JP4853595B2 - Computer system and access right management method thereof - Google Patents

Description

  The present invention relates to a computer system and an access right management method thereof. In particular, the present invention provides a different access right for each management area in a computer system capable of accessing from a terminal device in a plurality of management areas to a server device to be accessed via a network. It relates to the technology to set.

  Due to the development of networks, a method of accessing computers from a terminal device (client computer) to a server device (server computer) via a network has become common. In this case, the user of the terminal device normally logs in to the server device using a predetermined account (user ID) and password, and reads data stored in the server device to the terminal device, or conversely, the terminal device An operation of writing data stored in the apparatus to the server apparatus is performed. Since a large number of users can access the server device using their respective terminal devices, in order to ensure sufficient security for the data stored in the server device, it is usually necessary to A unique access right is set for each account, and access to the server device is permitted within the range of the access right corresponding to the account.

  However, in the case of a company having a large number of employees, sufficient security cannot always be ensured even if an operation is performed in which each individual employee has an access right according to his / her responsibility. In particular, it is difficult to prevent malicious staff from committing fraudulent activity within the scope of access rights granted to them. In order to deal with such a problem, for example, Patent Literature 1 below discloses a technique for setting different access rights depending on the network environment to which the terminal device is connected. Patent Document 2 discloses a technique for ensuring security by evacuating a file used by a user to another location each time the user logs out from the server device.

International Publication No. WO2005 / 081120 International Publication No. WO2005 / 081114

  An object of the present invention is to make it possible to set different access rights for each location where a terminal device is used. A more specific object of the present invention is to provide different access rights depending on the location of the terminal device even if the same user accesses the server device using the same terminal device. It is to be. For example, when accessing from a room that has been monitored by your boss, make sure that you have the right to access according to your job responsibilities, and access from a room that cannot be monitored, such as a break room or dining room. In some cases, only restricted access rights can be granted.

(1) According to a first aspect of the present invention, there is provided a computer system capable of accessing a device to be accessed from a device arranged in any of a plurality of management areas via a network.
A physical structure that surrounds the management area so that access to the management area is only possible by passing through a specific gate;
A server device installed outside or inside the management area and subject to access;
A terminal device having a function of accessing the server device via the network from at least the management area;
An information recording medium having an authentication code storage unit storing a predetermined authentication code, and a management code storage unit for storing a predetermined management code as necessary;
An electronic lock that has the function of locking and unlocking the gate, normally maintaining the locked state, and temporarily unlocking only when an unlocking instruction signal is given;
When a user who has an information recording medium enters or exits the management area through the gate, the authentication code stored in the authentication code storage unit is read, authentication is performed using the read authentication code, and the correct authentication result is displayed. A management unit that gives an unlocking instruction signal to the electronic lock when it is obtained;
Provided,
When a correct authentication result is obtained when the management unit enters a specific management area, the management unit performs a process of writing a specific management code set for the specific management area in the management code storage unit, When the user leaves the specific management area, the specific management code is deleted or invalidated from the management code storage unit,
When the terminal device accesses the server device, it reads out the management code stored in the management code storage unit , and transmits this to the server device,
The server device responds to the access from the terminal device under the condition corresponding to the management code transmitted from the terminal device.

(2) According to a second aspect of the present invention, in the computer system according to the first aspect described above,
As a management code, use a code including an access right code indicating a predetermined access right set for each management area,
The server device responds to the access from the terminal device within the range of the access right indicated by the access right code transmitted from the terminal device.

(3) According to a third aspect of the present invention, in the computer system according to the second aspect described above,
The management unit generates an auxiliary code that is temporarily valid based on a predetermined algorithm, and uses the management code including both the access right code and the auxiliary code,
Based on this algorithm, the server device determines the validity of the auxiliary code included in the management code, and if a determination result that the auxiliary code is invalid is obtained, access is prohibited. It is a thing.

(4) According to a fourth aspect of the present invention, in the computer system according to the second aspect described above,
The server device has a correspondence table between the access right code and the content of the access right, and responds to the access from the terminal device within the range of the access right determined by referring to this correspondence table.

(5) According to a fifth aspect of the present invention, in the computer system according to the fourth aspect described above,
In the correspondence table between the access right code and the content of the access right, a setting for referring to the content of the access right that differs according to the date and time is performed.

(6) According to a sixth aspect of the present invention, in the computer system according to the fourth aspect described above,
In the correspondence table between access right codes and access right contents, make settings to refer to different access right contents depending on the authentication code,
When the terminal device accesses the server device, the management code is read from the management code storage unit, the authentication code is read from the authentication code storage unit, and the management code and the authentication code are transmitted to the server device.
The server device refers to the correspondence table based on both the management code and the authentication code transmitted from the terminal device, and responds to the access from the terminal device within the range of the access right determined by referring to the correspondence table. It is what I did.

(7) According to a seventh aspect of the present invention, in the computer system according to the fourth aspect described above,
In the correspondence table between access right codes and access right contents, make settings to refer to the access right contents that differ depending on the authentication code and date,
When the terminal device accesses the server device, the management code is read from the management code storage unit, the authentication code is read from the authentication code storage unit, and the management code and the authentication code are transmitted to the server device.
The server device refers to the correspondence table based on both the management code and the authentication code transmitted from the terminal device, and responds to the access from the terminal device within the range of the access right determined by referring to the correspondence table. It is what I did.

(8) According to an eighth aspect of the present invention, in the computer system according to the first aspect described above,
The management unit is configured not to execute the management code writing process at a specific date and time.

(9) According to a ninth aspect of the present invention, in the computer system according to the first aspect described above,
The management unit has a function of reading the authentication code from the authentication code storage unit, and when the read authentication code is a specific code, the management code writing process is not executed.

(10) According to a tenth aspect of the present invention, in the computer system according to the first aspect described above,
The management unit has a function of reading the authentication code from the authentication code storage unit, and when the read authentication code is a specific code, the management code writing process is not executed at a specific date and time. It is.

(11) According to an eleventh aspect of the present invention, in the computer system according to the first aspect described above,
The terminal device performs authentication using the authentication code stored in the authentication code storage unit, and accesses the server device only when a correct authentication result is obtained.

(12) According to a twelfth aspect of the present invention, in the computer system according to the first aspect described above,
The server apparatus is an authentication server apparatus that performs an authentication process for accessing another server apparatus, and performs relay so that the access to the other server apparatus is performed under a condition corresponding to the transmitted management code. It is a thing.

(13) According to a thirteenth aspect of the present invention, in the computer system according to the first aspect described above,
The management unit,
When the user enters the management area, it communicates with the information recording medium, reads the authentication code stored in the authentication code storage unit, and performs the process of writing the management code in the management code storage unit,
An exit communication device that communicates with the information recording medium when the user leaves the management area and deletes or invalidates the management code from the management code storage unit;
A controller that performs authentication processing using the read authentication code, and controls the entrance and exit communication devices, and
It is constituted by.

(14) According to a fourteenth aspect of the present invention, in a computer system capable of accessing a device to be accessed from a device arranged inside any of a plurality of management areas via a network,
A server device installed outside or inside the management area and subject to access;
A terminal device having a function of accessing the server device via the network from at least the management area;
An information recording medium having a management code storage unit for storing a predetermined management code as required;
When a user who has an information recording medium enters a specific management area, a process is performed to write a specific management code set for the specific management area in the management code storage unit . A management unit that performs processing for deleting or invalidating the specific management code from the management code storage unit when leaving the management area;
Provided,
When the terminal device accesses the server device, it reads out the management code stored in the management code storage unit , and transmits this to the server device,
The server device responds to the access from the terminal device under the condition corresponding to the management code transmitted from the terminal device.

(15) According to a fifteenth aspect of the present invention, an access right is managed when a terminal device arranged in any of a plurality of management areas accesses a server device to be accessed via a network. In the method
Preparing an information recording medium in which a predetermined management code can be written if necessary;
Installing a management unit having a function of communicating with the information recording medium in the vicinity of the gate for entering and exiting the management area;
When the user carrying the information recording medium enters a specific management area through the gate, the management unit writes a specific management code set for the specific management area to the information recording medium; ,
When the user performs an operation for starting access to the server device via the network using the terminal device, the terminal device reads the management code written in the information recording medium, and stores this in the server device. Sending, and
The server device from the terminal device, when there is an access with the transmission of specific management code, under conditions corresponding to the specific management code, the method comprising: responsive to access from the terminal device,
When the user exits the specific management area through the gate, the management unit erases or invalidates the management code for the specific management area written in the information recording medium; and
Is to do.

(A) A first aspect as a reference example is the computer system according to the first aspect described above.
A plurality of management areas are provided, and the management unit uses a code including an area code for specifying each management area as a management code to be written when the user enters each management area.

(B) A second aspect as a reference example is the computer system according to the first aspect as the reference example described above.
The management unit generates an auxiliary code that is temporarily valid based on a predetermined algorithm, and uses a management code that includes both the area code and the auxiliary code.
Based on this algorithm, the server device determines the validity of the auxiliary code included in the management code, and if a determination result that the auxiliary code is invalid is obtained, access is prohibited. It is a thing.

(C) A third aspect as a reference example is the computer system according to the first aspect as the reference example described above.
In the server device, a correspondence table of individual area codes and access right codes indicating predetermined access rights is provided,
The server device refers to the correspondence table to recognize the access right code corresponding to the area code transmitted from the terminal device, and from the terminal device within the range of the access right indicated by the recognized access right code. It is intended to respond to access.

  According to the computer system of the present invention, the right to access the server device from the terminal device in the specific management area is determined based on the management code written in the information recording medium possessed by the user. In addition, the management code is written when the user having the information recording medium enters the management area, and is erased or invalidated when leaving the management code. Eventually, when a user who has an information recording medium in which a specific management code is written accesses from a terminal device, the server device recognizes that the access is from a specific management area. It becomes possible to do. Therefore, if a unique management code is prepared for each management area, different access rights can be set for each location where the terminal device is used. Thus, even if the same user accesses the server device using the same terminal device, different access rights can be given depending on the location where the terminal device is placed.

It is a block diagram which shows the whole structure of the computer system which concerns on fundamental embodiment of this invention. It is a block diagram of an example which shows the state which recorded the specific code | cord | chord on the information recording medium 400 shown in FIG. FIG. 2 is a diagram showing an example of a “correspondence table between management codes (area codes) and access right codes” provided in the authentication server device 100 shown in FIG. 1. FIG. 2 is a diagram illustrating an example of a “correspondence table between access right codes and access right contents” provided in the authentication server device 100 shown in FIG. 1. It is a block diagram of another example which shows the state which recorded the specific code | cord | chord on the information recording medium 400 shown in FIG. It is a figure which shows another example of the "correspondence table of the access right code and the content of access right" provided in the authentication server apparatus 100 shown in FIG. It is a figure which shows another example of the "correspondence table of the access right code and the content of access right" provided in the authentication server apparatus 100 shown in FIG. It is a figure which shows an example of the process table provided in management unit 340A shown in FIG. It is a figure which shows an example of the production | generation algorithm of the management code performed within the management unit 340A shown in FIG. It is a figure which shows another example of the production | generation algorithm of the management code performed within the management unit 340A shown in FIG. It is a block diagram of another example which shows the state which recorded the specific code | cord | chord on the information recording medium 400 shown in FIG. It is a perspective view which shows the specific construction example of the component of the management area A periphery in the computer system shown in FIG. It is a flowchart which shows the basic procedure of the access right management method which concerns on this invention.

  Hereinafter, the present invention will be described based on the illustrated embodiments.

<<< §1. Basic system configuration >>
First, a computer system according to a basic embodiment of the present invention will be described with reference to the block diagram of FIG. The illustrated computer system is a system in which each terminal device accesses the authentication server device 100 via the network 200 from various locations.

  Each closed area surrounded by a hatched portion in the figure is a specific management area. Here, for convenience of explanation, only two management areas A and B are shown, but in practice, a larger number of management areas are provided. Here, the management area refers to a region whose periphery is surrounded by a physical structure so that entry / exit is possible only by passing through a specific gate (a plurality of gates may be present). In the case of the illustrated example, the management area A is surrounded by a physical structure 300A, and can only enter and exit through the gate 310A. Similarly, the management area B is surrounded by a physical structure 300B, and can only enter and exit through the gate 310B.

  A typical example of the management area is a room in a building. For example, when the management area A is a room, the physical structure 300A is constituted by a wall, floor, and ceiling of the room, and the gate 310A is constituted by a door provided at the entrance of the room. However, the management area referred to in the present invention is not necessarily a living room, and may be a factory, a work place, a warehouse, or the like. Moreover, since it does not necessarily need to be an indoor facility, it may be an outdoor facility surrounded by a fence.

  As illustrated, the terminal device 320A is installed in the management area A, and the terminal device 320B is installed in the management area B. Each of the terminal devices 320A and 320B can access the authentication server 100 via the network 200. Each terminal device 320A, 320B may be any device as long as it has a function of accessing the authentication server 100. Generally, a desktop personal computer or a notebook personal computer is used as a terminal device, but a mobile phone, a PDA device, or the like may be used as a terminal device. In the case of a portable terminal device such as a notebook computer, a mobile phone, or a PDA device, the user can carry it appropriately. Therefore, it can be taken out from the management areas A and B, or can be brought into the management areas A and B from the outside. These terminal devices are only required to have a function of accessing the server device 100 from at least the management areas A and B via the network 200, and the server device 100 is accessed from outside the management areas A and B. Whether or not it is accessible is unquestioned when implementing the present invention.

  On the other hand, the network 200 can also be configured by various networks such as a LAN, a WAN, and the Internet. In FIG. 1, a line is drawn between each of the terminal devices 320A and 320B and the network 200, but the connection to the network may be wired or wireless. When a wired connection is performed, a wiring such as a LAN cable is provided in the management area. When a wireless connection is performed, a wireless LAN facility is provided in the management area.

  As described above, in the example shown in FIG. 1, the terminal device 320A in the management area A can access the authentication server device 100 outside the management area A via the network 200. Similarly, the management area The terminal device 320B in B can access the authentication server device 100 outside the management area B via the network 200. In the illustrated example, the authentication server device 100 is not drawn in the management area surrounded by the physical structure, but this is because the authentication server device 100 is located in a location surrounded by some physical structure. This is because the installation is irrelevant to the operation of the computer system. Of course, in practice, the authentication server device 100 is installed in an appropriate management area (usually an indoor room).

  Therefore, in the present application, the phrase “a server device installed outside the management area and subject to access” does not mean “the server device is not surrounded by a physical structure”. This means that “when a focus is placed on access from a specific terminal device in a specific management area, the server device to be accessed is outside the specific management area”. For example, in FIG. 1, “If attention is paid to access from the terminal device 320A in the management area A, the authentication server device 100 is installed outside the management area A”. Of course, in this case, the authentication server device 100 may be installed in the management area Z for server installation, for example.

  In the present application, the server device to be accessed may be installed in the same management area as the terminal device that performs access. That is, in the example shown in FIG. 1, the authentication server device 100 to be accessed is set outside the management areas A and B, but the authentication server device 100 may be installed in the management area A. . In this case, the terminal device 320A accesses the authentication server device 100 installed in the same management area A via the network 200. Of course, the authentication server device 100 may be installed in the management area B. Here, for the sake of convenience, as shown in FIG. 1, the following description will be given with respect to an example in which the server device is installed outside the management area in which the terminal device is installed, but the server device is the same as the terminal device. The basic operation as a system is the same when installed in the management area.

  In the case of the embodiment illustrated in FIG. 1, the server device 100 is an authentication server device, and is a dedicated server for authenticating a user who has accessed through the network 200. In the illustrated example, another server device 110 or 120 is connected to the authentication server device 100, and another server device 130 is connected to the network 200. The original access targets of the terminal devices 320A and 320B are not the authentication server device 100 but other server devices 110, 120, and 130. The authentication server device 100 has a function of performing the authentication processing necessary for the original access as a representative. Of course, the server devices 110, 120, and 130 may be installed in the management areas A and B. In the present invention, it is important to recognize “in which management area the terminal device on the access side is located”, and the location of the server device on the access side may be anywhere.

  As described above, when a method of accessing each of the server devices 110, 120, and 130 via the authentication server device 100 is adopted, the user has a predetermined account and a predetermined account with respect to the representative authentication server device 100. It is possible to access the server apparatuses 110, 120, and 130 only by performing a login procedure using a password. That is, since it is not necessary to individually log in to each of the server devices 110, 120, and 130 through an authentication procedure, the complexity of the login work can be eliminated. Such a method is generally called a single sign-on method.

  This single sign-on method has an advantage that the complexity of login work can be eliminated from the standpoint of the user. However, from a security point of view, it must be said that the method has a vulnerability. That is, if the authentication server device 100 can be successfully authenticated and logged in once, it becomes possible to access all the server devices 110, 120, and 130.

  In the present invention, since different access rights can be set for each management area where the terminal device is used, security can be improved and vulnerability of the single sign-on method can be compensated. . Therefore, the present invention can take a particularly effective security measure for a computer system employing the single sign-on method using the authentication server device 100 as in the example shown in FIG.

  However, the application of the present invention is not limited to a computer system adopting the single sign-on method. That is, in the example shown in FIG. 1, since the present invention is applied to a computer system that adopts the single sign-on method, the access target at the time of authentication of the terminal devices 320A and 320B is the authentication server device 100. In the present invention, the access target at the time of authentication of the terminal device does not necessarily need to be the authentication server device 100, and may be a server device (for example, the server devices 110, 120, and 130) that is the original access target.

<<< §2. Entrance / exit to the management area >>>
In the management area A shown in FIG. 1, an electronic lock 330A and a management unit 340A are provided as shown. The electronic lock 330A has a function of locking and unlocking the gate 310A, normally maintains the locked state, and temporarily unlocks only when an unlocking instruction signal is given. The management unit 340A has a function of controlling the electronic lock 330A. Similarly, in the management area B, an electronic lock 330B and a management unit 340B are provided as shown. The electronic lock 330B has a function of locking and unlocking the gate 310B, normally maintains a locked state, and temporarily unlocks only when an unlocking instruction signal is given. The management unit 340B has a function of controlling the electronic lock 330B.

  In the block diagram of FIG. 1, for convenience, the blocks of the electronic locks 330A and 330B and the management units 340A and 340B are arranged in the management areas A and B, respectively. It does not necessarily have to be placed inside each management area. For example, the electronic lock 330A may be embedded in the physical structure 300A (room wall) or the gate 310A (room door), or may be provided outside these. Similarly, the management units 340A and 340B may be provided outside the management areas A and B. In FIG. 1, for convenience of explanation, the management units 340A and 340B are shown as independent blocks. However, in practice, a plurality of management units 340A and 340B may be configured by the same control computer. Absent.

  On the other hand, the information recording medium 400 is a portable digital data recording medium and is distributed to the user P. Although only an example in which the information recording medium 400 is distributed to one user P is shown in the figure, in practice, a dedicated information recording medium 400 is provided to each of a large number of users who use this computer system. Will be distributed. An electronic device such as an IC card can be used as the information recording medium 400. In the embodiment shown here, an example in which a non-contact type IC card is used as the information recording medium 400 will be described. Of course, a cellular phone, a PDA device, or the like can be used as the information recording medium 400. Recently, an increasing number of companies have introduced IC cards as identification cards such as employee ID cards. When such a company uses the computer system according to the present invention, it is convenient to divert this existing IC card as the information recording medium 400 as it is.

  The information recording medium 400 functions as an electronic key for entering and leaving the management areas A and B. That is, the user P having the information recording medium 400 can unlock the electronic locks 330A and 330B using the information recording medium 400 when passing through the gates 310A and 310B. In the example shown here, since the information recording medium 400 is a non-contact type IC card, it has a function of performing wireless communication with the management units 340A and 340B. The management units 340A and 340B perform an authentication process by wireless communication, and then give an unlock instruction signal to the electronic locks 330A and 330B.

  The information recording medium 400 is provided with an authentication code storage unit 410 and a management code storage unit 420. In the embodiment shown here, since the IC card is used as the information recording medium 400, each of these storage units 410 and 420 is constituted by a part of a storage area of a memory (for example, EEPROM) built in the IC card. The The authentication code storage unit 410 stores a predetermined authentication code in advance. On the other hand, as will be described later, the management code storage unit 420 is an area for storing a predetermined management code as necessary, and no meaningful data is written in the initial state.

  The management units 340A and 340B execute an authentication process using an authentication code stored in the information recording medium 400 when the user P enters and exits the management areas A and B. For example, when the user P enters the management area A through the gate 310A, the user P brings the information recording medium 400 possessed so as to enter the communication range of the management unit 340A. Then, the management unit 340A wirelessly communicates with the information recording medium 400, reads the authentication code stored in the authentication code storage unit 410, performs authentication using the read authentication code, and obtains a correct authentication result. In this case, a process of giving an unlock instruction signal to the electronic lock 330A is performed. Accordingly, the electronic lock 330A temporarily unlocks the gate 310A, so that the user P can enter the management area A through the gate 310A. Conversely, the same applies to the case where the user exits the management area A through the gate 310A.

  Eventually, the authentication code stored in the authentication code storage unit 410 is a code that functions as an electronic key for the electronic lock 330A. In the example shown here, this authentication code also functions as an electronic key for the electronic lock 330B in the management area B. Therefore, if the user P has the information recording medium 400, the user P can freely enter and leave the management areas A and B.

  Of course, each information recording medium 400 distributed to each user stores a separate authentication code, and for each authentication code, which management area can be entered and exited is determined. In practice, a list specifying authentication codes that allow entry and exit for each management area may be prepared. Then, for example, when the authentication code read from the information recording medium 400 possessed by the user P is a code posted in this list, the management unit 340A determines that the authentication is successful. Then, a process of giving an unlocking instruction signal to the electronic lock 330A can be performed. Of course, if the code is not on the list, the management unit 340A determines that the authentication has failed, and does not output the unlock instruction signal. Therefore, the gate 310A is maintained in the locked state, and the user can Cannot pass 310A.

  Thus, the first role of the management unit 340A is the authentication stored in the authentication code storage unit 410 when the user P having the information recording medium 400 enters and exits the management area A through the gate 310A. The code is read, the authentication using the read authentication code is performed, and when the correct authentication result is obtained, the unlocking instruction signal is given to the electronic lock 330A. In this case, the management unit 340A functions as an entrance / exit management device for the management area A.

  On the other hand, the management unit 340A has the following second role. That is, when the user P enters the management area A and the correct authentication result is obtained by the process related to the first role, the management unit 340A uses the management code set for the management area A as the management code. A process of writing to the storage unit 420 is performed. Conversely, when the user P leaves the management area A, a process of deleting the management code from the management code storage unit 420 is performed.

  Of course, the management unit 340B also has two roles in exactly the same way. That is, the management unit 340B reads the authentication code stored in the authentication code storage unit 410 when the user P enters and exits the management area B through the gate 310B, and performs authentication using the read authentication code. When a correct authentication result is obtained, a process of giving an unlocking instruction signal to the electronic lock 330B is performed, and when the user P enters the management area B and the correct authentication result is obtained, the management area The management code set for B is written into the management code storage unit 420. Conversely, when the user P leaves the management area B, the management code is deleted from the management code storage unit 420. .

  Next, the process performed as the second role described above will be described with a specific example. FIG. 2 is a block diagram of an example showing a state where a specific code is recorded on the information recording medium 400 shown in FIG. In the example shown in the figure, an authentication code “8888” is stored in the authentication code storage unit 410, and a management code “AAA” is stored in the management code storage unit 420. Here, as described above, the authentication code “8888” is a code that functions as an electronic key for unlocking the electronic locks 330A and 330B. In the embodiment described here, the authentication code “8888” is for a specific user P. This is an identification code unique to the issued information recording medium 400. Therefore, in a normal usage mode, it is not necessary to rewrite the authentication code “8888”.

  On the other hand, the management code “AAA” should be called “a code indicating the location of the user P”, and the management code “AAA” indicating the management area A is recorded in the information recording medium 400. In this case, it means that “the user P who owns the information recording medium 400 is in the management area A”. As described above, when a correct authentication result is obtained when the user P enters the management area A, the management code “AAA” set for the management area A is stored in the management code storage unit 420 by the management unit 340A. Written. Of course, if a correct authentication result is not obtained, the user P cannot enter the management area A.

  Therefore, when the user P carrying the information recording medium 400 enters the management area A, the management code “AAA” is written in the management code storage unit 420 in the information recording medium 400. Become. On the other hand, when the user P leaves the management area A, the management code “AAA” is deleted by the management unit 340A. Therefore, while the user P stays in the management area A, the management code “AAA” is recorded in the management code storage unit 420, but if the user P goes out of the management area A, The management code “AAA” is deleted.

  The management code “AAA” is a code set in advance for the management area A. In the embodiment described here, an area code for specifying each management area is used as it is as a management code. Here, for convenience, the following description will be made assuming that the area code for specifying the management area A is “AAA” and the area code for specifying the management area B is “BBB”. Any code may be used as long as the area code can specify each management area. For example, for a management area such as room 823 in the sixth building of the head office, an area code consisting of a code such as “Head Office-6-823” can be defined, and the area code can be used as it is as a management code. do it.

  After all, in the case of the example shown in FIG. 1, no code is recorded in the management code recording unit 420 in the information recording medium 400 in the initial state, but when the user P enters the management area A, the management unit 340A. The management code “AAA” (area code of the management area A) is written by (in the state shown in FIG. 2), and when the user P leaves the management area A, the management unit 340A causes the management code “AAA”. When the user P enters the management area B, a management code “BBB” (area code of the management area B) is written by the management unit 340B, and when the user P leaves the management area B, the management unit 340B The management code “BBB” is erased by 340B.

  In general, an IC card is an electronic medium with high security, and there is very little possibility of unauthorized tampering with data written therein. Therefore, if an IC card is used as the information recording medium 400, the codes recorded in the authentication code storage unit 410 and the management code storage unit 420 are considered as data having sufficient reliability in practice. Good. Therefore, if it can be detected that the management code “AAA” is written in the management code storage unit 420, “the user who owns the information recording medium 400 (IC card) is in the management area A at that time. Similarly, if the state where the management code “BBB” is written can be detected, “if the user who owns the information recording medium 400 (IC card) Can be determined with sufficient reliability.

  In the example shown in FIG. 1, only two management areas A and B are shown. However, in practice, more management areas are provided, and each management unit is provided when a user enters each management area. In addition, an area code for specifying each management area is written as a management code to the information recording medium 400 possessed by the user. If a unique area code is defined for each management area, the location of the information recording medium 400 (that is, the location of the owner) is determined by the management code (area code) written in the information recording medium 400. ) Can be uniquely recognized.

<<< §3. Access to server device >>
In the computer system according to the present invention, by using a management code having such characteristics, different access rights can be set for each management area. For this purpose, the following devices are also applied to the terminal device to be accessed and the server device to be accessed.

  First, when accessing the authentication server device 100, the terminal devices 320 </ b> A and 320 </ b> B read the management code from the management code storage unit 420 in the information recording medium 400 possessed by the user P and store it in the server device 100. It has a function to send. Specifically, a processing routine for reading and transmitting the management code may be incorporated in a program for accessing the authentication server device 100.

  In the embodiment shown here, since the information recording medium 400 is an IC card, the terminal devices 320A and 320B are provided with a reader / writer device and a communication program for communicating with the IC card. In practice, the terminal devices 320A and 320B request the user to input an account code and a password, and store them in the authentication code storage unit 410, although this is not an essential matter for carrying out the present invention. It is preferable to perform authentication (pre-authentication before starting access to the server) using the authenticated authentication code, and to access the authentication server device 100 only when a correct authentication result is obtained. .

  For example, let us consider a case where the user P operates the terminal device 320A in the management area A to access the authentication server device 100. In this case, the user P has already been authenticated by the management unit 340A when passing through the gate 310A (that is, authentication by the authentication code “8888” in the authentication code storage unit 410 has been successful). ). However, this authentication is merely authentication for entering the management area A, and is not authentication for authority to operate the terminal device 320A. Therefore, when the user P uses the terminal device 320A, the user P inputs a predetermined account and password, and further inserts the information recording medium 400 (non-contact IC card) into the reader / writer device provided in the terminal device 320A. The user is allowed to approach and authenticate the authority to operate the terminal device 320A. That is, the terminal device 320A checks the validity of the account and password, reads the authentication code “8888” from the information recording medium 400, and authenticates whether or not the code is given a right to use.

  Here, it is assumed that a list of terminal devices to which use authority is given by the authentication code “8888” is prepared in the authentication server device 100. In this case, the terminal device 320 </ b> A may transmit the authentication code “8888” to the authentication server device 100 via the network 200 and inquire about the use authority for itself. What is necessary is just to inquire the authentication server apparatus 100 also about the item required for the validity check of an account and a password. Of course, if all information necessary for authentication is stored in the terminal device 320A, an inquiry to the authentication server device 100 is unnecessary.

  As described above, in the embodiment described here, when the user P starts to operate the terminal device 320A, the terminal device 320A reads the authentication code “8888” from the information recording medium 400, and the terminal device 320A is Authentication about the authority to operate will be performed. Therefore, at this time, the management code “AAA” is also read, and this management code “AAA” is transmitted to the authentication server device 100. In the case of the embodiment described here, both the authentication code “8888” and the management code “AAA” are transmitted from the terminal device 320 </ b> A to the authentication server device 100. This is nothing but a process of notifying the authentication server device 100 that the user P given the authentication code “8888” desires access from the management area A specified by the management code “AAA”.

  If the authentication code “8888” and the management code “AAA” are thus transmitted from the terminal device 320A, the authentication server device 100, as described above, the authorized code “8888” is authorized to operate the terminal device 320A. After confirming that the authentication code has, access is permitted. At this time, however, the access is accepted under the condition corresponding to the management code “AAA”. In other words, even if the same user P wishes to access with the same authentication code “8888”, the management code “AAA” is transmitted (that is, when access is made from the management area A). ) And when the management code “BBB” is transmitted (that is, when accessing from the management area B), the access is accepted under different conditions.

  Let me illustrate this with a specific example. FIG. 3 is a diagram showing an example of a “correspondence table between management codes (area codes) and access right codes” provided in the authentication server device 100 shown in FIG. A management code (area code) is shown in the left column of the table, and an access right code corresponding to this is shown in the right column. For example, an access right code “L1” is associated with the management code “AAA”, and an access right code “L3” is associated with the management code “BBB”. In the case of this example, three types of access right codes L1, L2, and L3 are defined in total, and each access right code indicates a security level index.

  That is, the access right code “L1” indicates that the access right up to the action for which the highest security level is set is given, and the access right code “L2” is for the action for which the medium security level is set. The access right code “L3” indicates that the access right is given only for an action for which the lowest security level is set.

  The important point here is that these access right codes are not set for individual users, but are set for individual management areas. The management code (area code) in the left column of the correspondence table in FIG. 3 indicates a specific management area and does not indicate a specific user. According to this correspondence table, the access right code “L1” is associated with the management code “AAA”, but if this is an access from the management area A, the access right indicated by “L1” is given. It is shown that. Similarly, the access right code “L3” is associated with the management code “BBB”, and this indicates that if the access is from the management area B, the access right indicated by “L3” is given. ing.

  FIG. 4 is a diagram illustrating an example of a “correspondence table between access right codes and access right contents” provided in the authentication server device 100 shown in FIG. As shown in the figure, with the access right code “L1” corresponding to the highest security level, all actions of reading, rewriting (overwriting an existing file), and writing (saving a new file) are permitted. On the other hand, with the access right code “L2” corresponding to the medium security level, data reading and rewriting are permitted, but writing is not permitted. In addition, with the access right code “L3” corresponding to the lowest security level, only data reading is permitted. Of course, the correspondence table shown in FIG. 4 shows a simple setting example regarding the contents of specific access rights, and various settings can be practically performed. For example, detailed access such as whether data can be downloaded, whether it is possible to print out on paper using a printer, whether data can be copied to a medium such as a CD-R, etc. It is also possible to set the content of the right.

  As described above, in the authentication server device 100 shown in FIG. 1, there is a correspondence table between “individual management codes (area codes)” and “access right codes indicating predetermined access rights” as shown in FIG. Therefore, the authentication server device 100 recognizes the access right code corresponding to the area code transmitted from the terminal devices 320A and 320B by referring to the correspondence table, and indicates the access right code by the recognized access right code. The access from the terminal devices 320A and 320B can be accommodated within the range of the access right. Specifically, in the authentication server device 100, a “correspondence table between access right codes and access right contents” as shown in FIG. 4 is also prepared, and the access right determined by referring to this correspondence table. Within the range, it is possible to respond to access from the terminal devices 320A and 320B.

  Therefore, in the case of the embodiment shown here, when the user P accesses the authentication server device 100 by operating the terminal device 320A in the management area A, the access right code “AAA” corresponding to the management code “AAA”. All actions of reading, rewriting, and writing of data are permitted within the range of the access right indicated by “L1”. On the other hand, when the same user P accesses the authentication server device 100 by operating the terminal device 320B in the management area B, it is indicated by the access right code “L3” corresponding to the management code “BBB”. Within the range of access rights to be granted, that is, only data reading is permitted.

  As described above, in the embodiment shown in FIG. 1, the authentication server device 100 is a device that performs an authentication process for accessing another server device 110, 120, 130, and has been transmitted from the terminal device. Under the conditions corresponding to the management code, relaying is performed so that access to these different server apparatuses 110, 120, and 130 is performed. In this embodiment, the single sign-on method described above is adopted, and when the user P accesses the authentication server device 100 by operating the terminal device 320A in the management area A, the server devices 110 and 120 are used. , 130 can be performed within the range of the access right indicated by the access right code “L1”, that is, data can be read, rewritten, and written.

<<< §4. Advantages of the system according to the present invention >>
In this way, if different access rights can be set for each management area where the terminal device is used, it is effective in suppressing fraud. For example, in the example shown in FIG. 1, the management area A is a work room for performing normal work, and is always a room that is carefully monitored by a boss or a colleague, whereas the management area B is a break. Consider a room that is unattended depending on the time of day. In this case, the work room in the management area A is in an environment where it is difficult to perform cheating, but the break room in the management area B is in an environment in which cheating is easily induced. However, according to the above-described example, even if the user P is exactly the same, when accessed from the management area B, the content of the access right to be given is greatly limited. Even in this case, the system can prevent fraud. This is the essential effect of the present invention.

  The conventional concept of ensuring security is a concept that always targets humans, and presumes that each person is given access rights according to their responsibilities and positions. In other words, an individual person can exercise a given access right anytime and anywhere. In other words, as long as a terminal device that can be connected to the network can be prepared, the user can log in to the server device using a predetermined account and password anytime and anywhere, and can perform various actions within the scope of the given access right. .

  In addition, as a countermeasure against an account or password being stolen, an operation that requires authentication using an IC card or the like has been conventionally performed. In the above-described embodiment, when the terminal device is operated, the condition that the authentication using the authentication code in the information recording medium 400 is successful is based on a security measure based on such an idea. Yes. Even if an account or password is stolen, unauthorized access cannot be made unless an authorized IC card is obtained.

  As described above, the conventional security measures have a “regular IC card”, and if there is an access from a user who knows the “regular account and password”, this is regarded as regular access. Based on the concept of permitting access within the scope of the access right given to the user. This is merely a security measure based on the premise that “a legitimate user never performs a fraud”, and it is completely powerless when a legitimate user commits a fraud.

  On the other hand, the present invention exhibits a sufficient effect in preventing an illegal act by an authorized user. That is, in the computer system according to the present invention, in order to access with a regular access right, the user has a “regular IC card” and knows the “regular account and password”. In addition to the two security conditions, a third condition that access is made from a “regular place” is further required. Therefore, as in the example described above, if an operation is performed so as to give a legitimate access right only when access is made from a room that is always monitored by the supervisor or colleagues, fraudulent acts by legitimate users are suppressed. An effect is obtained.

  In carrying out the present invention, each terminal device does not need to be fixed in a specific management area. For example, in the example shown in FIG. 1, the terminal device 320A does not need to be a device fixed in the management area A, and may be a device that can be easily carried, such as a laptop computer. Of course, the user P may be a personal computer brought from home. This is because in the system according to the present invention, the access right is not set for a specific terminal device, but is set for a specific management area.

  For example, a user P who enters the management area A leaves the management area A while holding the terminal device 320A, brings the terminal device 320A into the management area B, and uses the terminal device 320A from the management area B to authenticate the server. Even if the access to 100 is performed, the management code “BBB” is written in the management code storage unit 420 of the information recording medium 400. Therefore, even if the terminal device 320A is used, the access right given is only managed. The access right set for area B is obtained. Therefore, in the case of the above-described example, unless the user P accesses from within the management area A, the user P cannot access with the original access right necessary for performing the business.

  If each management area is provided with a terminal device installed in a state where it cannot be moved, the management code is stored in the terminal device itself and the server device is accessed from the terminal device. May transmit the management code stored in the terminal device itself to the server device. In this case, it is not necessary to read out the management code in the information recording medium possessed by the user. For example, when the terminal device 320A shown in FIG. 1 is a device that is embedded and installed in the wall of a room constituting the management area A, the use of the terminal device 320A is always limited to the management area A. Therefore, the management code “AAA” may be stored in the terminal device 320A and transmitted to the authentication server device 100.

<<< §5. Some variations >>>
As described above, in §1 to §4, the computer system according to the basic embodiment of the present invention has been described. Here, some modified examples will be described.

(1) Example of using management code indicating access right In the basic embodiment, the management units 340A and 340B specify each management area as a management code to be written in the management code storage unit 420 in the information recording medium 400. An example using an area code is shown. For example, in the example shown in FIG. 2, the area code “AAA” for specifying the management area A is written as the management code. As described above, when the area code “AAA” is used as the management code, the authentication server device 100 that receives the access with the management code recognizes that the access is performed from within the management area A. Therefore, using the correspondence table as shown in FIG. 3, it is recognized that the access right code set for the access from the management area A is L1, and it corresponds to the access right code L1 shown in FIG. Based on the contents of the access right, it is possible to respond to the access.

  In the modification described here, this access right code itself is used as a management code. That is, a predetermined access right code is set for each management area in advance, and the access right code set for the management area is stored in the management unit for each management area. For example, in FIG. 1, the access right code L1 may be stored in the management unit 340A, and the access right code L3 may be stored in the management unit 340B. In this case, when the user P enters the management area A, the access right code “L1” is stored in the management code storage unit 420 of the information recording medium 400 possessed by the management unit 340A as shown in FIG. Is written as a management code. Therefore, the access right code “L1” is transmitted as a management code also from the terminal device 320A to the authentication server apparatus 100, and the authentication server apparatus 100 immediately recognizes the access right code for the access. It becomes possible to do. In this way, the authentication server device 100 can respond to access from the terminal device within the range of the access right indicated by the access right code. That is, the authentication server device 100 does not need the correspondence table as shown in FIG. 3, and it is sufficient to prepare only the correspondence table shown in FIG.

  Of course, information indicating the content of the access right itself as shown in the right column of FIG. 4 can be used as it is as a management code. In this case, the authentication server device 100 does not need the correspondence table shown in FIG. As described above, the management code in the present invention is any code as long as it is “some code that can be used to determine the access right for the management area” set for each management area. It doesn't matter. However, as described in the basic embodiment, when the area code is used as the management code, the authentication server apparatus 100 side determines which management area the access is from when the terminal apparatus accesses. There is an advantage that it can be grasped.

(2) Example of setting different access right according to date and time and authentication code FIG. 6 shows another example of “correspondence table between access right code and access right content” provided in the authentication server device 100 shown in FIG. It is a figure which shows an example. In the case of the correspondence table shown in FIG. 4, only one content of the access right is set for one access right code. However, in the case of the correspondence table shown in FIG. Different contents are set according to the time of day.

  In other words, the access right code “L1” is always set to “all access is possible”, not limited to the date and time, but the access right codes “L2” and “L3” are either weekdays or Saturday / Sunday. -Different settings are made depending on whether it is a holiday. Therefore, when accessing from a management area where the access right code “L1” is set, the access is always “all accessible”, whereas access from the management area where the access right code “L2” is set. Can only be done on weekdays. Access from the management area in which the access right code “L3” is set is limited to weekdays and only data can be read.

  Although FIG. 6 shows an example in which different settings are made on a daily basis such as day of the week, it is of course possible to make different settings on a time basis. For example, even if the settings are related to the same weekday, the time zone is divided into a time zone of 09: 0 to 17:00, a time zone of 17:00 to 23:00, and a time zone of 23: 0 to 09:00. It is also possible to set different contents of access rights for each.

  In this way, in the correspondence table between the access right code and the content of the access right, a setting for referring to the content of the access right that differs according to the date and time is performed, and the server device is set according to the date and time when the server receives the access. By referring to the setting contents of the corresponding date and time, it is possible to set different access rights depending on the date and time even when the same user accesses from the same management area. Such an operation is effective in preventing fraudulent acts in a special environment where supervisors and colleagues are not easily monitored, such as during overtime or on holiday.

  On the other hand, FIG. 7 is a diagram showing still another example of the “correspondence table between access right codes and access right contents” provided in the authentication server device 100 shown in FIG. In the case of this correspondence table, a plurality of different contents are set for one access right code depending on the authentication code. As already described, the authentication code is a code stored in the authentication code storage unit 410 in each information recording medium 400. In the embodiment described here, the authentication code is a unique code issued to a specific user P. This is an identification code.

  Therefore, for example, in a certain company, a unique authentication code in the range of 0000-0999 is given to each executive, and a unique authentication code in the range of 1000-9999 is given to the general staff. If a correspondence table as shown in FIG. 7 is prepared in the authentication server device 100, different access rights can be set depending on whether the person who performs the access is an executive or general employee. It becomes possible.

  That is, in the “correspondence table between access right codes and access right contents” prepared in the authentication server device 100, a setting for referring to the contents of access rights that differ depending on the authentication code is made. When the user P accesses the authentication server device 100 using the terminal device 320A, the terminal device 320A reads the management code from the management code storage unit 420, and also obtains the authentication code from the authentication code storage unit 410. The management server and the authentication code are both read and transmitted to the authentication server device 100.

  On the other hand, the authentication server device 100 may determine the contents of the access right by referring to the correspondence table as shown in FIG. 7 based on both the transmitted authentication code and management code. For example, when the access right code indicated by the management code is “L2”, if the authentication code is within the range of 0000 to 0999 (that is, access by a director), all accesses are allowed and authentication is performed. If the code is in the range of 1000 to 9999 (that is, access by a general staff member), all access is disabled.

  Of course, it is also possible to combine the method of setting different access rights according to the date and time as shown in FIG. 6 and the method of setting different access rights according to the authentication code as shown in FIG. In this case, in the “correspondence table between access right codes and access right contents” prepared in the authentication server apparatus 100, settings for referring to the access right contents that differ depending on the authentication code and the date and time are set. To do. For example, when the terminal device 320A accesses the authentication server device 100, the management code is read from the management code storage unit 420, the authentication code is read from the authentication code storage unit 410, and both codes are read from the authentication server. The data is transmitted to the device 100. Then, the authentication server device 100 refers to the correspondence table based on both the transmitted management code and authentication code, and within the range of the access right determined by referring to this correspondence table, the terminal device 320A. It can respond to access from.

(3) Example of writing management code according to date / time and authentication code In the embodiment described so far, when the user P enters the management area, the management code set for the management area is always information. It was written in the recording medium 400. In the modification described here, this writing process is performed or not performed according to the date and time or the authentication code.

  FIG. 8 is a diagram showing an example of a processing table provided in the management unit 340A shown in FIG. As already described, when the user P enters the management area A and brings the information recording medium 400 possessed closer to the management unit 340A, the authentication code stored in the authentication code storage unit 410 (for example, “8888”) is read out to the management unit 340A side. At this time, in the basic embodiment described above, the management unit 340A unconditionally writes the management code “AAA” to the management code storage unit 420. In the case of the modification described here, the management unit 340A refers to the processing table shown in FIG. 8 and determines whether or not the management code “AAA” should be written.

  That is, when the processing table shown in FIG. 8 is prepared, the management code “AAA” is always written regardless of the read authentication code on weekdays. However, on Saturdays, Sundays, and holidays, if the read authentication code is within the range of 0000-0999 (that is, if the user who is going to enter is a director), the management code “AAA” is written. However, if the authentication code is in the range of 1000 to 9999 (that is, if the user trying to enter is a general employee), the management code “AAA” is not written. Of course, in this processing table, the time zone is divided into a time zone of 09: 0 to 17:00, a time zone of 17:00 to 23:00, and a time zone of 23: 0 to 09:00. It is also possible to make different settings for the time zone.

  In short, when the authentication code read from the authentication code storage unit 410 is a specific code, the management unit does not execute the management code writing process at a specific date and time. In the case of the example shown in FIG. 8, when the authentication code read from the authentication code storage unit 410 is a code within the range of 1000 to 9999, the management code writing process is executed on Saturdays, Sundays, and holidays. Will not.

  As described above, in the modification described here, the management code may not be written in the management code control unit 420 even when the user enters the predetermined management area. If no management code is written in the management code storage unit 420, the terminal device cannot transmit the management code to the authentication server device 100. Thus, when the management code has not been transmitted, the authentication server device 100 refuses access.

  In the event of such an operation, after all, in the case of executives, access according to the management code “AAA” is always possible from within the management area A, but in the case of general staff, on Saturdays, Sundays and holidays, Access from within the management area A is impossible. Even if a general staff enters the management area A on Saturdays, Sundays, and holidays, the management code “AAA” is not written in the management code storage unit 420, so the terminal device 320A sends the management code to the authentication server. This is because it cannot be transmitted to the device 100 and access is denied by the authentication server device 100.

  FIG. 8 illustrates a processing table for determining whether or not to perform the writing process with reference to both the date and the authentication code. Of course, whether or not the writing process is performed based only on the date and time. It is also possible to use a processing table that determines whether or not to write, or a processing table that determines whether or not to write based on only the authentication code. In the former case, the management unit does not execute the management code writing process at a specific date and time. In the latter case, the management unit reads the authentication code from the authentication code storage unit 410 as a specific code. In this case, the management code writing process is not executed.

(4) Example Using Management Code Including Auxiliary Code FIG. 2 shows an example using the area code “AAA” as the management code, and FIG. 5 shows an example using the access right code “L1” as the management code. showed that. When an IC card is used as the information recording medium 400, relatively sufficient security is secured for the management code written in the management code storage unit 420. However, the management code may be read from the IC card by some illegal method. Further, by performing some kind of illegal device on the terminal device side, there is a possibility that the management code is illegally acquired in the process of transmitting the management code written in the IC card to the server device.

  In order to cope with such a problem, it is effective to use a different management code every time the server apparatus is accessed. Then, even if the management code is illegally acquired, the management code is only valid once, so it is possible to prevent unauthorized access to the server device using the illegally acquired management code. can do. For this purpose, an auxiliary code that is temporarily effective is generated in the management unit 340A based on a predetermined algorithm, and a management code including this auxiliary code is used.

  FIG. 9 is a diagram illustrating an example of a management code generation algorithm performed in the management unit 340A. Here, as a supplementary code generation algorithm, a method of using the current date data is employed. In other words, an 8-digit numeric string consisting of 2 digits of “day” data of the day, 2 digits of “month” data, and 4 digits of “year” data is used as an auxiliary code, and this is added after the area code. As a result, a temporarily valid management code is generated. The example of FIG. 9 is an example in which a management code is generated on September 18, 2006, and a management code “AAA18092006” is generated.

  For example, if the management unit 340A shown in FIG. 1 is provided with a function for generating an auxiliary code that is temporarily effective based on a predetermined algorithm as described above, the management code storage unit 420 has an area code “AAA”. ”And the auxiliary code“ 18092006 ”are written, and the management code is transmitted to the authentication server device 100.

  On the other hand, the authentication server apparatus 100 side determines the validity of the auxiliary code included in the transmitted management code based on the completely same algorithm, and obtains a determination result that the auxiliary code is invalid. If so, take measures to prohibit access. In the case of the above-described algorithm, the management code has a configuration in which the first three characters are an area code and the subsequent eight characters are an auxiliary code. Therefore, the authentication server device 100 separates both codes and adds an auxiliary code. Determine the validity of a piece of code. That is, based on the date of the day, a correct auxiliary code “18092006” is generated, and it is determined whether or not it matches the auxiliary code included in the transmitted management code. do it. By doing so, even if the management code is illegally acquired, the management code is valid only on that day, so the possibility of unauthorized access to the authentication server device 100 can be reduced. .

  Of course, the auxiliary code generation algorithm can be arbitrarily set. As long as the auxiliary code can be generated based on the same algorithm on the management unit side and the authentication server device side, any algorithm may be adopted. For example, hours, days of the week, and days may be added. Alternatively, if the management unit is provided with a function to directly access the authentication server device, a “random code” is generated on the authentication server device side at the start time every morning, and each management unit The “random code” may be downloaded by accessing. In this case, the management unit can use the downloaded “random code” itself as an auxiliary code, or can use the “random code” processed by a predetermined algorithm as an auxiliary code. it can.

  FIG. 10 is a diagram illustrating another example of the management code generation algorithm. In the example shown in FIG. 9, the management code is generated by adding the auxiliary code “18092006” to the area code “AAA”, but in the example shown in FIG. 10, the auxiliary code “18092006” is added to the access right code “L1”. "Is added to generate a management code. This is to cope with the above-described modification of §5 (1).

  That is, in the case of the example shown in FIG. 10, the management unit generates an auxiliary code that is temporarily valid based on a predetermined algorithm, generates a management code including both the access right code and the auxiliary code, This is written into the management code storage unit 420. On the other hand, on the server device side, the validity of the auxiliary code included in the transmitted management code is determined based on the completely same algorithm, and a determination result that the auxiliary code is invalid is obtained. In this case, access is prohibited.

(5) Example of management code erasure and invalidation As described above, in the system according to the present invention, when the user P leaves the management area, the management code storage unit 420 stores the management code upon entering the management area. Processing for erasing the written management code is performed. Here, “deletion of management code” in the present application broadly means processing for invalidating the function as management code information. Therefore, for example, not only a process of overwriting with a specific code (a code indicating that the data is empty) such as hexadecimal “FF” but also a process of rewriting with a code having another meaning is referred to in the present application. “Erase” processing.

  For example, after entering a management area A, a management code consisting of a character string “AAA” is written to the information recording medium, and then when the management area A is exited, the character string “AAA” is changed to another “ZZZ”. The management code “AAA” may be “erased” by performing a process of rewriting the character string. When an IC card is used as an information recording medium, a command given to the IC card when performing such rewriting processing is not a “erase command” but a “write command”. In addition, “erase management code” according to the present invention is performed.

  In addition, when the management area A and the management area B are adjacent rooms connected by a single door, if the user moves from the management area A to the management area B through the door, the management area A It is only necessary to rewrite the management code “AAA” for the area A to the management code “BBB” for the management area B. In this case, the rewriting process serves as both a process of deleting the management code “AAA” and a process of writing the management code “BBB”.

  Further, the management code does not necessarily need to be erased, and a process of invalidating by some method may be performed. FIG. 11 is a block diagram showing a state in the information recording medium 400 when such invalidation operation is performed. In this example, a plurality of management codes are sequentially recorded in the management code storage unit 420. Specifically, a state is shown in which three management codes “AAA”, “DDD”, and “GGG” are recorded in each row. Each management code is recorded with a flag indicating its effectiveness. In the case of the illustrated example, an invalid flag is set for the management codes “AAA” and “DDD”, and an effective flag is set only for the management code “GGG”. This is because the user who has this information recording medium 400 enters the management area A and leaves, then enters the management area D, leaves, and finally enters the management area G. Show.

  In this operation mode, when the user P enters the management area, the management code is written in a new line in the management code storage unit 420, and a valid flag is set for the management code. When the user P leaves the management area, the valid flag is rewritten to an invalid flag. Further, the terminal device treats only the management code for which the valid flag is set as valid. In this way, the management codes are sequentially written in the management code storage unit 420, and the movement history of the user P remains. Therefore, the movement history can be used for some purpose as necessary. Is possible. Of course, since the storage capacity of the management code storage unit 420 is limited, it is practically preferable to delete old management codes that are no longer needed at a predetermined timing.

<<< §6. Specific construction example >>>
Here, a more specific construction example of the present invention will be briefly described. FIG. 12 is a perspective view showing a specific construction example of components around the management area A in the computer system shown in FIG. In the example shown in FIG. 12, the management area A is a living room, the physical structure 300A shown in FIG. 1 is configured by the walls, floor, and ceiling of the room, and the gate 310A is a door provided at the entrance of this room. It is constituted by. The user P carrying the information recording medium 400 enters and exits the living room A through the door 310A.

  An entrance communication device 340A-1 and an exit communication device 340A-2 are provided on the wall surface in the vicinity of the door 310A. The entrance communication device 340 </ b> A- 1 is a device that communicates with the information recording medium 400 when entering the living room A, and is installed on the outer wall of the living room A. On the other hand, the exiting communication device 340A-2 is a device that communicates with the information recording medium 400 when leaving the room A, and is installed on the inner wall of the room A. In the case of this embodiment, the information recording medium 400 is a non-contact type IC card, and each of the communicators 340A-1 and 340A-2 is constituted by a reader / writer device that performs radio communication with the non-contact type IC card. Therefore, when the user P holds the information recording medium 400 in the vicinity of each of the communication devices 340A-1 and 340A-2, communication is performed between the two and necessary processing is executed.

  That is, the entrance communication device 340A-1 communicates with the information recording medium 400 when the user P enters the room A, reads the authentication code stored in the authentication code storage unit 410, and manages the management code. A process of writing in the code storage unit 420 is performed. On the other hand, the exiting communication device 340A-2 communicates with the information recording medium 400 when the user P leaves the room A, and performs a process of deleting or invalidating the management code in the management code storage unit 420.

  The entrance communication device 340A-1 and the exit communication device 340A-2 are connected to the controller 340A-3. The controller 340A-3 controls each of the communication devices 340A-1 and 340A-2 and performs an authentication process using the authentication code read from the entrance communication device 340A-1. In the embodiment shown in FIG. 12, the management unit 340A depicted as one block in FIG. 1 is composed of three devices: an entrance communication device 340A-1, an exit communication device 340A-2, and a controller 340A-3. Will be composed. The processing function of the management unit 340A described so far is realized by a control program incorporated in the controller 340A-3.

  When the user P holds his / her information recording medium 400 over the entrance communication device 340A-1 in order to enter the room A, the information is stored in the authentication code storage unit 410 by the entrance communication device 340A-1. The authentication code (for example, “8888”) is read and transmitted to the controller 340A-3. The controller 340A-3 confirms that this authentication code is “a correct authentication code permitting access to the room A”, then gives an unlock instruction signal to the electronic lock 330A and manages the information recording medium 400 An instruction is given to the admission communicator 340A-1 to write a predetermined management code (for example, area code “AAA”) in the code storage unit 420. The state of the information recording medium 400 at this time is the state shown in FIG.

  Thereby, since door 310A is unlocked, user P can enter room A. When the user P uses the terminal device 320A (in the illustrated example, a personal computer), the user P wirelessly connects the information recording medium 400 to the IC card reader / writer device provided in the terminal device 320A, Enter your account and password. The terminal device 320A reads the authentication code “8888” and the area code “AAA” from the information recording medium 400, and transmits them to the authentication server device 100 together with the account and password. The authentication server device 100 authenticates the account, password, and authentication code by the method described above, and responds to the access from the terminal device 320A within the range of the access right corresponding to the area code (management code).

  When the user P finishes the operation of the terminal device 320A and leaves the room A, the user P holds the information recording medium 400 he / she holds over the exiting communication device 340A-2. Then, the authentication code (for example, “8888”) stored in the authentication code storage unit 410 is read out by the exiting communication device 340A-2 and transmitted to the controller 340A-3. The controller 340A-3 confirms that this authentication code is “a correct authentication code permitting access to the room A”, and then gives an unlock instruction signal to the electronic lock 330A. In addition, an instruction is given to the exiting communication device 340A-2 to delete or invalidate the management code “AAA” written in the management code storage unit 420 of the information recording medium 400. As a result, the door 310A is unlocked, so that the user P can leave the room A.

<<< §7. Basic procedure of the method according to the present invention >>
Finally, the basic procedure of the access right management method according to the present invention will be described with reference to the flowchart of FIG. This procedure is a procedure for managing access rights when accessing from a terminal device in a specific management area to a server device outside the management area via a network. Here, only procedures essential to this access right management method are described, and an account and password input operation, an authentication process using an authentication code, a lock / unlock operation of the management area, and the like are omitted.

  First, in step S1, the information recording medium 400 is prepared. This is a process of preparing an information recording medium in which a predetermined management code can be written as needed and distributing it to each user. In order to apply the present invention to an existing computer system of a company, a dedicated information recording medium 400 may be distributed to each employee. In this case, a unique authentication code given to each employee is written in the authentication code storage unit 410 in each information recording medium 400.

  Currently, companies that issue employee ID cards consisting of IC cards and distribute them to individual employees can use this ID card as an information recording medium 400 as it is. Usually, an employee ID card consisting of an IC card stores an authentication code unique to each employee, and this authentication code has a function as an electronic key for entering and exiting each room (management area). Often taken. In such a case, if the process of setting the management code storage unit 420 is performed in the IC card functioning as the employee ID and electronic key, the process of step S1 is completed.

  In subsequent step S2, a management unit is installed in each room. In other words, a management unit having a function of communicating with the information recording medium 400 is installed in the vicinity of the gate for entering and exiting each room. As described above, if an electronic lock is already provided in each room (management area) and an environment in which an IC card distributed as an employee ID card is used as an electronic key, a communication device that communicates with the IC card, Since a controller for controlling the locking / unlocking of the electronic lock has already been prepared, these existing devices can be used as a management unit as they are. In this case, a program for adding a management code writing function to the management code storage unit 420 and a function of deleting or invalidating the management code may be added to the controller.

  As described above, steps S1 and S2 are the preparation stage, and the subsequent steps S3 and after are the actual operation stage. Here, a processing procedure from entering the management area A shown in FIG. 12 to leaving is described. First, in step S3, it is detected whether or not the user P carrying the information recording medium 400 has performed an operation for entering a predetermined management area. Specifically, in the case of the example shown in FIG. 12, when the information recording medium 400 is held near the entrance communication device 340A-1, it is treated that an operation for entering the management area A has been performed, and step S4 is performed. Migrate to In step S4, the management unit 340A writes a management code to the information recording medium 400. That is, when the user P who carries the information recording medium 400 tries to enter the management area A through the gate 310A, the management code set for the management area A is set by the management unit 340A as the information recording medium. A process of writing to 400 is performed.

  In subsequent step S5, it is detected whether or not the user P entering the management area A has performed an operation of starting access to the authentication server device 100 via the network 200 using the terminal device 320A. Specifically, in the case of the example shown in FIG. 12, when the information recording medium 400 is connected to the terminal device 320A and the user P inputs an account and a password and performs an access start procedure for the server device, step S6 is performed. Migrate to In step S6, the terminal device 320A reads the management code written in the information recording medium 400 and performs processing for transmitting this management code and other necessary information to the authentication server device 100. In step S7, access from the terminal device 320A to the server device (in the case of the system shown in FIG. 1, access to the server devices 110, 120, and 130 relayed through the authentication server device 100) is executed. At this time, the authentication server device 100 that has received an access accompanying the transmission of the management code responds to an access from the terminal device 320A under the conditions corresponding to the management code.

  Next, in step S8, it is detected whether or not the user P has performed an operation of exiting the management area. Specifically, in the case of the example shown in FIG. 12, when the information recording medium 400 is held near the exiting communication device 340A-2, it is treated that an operation to exit from the management area A has been performed, and step S9. Migrate to In step S9, the management unit 340A performs processing for deleting or invalidating the management code for the management area A written in the information recording medium 400. As a result, when leaving the management area A, a valid management code is not recorded in the information recording medium 400.

  This completes the procedure from entry to exit in one management area A. If necessary, the process returns to step S3 again, and the entry / exit process to the new management area is repeated.

  The present invention can be widely applied to computer systems having a function of accessing a server device from a terminal device via a network. In particular, in a computer system in a company in which a large number of users access a server apparatus from a large number of locations, it is optimal to use it for setting different access rights for each location.

100: Authentication server device 110: Server device 120: Server device 130: Server device 200: Network 300A: Physical structure 300B: Physical structure 310A: Gate 310B: Gate 320A: Terminal device 320B: Terminal device 330A: Electronic lock 330B: Electronic lock 340A: Management unit 340B: Management unit 340A-1: Entrance communication device 340A-2: Exit communication device 340A-3: Controller 400: Information recording medium 410: Authentication code storage unit 420: Management code storage unit A: Management area B: Management areas S1 to S9: Steps in the flowchart

Claims (15)

A computer system capable of accessing a device to be accessed from a device arranged in any of a plurality of management areas via a network,
A physical structure surrounding the management area, so that access to the management area is only possible by passing through a specific gate;
A server device installed outside or inside the management area and subject to access;
A terminal device having a function of accessing the server device via the network from at least the management area;
An information recording medium having an authentication code storage unit storing a predetermined authentication code, and a management code storage unit for storing a predetermined management code as necessary;
An electronic lock having a function of locking and unlocking the gate, normally maintaining a locked state, and temporarily unlocking only when an unlocking instruction signal is given;
When the user who possesses the information recording medium enters and exits the management area through the gate, the authentication code stored in the authentication code storage unit is read, and the authentication using the read authentication code is performed, A management unit that gives the unlocking instruction signal to the electronic lock when a correct authentication result is obtained;
With
The management unit, when the correct authentication result upon entering specific management area with the user is obtained, writes the specific management code set for the particular management area to the management code storage unit When the user leaves the specific management area, the specific management code is erased or invalidated from the management code storage unit when the user leaves the specific management area,
When the terminal device accesses the server device, the terminal device reads the management code stored in the management code storage unit , and transmits the management code to the server device,
The computer system according to claim 1, wherein the server device responds to an access from the terminal device under a condition corresponding to a management code transmitted from the terminal device. The computer system of claim 1,
As a management code, use a code including an access right code indicating a predetermined access right set for each management area,
The server device responds to an access from the terminal device within a range of an access right indicated by an access right code transmitted from the terminal device. The computer system according to claim 2, wherein
The management unit generates a temporary valid auxiliary code based on a predetermined algorithm, and uses a management code including both the access right code and the auxiliary code,
The server apparatus determines the validity of the auxiliary code included in the management code based on the algorithm, and prohibits access when a determination result that the auxiliary code is invalid is obtained. A computer system characterized by: The computer system according to claim 2, wherein
A server system has a correspondence table between access right codes and access right contents, and responds to access from a terminal device within a range of access right determined by referring to the correspondence table. . The computer system according to claim 4.
A computer system characterized in that a setting table for referring to the contents of an access right that differs depending on the date and time is set in a correspondence table between the access right code and the contents of the access right. The computer system according to claim 4.
In the correspondence table between access right codes and access right contents, settings are made to refer to different access right contents depending on the authentication code.
The terminal device reads the management code from the management code storage unit when accessing the server device, reads the authentication code from the authentication code storage unit, and transmits the management code and the authentication code to the server device.
The server device refers to the correspondence table based on both the management code and the authentication code transmitted from the terminal device, and within the range of the access right determined by referring to the correspondence table, A computer system characterized by responding to an access from a terminal device. The computer system according to claim 4.
In the correspondence table between access right codes and access right contents, settings are made to refer to the access right contents that differ depending on the authentication code and date,
The terminal device reads the management code from the management code storage unit when accessing the server device, reads the authentication code from the authentication code storage unit, and transmits the management code and the authentication code to the server device.
The server device refers to the correspondence table based on both the management code and the authentication code transmitted from the terminal device, and within the range of the access right determined by referring to the correspondence table, A computer system characterized by responding to an access from a terminal device. The computer system of claim 1,
A computer system, wherein the management unit does not execute a management code writing process at a specific date and time. The computer system of claim 1,
A computer system, wherein the management unit has a function of reading an authentication code from an authentication code storage unit, and when the read authentication code is a specific code, the management code writing process is not executed. The computer system of claim 1,
The management unit has a function of reading the authentication code from the authentication code storage unit, and when the read authentication code is a specific code, the management code writing process is not executed at a specific date and time. Computer system. The computer system of claim 1,
A computer system, wherein a terminal device performs authentication using an authentication code stored in an authentication code storage unit, and accesses the server device only when a correct authentication result is obtained. The computer system of claim 1,
The server device is an authentication server device that performs an authentication process for accessing another server device, and relays the access to the other server device under a condition corresponding to the transmitted management code. A computer system characterized by that. The computer system of claim 1,
The management unit
When the user enters the management area, it communicates with the information recording medium, reads the authentication code stored in the authentication code storage unit, and performs the process of writing the management code in the management code storage unit,
An exit communication device that communicates with an information recording medium when a user leaves the management area, and performs processing for deleting or invalidating the management code from the management code storage unit;
A controller for performing authentication processing using the read authentication code, and controlling the entrance communication device and the exit communication device;
A computer system comprising: A computer system capable of accessing a device to be accessed from a device arranged in any of a plurality of management areas via a network,
A server device installed outside or inside the management area and subject to access;
A terminal device having a function of accessing the server device via the network from at least the management area;
An information recording medium having a management code storage unit for storing a predetermined management code as required;
When a user who possesses the information recording medium enters a specific management area, a process of writing a specific management code set for the specific management area in the management code storage unit is performed, and the user A management unit for performing a process of deleting or invalidating the specific management code from the management code storage unit when leaving the specific management area;
With
When the terminal device accesses the server device, the terminal device reads the management code stored in the management code storage unit , and transmits the management code to the server device,
The computer system according to claim 1, wherein the server device responds to an access from the terminal device under a condition corresponding to a management code transmitted from the terminal device. A method of managing access rights when accessing a server device to be accessed from a terminal device arranged in any of a plurality of management areas via a network,
Preparing an information recording medium in which a predetermined management code can be written if necessary;
Installing a management unit having a function of communicating with the information recording medium in the vicinity of the gate for entering and exiting the management area;
User carrying the information recording medium, upon entering a particular management area that is through the gate, the management unit, wherein the specific management code set for the particular management area information recording medium Writing to
When the user performs an operation of starting access to the server device via the network using the terminal device, the specific management written in the information recording medium is performed by the terminal device. Reading the code and sending it to the server device;
Said server apparatus, from the terminal device, the when there is an access with the transmission of specific management code, under conditions corresponding to the specific management code, the method comprising: responsive to access from the terminal device,
When the user exits the specific management area through the gate, the management unit erases or invalidates the management code for the specific management area written in the information recording medium. When,
A method for managing access rights in a computer system.

Images