JP4900925B2 - Access authority management system - Google Patents

Description

The invention relates to access rights management system, in particular, to a technique for performing the access rights management using the management unit team and a group for each access.

  Conventionally, a method for managing the access authority of a system user in various systems has been proposed. For example, there is a method of setting the access authority for each type of information to be accessed. There is also a method of setting access authority for each executable function. Such management of access authority is realized more efficiently by grouping users having access authority.

  For example, in the operator authority management system disclosed in Patent Document 1, a group (general employee, part-time job, etc.) that collects system users who have the same combination of authority for each unit (each function) for setting access authority Create and manage access rights.

That is, a group for each person having the same authority (referred to as an operator group in Patent Document 1) is created. Then, by setting the access authority for each authority group, the access authority for all users belonging to the group is determined. An example of the unit for setting the access authority is a project unit for issuing a form in the workflow form system.
JP 2003-323410 A

  However, in the conventional operator authority management system, as the number of system users and the number of units (projects) for setting access authority increase, the load on the administrator who sets access authority increases accordingly. For this reason, if the management range can be reduced by grouping users in some units and allocating managers of users belonging to the group, the burden on the manager per person is reduced.

  In this case, there is no problem when an administrator is assigned in units of access authority or projects. However, a problem arises when management is desired in organizational units. The organizational unit here is a team that is a unit of management in the organization, for example, one section or department in the company organization. Organizational units are different from access authority units and project units. Unlike the access authority unit, there are users (section managers, general employees, temporary employees, etc.) with various authorities in one organization. In addition, since a project may be operated across organizations, one organization may be related to a plurality of projects across the organization.

  In an ordinary business system, an access authority setting manager is often assigned in an organizational unit (for example, a section manager determines the access authority of a section member to a project). That is, when grouping is performed in units of access authority and project, the administrator must be all administrators in the access authority unit and project unit to which members in the organization belong. For this reason, the access authority which should be managed increases and the burden of an administrator is not reduced.

  As a method of solving the problem of access authority setting management in the above access authority unit, a team composed of users of the unit (organization, department, etc.) to be managed separately from the access authority unit (hereinafter referred to as “Organization”) There is a method to manage access rights by creating a team.

  The administrator of the organization team can set the access authority for the information actually managing the access authority via the organization team for only the system users (members) belonging to the organization team. Therefore, it is possible to manage not the access authority unit but the organization / department unit which is the original management unit. In addition, a user who does not want to be managed is not under management.

  However, management by organizational team has the following problems.

  (1) When the organizational affiliation of a member, such as a change, is changed, the organization team is also changed. Along with this, the organizational team manager will also change. At this time, if the organization of the new affiliation is not related to the project that the member was involved in the previous affiliation, the organization team manager who manages the access authority to the project of the transferred member is absent. End up.

  (2) If the organization to which a member of the organization team belongs is changed due to a change, etc., if you want to be involved in a project related only to the department before the change for reasons such as handover, The organization team manager must manage the transferred members after the transfer. Therefore, the burden on the organization team manager before the change is large.

  (3) The organization team administrator must continue to manage the members of the organization team that has been transferred, taking into consideration the access authority for taking over.

The present invention has been made in view of such problems. In other words, it is provided in consideration of the takeover period of the case, such as personnel changes, the access rights management system that made it possible to automatically carry out the management of the authority possessed by the organization team administrator for the subsequent tissue team members With the goal.

To achieve the above object, an access authority management system according to the present invention is an access authority management system that manages access authority to business data for a team of a plurality of members. Deletion determination means for determining whether or not a team has been removed, and acquisition of a transfer period in which a member determined to have been removed by the removal determination means has a takeover period that can have the access authority that the member had before the removal And the elapsed time since the removal was performed and the takeover period obtained by the takeover period obtaining means, and the member removed by the removal determination means is obtained by the takeover period obtaining means. takeover and administrative rights persist determining means for determining whether to extend the period, a threshold obtaining means for obtaining a threshold value, the The authority authority determining means is configured such that the frequency of access to the data before the removal by the member in the period from when the member's data is removed until the takeover period elapses exceeds the threshold acquired by the threshold acquisition means. If it is determined that the takeover period acquired by the takeover period acquisition means is extended, access to the data before the removal by the member during the period from when the member's data is removed until the takeover period elapses When the frequency exceeds the threshold acquired by the threshold acquisition means, the processing of the business data relating to the work before the removal involving the member determined to have been removed by the removal determination means is completed. Yes If a deleting means for deleting the administrative authority of the team administrator for the members, the it is And wherein the Rukoto.

According to the present invention, in consideration of the takeover period for such personnel changes, subsequent tissue Team (Management Unit team) can be automatically manages the administrative authority with the organization team administrator for members to Become. Therefore, even if there is a personnel change in the members of the organization team, the organization team manager can manage access authority without particularly increasing the burden, thereby saving labor in management work.

  The best mode for carrying out the present invention will be described below with reference to the drawings.

[First Embodiment]
FIG. 1 is a block diagram showing a configuration of a server / client system including an access authority management system according to the first embodiment of the present invention.

  This server / client system includes a server 150 and client terminals 170a and 170b connected via a network 160. The server 150 and the client terminals 170a and 170b are each configured by a control device. The control device includes, for example, a central processing unit (hereinafter referred to as “CPU”), a ROM (Read Only Memory) storing a program executed by the CPU, a RAM (Random Access Memory) used by the CPU for calculation, an input / output device, and the like. Composed. In the following, the present embodiment will be described with a block configuration representing programs and storage databases stored in the control device, functions realized by the CPU executing the programs, and the like.

  A workflow form system 100 is provided in the server 150, and an access authority management system 110 and a workflow form program 120 are provided in the workflow form system 100. The access authority management system 110 has an access authority management program 140 and a workflow form system DB (database) 101. The workflow form system DB 101 is referred to by both the workflow form program 120 and the access authority management program 140.

  The client terminals 170a and 170b access the workflow form system 100 using the browsers 180a and 180b, respectively.

  In the present embodiment, a server / client system is taken as an example, but instead, it may be configured only by terminals not connected by a network. In this embodiment, the workflow form program 120 and the access authority management program 140 refer to the same database (workflow form system DB 101), but each refers to a plurality of separate databases. May be.

  FIG. 2 is a block diagram showing the internal configuration of the access authority management system 110.

  The access authority management system 110 holds an access authority management program 140 and an access authority management system DB 130. The access authority management system DB 130 is a part of the workflow form system DB 101 shown in FIG.

  The access authority management program 140 is a program that controls the access authority of the form user of the workflow form system 100. The access authority management program 140 includes a login function control unit 141, a message notification function control unit 142, a system control unit 143, a screen display unit 144, an organization team control unit 145, and a timer function control unit 146. The access authority management system DB 130 includes a project information DB 131, a user information DB 132, an organization team information DB 133, an enrollment information DB 134, and an access log 136.

  Next, each control unit in the access authority management program 140 and each DB in the access authority management system DB 130 will be described.

  FIG. 3 is a block diagram showing a static relationship between each control unit in the access authority management program 140 and each DB in the access authority management system DB 130.

  The system control unit 143 manages a screen display unit 144, a login function control unit 141, an organization team control unit 145, and a message notification function control unit 142. The timer function control unit 146 manages the organization team control unit 145 that operates when the timer is activated. The organization team control unit 145 refers to the project information DB 131, organization team information DB 133, enrollment information DB 134, and access log 136. The message notification function control unit 142 refers to the user information DB 132 in which the message is stored.

  Next, the data structure of the DB used in the access authority management system 110 among the DBs included in the access authority management system DB 130 will be described with reference to FIG.

  FIG. 4 is a diagram showing the data structure of the project information DB 131, user information DB 132, organization team information DB 133, and enrollment information DB 134 that the access authority management system DB 130 has.

  The project information DB 131 includes a project unit 1311 and an authority type group unit 1312. The project unit 1311 is associated with start date / time, end date / time, and phase data regarding each project. A project is a unit for issuing a form. It is linked to the organization team section 1331 of the organization team information DB 133.

  The authority type group unit 1312 holds information obtained by grouping access authority types in units of projects. The authority type group part 1312 is associated with an access authority type group (reference only group, edit group, etc.) that can be set for each project of the project part 1311. The authority type group part 1312 is linked to the user part 1321 of the user information DB 132. That is, the user of the user unit 1321 who has some access authority to the project of the project unit 1311 is associated with the corresponding authority type group in the authority type group unit 1312.

  The organization team information DB 133 includes an organization team unit 1331, and the organization team unit 1331 is associated with an organization team manager, a takeover period, and an access frequency threshold regarding each organization team. The takeover period is a period during which a member (user) deleted from the organization team by the organization team administrator is allowed to take over the business after the deletion, and is a value that can be set for each organization team. The access frequency threshold is a determination reference value for determining the continuation of management authority thereafter (e.g. extension of the takeover period) when the takeover period elapses for the members deleted from the organization team.

  The user information DB 132 has a user part 1321, a message box part 1322, and message information 1323. The user unit 1321 is associated with information on a user who uses the access authority management system 110, and includes information that uniquely identifies the user, an ID, a name, an e-mail address, and a comment. The user part 1321 has a message box part 1322, and the message box part 1322 has message information 1323.

  Reference numeral 134 denotes an enrollment information DB. Reference numeral 1341 denotes an enrollment information unit to which enrollment information relating to a user who is enrolled is associated. Reference numeral 1342 denotes an enrollment information unit to which enrollment information relating to the user being taken over is associated. The user who is taking over refers to a user who has been deleted from the organization team but is within the takeover period. Reference numeral 1343 denotes an enrollment information unit to which enrollment information related to the removed user is associated. A user who has been removed is a user who has been deleted from the organization team and whose handover period has ended. The enrollment information sections 1341 to 1343 are associated with the user name, the enrollment start date and time when the user belonged to the organization team, the enrollment end date and time, and the project name that was involved when the user was removed from the organization team. When the organizational team is associated with a plurality of projects, the enrollment information of users belonging to the organizational team exists for a plurality of projects.

  Next, each part in the access authority management program 140 will be described in detail.

  FIG. 5 is a sequence diagram showing the operation of the message notification function control unit 142 in the access authority management program 140.

  The message notification function control unit 142 performs control for notifying a user of the workflow form system 100 of a message. The notification of the message to the user is performed immediately after the user logs into the workflow form system 100. In addition, when the organization team manager notifies the user of the message, it is performed when the screen is changed to a screen dedicated to the manager.

  First, a message notification instruction is transmitted from the system control unit 143 to the message notification function control unit 142 (M400). The instruction from the system control unit 143 to the message notification function control unit 142 is transmitted at the time of login for notifying the user and at the time of displaying the management screen for notifying the organization team administrator.

  Receiving this, the message notification function control unit 142 acquires a message to be notified from the message information 1323 via the user unit 1321 and the message box unit 1322 of the user information DB 132 (M401, M402).

  The message notification function control unit 142 transmits a message notification to the system control unit 143 using the acquired message as an argument (M403). The system control unit 143 instructs the screen display unit 144 to display a message dialog (M404), and the screen display unit 144 displays a message dialog (1101 in FIG. 12) (M405).

  The message content displayed at this time is the notification content that is the attribute of the message acquired from the message box portion 1322 of the user information DB 132. Similarly, information indicating whether the message is to be notified to the user as a member of the team or the message to be notified as the organization team manager is held in the notification location which is also an attribute of the message. As an example of a screen for notification as an organization team manager, there is a message dialog 1201 shown in FIG.

  The message notification function control unit 142 deletes the notified message from the message information 1323 via the user unit 1321 and the message box unit 1322 of the user information DB 132 (M406, M407).

  FIG. 6 is a sequence diagram showing the operation of the timer function control unit 146 in the access authority management program 140.

  The timer function control unit 146 extracts organization team members (users) whose handover period has expired, and determines the management authority of the organization team manager for the subsequent members. In the present embodiment, the operation of the timer function control unit 146 is set to be performed periodically at midnight or the like where the operation of the workflow form system 100 is less affected. In other words, the takeover period and the access frequency threshold are set in advance in the organization team section 1331 of the organization team information DB 133 by the organization team manager. An example of a screen used when the organization team administrator makes settings in the organization team unit 1331 is shown in FIG. The takeover period is a default (1 month), a long (half year), a short (2 weeks), or a value specified for a period. The access frequency threshold is selected by a threshold selection slider (1407 in FIG. 15) or input by a threshold setting radio button (1409 in FIG. 15).

  When the preset operation start timing arrives, the timer function control unit 146 transmits an instruction to the organization team control unit 145 to investigate whether there is an organization team member (user) who is taking over (M501). Receiving this, the organization team control unit 145 refers to the enrollment information being taken over by the organization team unit 1331 of the organization team information DB 133 as an attribute, and confirms the presence / absence of the organization team member being taken over (M502). ). As a result, when there is no organization team member taking over, the processing is terminated and the following processing is not performed. On the other hand, when there is a member who is taking over, the organization team control unit 145 notifies the timer function control unit 146 that there is an organization team member that is taking over (M504).

  Next, the timer function control unit 146 transmits to the organization team control unit 145 an instruction to investigate the presence / absence of an organization team member (user) exceeding the takeover period (M505). Receiving this, the organization team control unit 145 acquires the takeover period from the organization team information DB 133 (M506). Further, the elapsed time in the corresponding takeover period is acquired from the enrollment information DB 134 (M507, M508). Next, the organization team control unit 145 compares the acquired takeover period with the elapsed time, and determines whether or not the takeover period is exceeded (M509). If it is determined that the handover period has not been exceeded, the process is terminated. On the other hand, when the handover period has been exceeded, the member corresponding to the handover period is notified to the timer function control unit 146 (M510).

  The timer function control unit 146 notifies the organization team control unit 145 to determine whether or not the future management authority regarding the member whose handover period has passed is determined (M512). Receiving this notification, the organization team control unit 145 acquires the access frequency during the takeover period of the member from the access log 136 as a determination material (M513). Then, the organization team control unit 145 executes management authority existence determination processing described later with reference to FIG.

  Note that the sequence in the range indicated by the loop frame 515 in FIG. 6 is executed for all the members of the organization team who have exceeded the takeover period. Further, the sequence in the range indicated by the loop frame 514 in FIG. 6 is executed for all the organization teams.

  FIG. 7 and FIG. 8 are flowcharts showing the procedure of the management authority existence determination process performed in the organization team control unit 145 based on the notification from the timer function control unit 146.

  First, the organization team control unit 145 obtains an access frequency threshold associated with the organization team unit 1331 of the organization team information DB 133 (S600). Next, the access frequency during the takeover period of the target organization team member is acquired (S601). This access frequency is acquired by referring to the enrollment information DB 134 to identify the target project in the takeover period and acquiring the access count of the organization team member from the access log 136.

  Next, the access frequency acquired in step S601 is compared with the access frequency threshold acquired in step S600 (S602). As a result, if the access frequency exceeds the access frequency threshold, the process proceeds to step S604, and if not, the process proceeds to step S606.

  In step S604, the takeover period of the organization team members is extended. Next, a message addressed to the organization team manager is sent to the message box section 1322 of the user information DB 132 in order to notify the organization team manager who has management authority over the member of the extension of the transfer period regarding the managed member. It adds (S605). Then, the management authority existence determination process is terminated.

  In step S606, the current state of the form in which the organization team members are involved is acquired. As a result, if all the processes of the forms related to the members have been completed, the process proceeds to step S608, and if there is any form that has not been processed, the process proceeds to step S613.

  In step S608, the management authority of the organization team manager for the members is deleted. Next, the deleted member is deleted from the authority type group to which the member belonged (S609). Next, in order to notify the member and the organization team administrator of the member that the management authority for the member has been deleted, the member and the organization team management are displayed in the message box section 1322 of the user information DB 132. A message addressed to the person is added (S610). Next, the membership information of the member is deleted from the enrollment information portion 1342 for “taking over” in the enrollment information DB 134 (S611), and the membership information of the member is added to the enrollment information portion 1343 for “removed”. (S612). Then, the management authority existence determination process is terminated.

  In step S613, a message addressed to the organization team manager is added to the message box portion 1322 of the user information DB 132 in order to notify that processing has not been completed for all the forms related to the members (S613). Then, the management authority existence determination process is terminated.

  As described above, the reason why the management authority is determined to be determined based on the access frequency of the members of the organization team and the current state of the form in which the members are involved will be described with reference to FIG.

  FIG. 9 is a diagram showing reservation / deletion of the management authority of the organization team manager for the members, which is determined according to the access frequency and the current state of the form.

  When the access frequency is high (when the access frequency threshold value is exceeded), it is determined that the takeover operation is not completed regardless of the current state of the form the member is involved in. Reserve administrative rights for team managers. On the other hand, when the access frequency is low (below the access frequency threshold value) and the processing is completed (closed) for all the forms related to the members, it can be determined that the handover operation has been completed. Therefore, the management authority of the organization team manager for the members is deleted. However, even if the access frequency is low, if all the forms involving the members have not yet been processed (not closed), it can be determined that the handover operation has not yet been completed. That is, there is a possibility that the member or the organization team manager has forgotten to process the form. Therefore, the management authority of the organization team manager with respect to the members is reserved, and the fact is notified to the members and the organization team manager.

  FIG. 10 is a sequence diagram illustrating an operation when deleting an organization team member in the organization team control unit 145 in the access authority management program 140.

  First, the system control unit 143 transmits an instruction to display the editing screen of the organization team member to the screen display unit 144 (M800). Receiving this, the screen display unit 144 displays the editing screen of the organization team members (M801). This organization team member editing screen is illustrated in FIG.

  The organization team manager who has seen this edit screen uses the user selection check box (1302 in FIG. 14) to add / delete organization team members. In the organization team member editing screen, the check box of the user who is a member of the organization team is selected when the display is performed. Select the check box for the user you want to add, and deselect the check box for the user you want to delete.

  When the organization team manager finishes editing the organization team member and presses the update button (1303 in FIG. 14), the organization team member edit result is transmitted to the system control unit 143 (M802). The system control unit 143 transmits an organization team member editing instruction to the organization team control unit 145 (M803). Receiving this, the organization team control unit 145 acquires, from the project information DB 131, another organization team related to the project related to the organization team (M804). The organization team control unit 145 determines whether the acquired other organization team includes a member to be deleted (M805). When the member to be deleted is not included in the other organization team (they are not duplicated), the registration information of the member to be deleted is deleted from the enrollment information part 1341 for “being enrolled” in the enrollment information DB 134, The information is added to the enrollment information part 1432 for “being handed over” (M806).

  The sequence in the range indicated by the loop frame 807 in FIG. 10 is repeatedly executed for (number of members to be deleted) × (number of projects with which the organization team is related).

  Next, each screen displayed on the screen display unit 144 of the access authority management system 110 will be described.

  FIG. 11 is a diagram illustrating an example of a login screen.

  The login screen 1000 is a screen used by the user when logging into the workflow form system 100. A login ID input unit 1001, a password input unit 1002, a login execution button 1003, and a reset button 1004 are provided.

  FIG. 12 is a diagram showing an example of a message dialog 1101 screen notified to the organization team members.

  FIG. 5 is an example of a screen of a message dialog 1101 that is transmitted from the message notification function control unit 142 to the system control unit 143 (M403 in FIG. 5) and displayed on the user (organization team member) by the screen display unit 144; . A message content display unit 1102 and an OK button 1103 are provided.

  FIG. 13 is a diagram showing an example of a message dialog 1201 screen notified to the organization team manager.

  The message notification function control unit 142 transmits a message notification to the system control unit 143 (M403 in FIG. 5), and is an example of a message dialog 1201 screen displayed to the organization team administrator by the screen display unit 144. A message content display unit 1202, an OK button 1203, and a cancel button 1204 are provided.

  FIG. 14 is a diagram illustrating an example of an organization team member editing screen.

  The organization team member editing screen is a screen used when the organization team administrator deletes or adds an organization team member. A user list table 1301, a user selection check box 1302, an update button 1303, a cancel button 1304, and a clear button 1305 are provided.

  FIG. 15 is a diagram illustrating an example of a screen used when the organization team administrator sets the takeover period and the access frequency threshold in the organization team unit 1331 of the organization team information DB 133.

  For setting a takeover period, a default (one month) selection radio button 1401, a long (half year) selection radio button 1402, a short (two weeks) selection radio button 1403, and a period designation selection radio button 1404 are provided. Furthermore, it has a period input field 1405 and a unit selection pull-down list 1406 that are used when a period is uniquely set. The value designated here is stored in the organization team part 1331 of the organization team information DB 133 as a takeover period.

  For setting an access frequency threshold, an access frequency threshold slider 1407, a threshold selection content display unit 1408, a threshold setting radio button 1409, a threshold input field 1410, and a unit selection pull-down list 1411 are provided. Further, an OK button 1412, a cancel button 1413, and an adaptation button 1414 are provided. The access frequency threshold slider 1407 can select from “low” to “high”, and the description of the selected value is displayed on the threshold selection content display unit 1408. When the access frequency threshold slider 1407 selects “low”, it means that the access frequency threshold is set to be small. Therefore, if access is made even during the takeover period, the management authority of the organization team administrator for the organization team members is Reserved. On the other hand, when “many” is selected, if the access frequency during the takeover period is not high, the management authority of the organizational team manager for the organizational team members is deleted.

  In the present embodiment, the average access count per day during the takeover period is used as the access frequency. An access frequency threshold set to “many” corresponds to an average access count of 20 times per day, and an access frequency threshold set to “low” corresponds to an average access count of 0.1 times per day. To do.

  The value designated here is stored as an access frequency threshold value in the organization team part 1331 of the organization team information DB 133.

  As described above, in the first embodiment, taking into account the takeover period in the case of personnel changes, etc., whether or not the management authority of the organization team manager for the subsequent organization team members can be continued automatically. It becomes possible to judge. Therefore, even if there is a personnel change in the members of the organization team, the organization team manager can manage access authority without particularly increasing the burden, thereby saving labor in management work.

  In addition, when a predetermined period of time has passed since a member of the organizational team has changed, a message is automatically notified to the organizational team manager and members. It can prevent you from continuing to manage. In addition, it is possible to prevent the members from holding the access authority given by the organization team manager before the change.

[Second Embodiment]
Next, a second embodiment of the present invention will be described.

  Since the configuration of the second embodiment is basically the same as the configuration of the first embodiment, in the description of the second embodiment, the same parts as the configuration of the first embodiment are used. Are denoted by the same reference numerals, and the description of the first embodiment is used, and only different portions will be described.

  In the first embodiment, the case where members of the organization team are deleted from the organization team due to personnel changes, etc. has been described. This is because the organization team after the change is associated with the organization before the change. This is when the projects with which the team is related are different.

  On the other hand, in the second embodiment, a case will be described in which the project related to the organizational team after the transfer is the same as the project related to the organizational team after the transfer. In other words, this is a case where the transferred member is registered as a member of the organization team after the transfer in the project in the takeover state.

  FIG. 16 is a sequence diagram illustrating an operation when the organization team control unit 145 in the access authority management program 140 in the second embodiment adds an organization team member.

  First, the system control unit 143 transmits an instruction to display the editing screen of the organization team member to the screen display unit 144 (M900). Receiving this, the screen display unit 144 displays the organization team member editing screen (M901). This edit screen has already been illustrated in FIG.

  When the organization team manager finishes editing the organization team member using this editing screen and presses the update button 1303 (FIG. 15), the organization team member edit result is transmitted to the system control unit 143 ( M902). Receiving this, the system control unit 143 transmits an instruction to the organization team control unit 145 to edit the organization team members (M903).

  Receiving this instruction, the organization team control unit 145 acquires information on other organization teams related to the project related to the organization team from the project information DB 131 (M904). Then, the organization team control unit 145 checks whether or not the acquired other organization team includes a member to be deleted (duplication) (M905). When a member is duplicated with another organization team, the organization team control unit 145 refers to the enrollment information DB 134 to determine in which state (in the enrollment or taking over) the duplicate organization team. (M906).

  If the member is taking over, the organization team control unit 145 moves the member's enrollment information from the enrollment information unit 1342 for “taking over” to the enrollment information unit 1343 for “removed” (M907). ). Next, the organization team control unit 145 deletes the member from the organization team information DB 133 (M908) and also deletes it from the authority type group unit 1312 of the project information DB 131 to which the member is related (M909). This deletes the management authority for the members of the organizational team that were duplicated.

  Next, the organization team control unit 145 adds, to the user unit 1321 of the user information DB 132, a message to be sent to the organization team administrator whose management authority has been deleted, that is, a message indicating that the management authority has been deleted ( M910).

  Here, the sequence in the range indicated by the loop frame 913 in FIG. 16 is executed for all members to be added in one project. Further, the sequence in the range indicated by the loop frame 914 in FIG. 16 is executed for each of the projects related to the members to be added.

  Next, the organization team control unit 145 adds the membership information of the member to be added to the enrollment information unit 1341 for “being enrolled” in the enrollment information DB 134 (M911). Further, the organization team control unit 145 adds members to the organization team information DB 133 (M912).

  At this point, the members only belong to the organizational team and have no authority over the project with which the organizational team is associated. Therefore, the user part 1321 to which the member information is associated is not related to the authority type group 1312. The organization team administrator performs an operation to give authority to the added organization team member, and the member is related to the authority type group 1312 only by this.

  Thus, in the second embodiment, in the case where the project in which the organization team after the transfer is involved is the same as the project in which the organization team after the transfer is involved, Later registered as a member of the organization team.

[Other Embodiments]
The object of the present invention can also be realized by using a storage medium storing software program codes for realizing the functions of the above-described embodiments. That is, it is also achieved by supplying to a system or apparatus and reading and executing the program code stored in the storage medium by a computer (or CPU, MPU, etc.) of the system or apparatus.

  In this case, the program code itself read from the storage medium realizes the functions of the above-described embodiments, and the program code and the storage medium storing the program code constitute the present invention. .

  As a storage medium for supplying the program code, for example, a magnetic disk such as a floppy (registered trademark) disk or a hard disk, or a magneto-optical disk can be used. Further, optical disks such as CD-ROM, CD-R, CD-RW, DVD-ROM, DVD-RAM, DVD-RW, DVD + RW, magnetic tape, nonvolatile memory card, ROM, and the like can be used. Alternatively, the program code may be downloaded via a network.

  Further, processing may be shared with an OS (operating system) running on the computer based on an instruction of the program code. For example, the case where the OS performs part or all of the actual processing and the functions of the above-described embodiments are realized by the processing is also included.

  Further, the program code read from the storage medium may be written in a memory provided in a function expansion board inserted into the computer or a function expansion unit connected to the computer. In this case, on the basis of the instruction of the program code, a CPU or the like provided with the extension function in the extension board or the extension unit performs part or all of the actual processing, and the functions of the above-described embodiments are realized by the processing. The

It is a block diagram which shows the structure of the server client system containing the access authority management system which concerns on the 1st Embodiment of this invention. It is a block diagram which shows the internal structure of an access authority management system. It is a block diagram which shows the static relationship of each control part in an access authority management program, and each DB in access authority management system DB. It is a figure which shows the data structure of the project information DB which the access authority management system DB has, user information DB, organization team information DB, and enrollment information DB. It is a sequence diagram which shows operation | movement of the message notification function control part in an access authority management program. It is a sequence diagram which shows operation | movement of the timer function control part in an access authority management program. It is a flowchart (1/2) which shows the procedure of the determination process of the management authority existence performed in an organization team control part based on the notification from a timer function control part. It is a flowchart (2/2) which shows the procedure of the management authority existence determination process performed in an organization team control part based on the notification from a timer function control part. It is a figure which shows reservation / deletion of the management authority of the organization team manager with respect to a member determined according to the access frequency and the present state of a form. It is a sequence diagram which shows the operation | movement at the time of the organization team member deletion in the organization team control part in an access authority management program. It is a figure which shows an example of a login screen. It is a figure which shows an example of the screen of the message dialog notified with respect to an organization team member. It is a figure which shows an example of the screen of the message dialog notified with respect to an organization team manager. It is a figure which shows an example of the edit screen of an organization team member. It is a figure which shows an example of the screen used when an organization team manager sets a takeover period and an access frequency threshold value in the organization team part of organization team information DB. It is a sequence diagram which shows operation | movement when the organization team control part in the access authority management program in 2nd Embodiment adds an organization team member.

Explanation of symbols

100 Workflow form system 101 Workflow form system DB
110 Access Authority Management System 120 Workflow Form Program 130 Access Authority Management System DB
131 Project information DB
132 User information DB
133 organization team information DB
134 Enrollment Information DB
136 Access Log 140 Access Authority Management Program 141 Login Function Control Unit 142 Message Notification Function Control Unit 143 System Control Unit 144 Screen Display Unit 145 Organization Team Control Unit (Management Authority Survival Judgment Unit, Management Authority Deletion Unit, Takeover Period Extension Unit)
146 timer function control unit 150 server 160 network 170a, 170b client terminal 180a, 180b browser 1311 project unit 1312 authority type group unit 1321 user unit 1322 message box unit 1323 message unit 1331 organization team unit 1341 enrollment information unit (during enrollment)
1342 Enrollment Information Department (taking over)
1343 Enrollment Information Department (removed)

Claims (2)

In an access authority management system that manages access authority to business data for a team of multiple members,
A removal determination means for determining whether or not the data of the member has been removed from the team;
A takeover period obtaining means for obtaining a takeover period in which members determined to have been removed by the removal determination means have the access authority that the member had before the removal;
The elapsed time since the removal was performed and the transfer period acquired by the transfer period acquisition means, and the transfer period acquired by the transfer period acquisition means for the members removed by the transfer determination means Management authority existence judgment means for judging whether or not to extend,
Threshold acquisition means for acquiring a threshold;
The management authority existence determination means is configured to determine a threshold value by which the access frequency for the data before the removal by the member in a period from when the member's data is removed to when a takeover period elapses is acquired by the threshold acquisition means. If exceeded, it is determined to extend the handover period acquired by the handover period acquisition means,
When the access frequency to the data before the removal by the member in the period from when the member's data is removed until the takeover period elapses exceeds the threshold acquired by the threshold acquisition means, Deletion that deletes the management authority of the manager of the team for the member when the processing of the business data related to the work before the removal involving the member who is determined to be removed by the removal determination means has been completed Means,
An access authority management system characterized by comprising:   When it is determined by the management authority existence determination means that the takeover period acquired by the takeover period acquisition means is extended, the management authority existence determination means further comprises notification means for notifying the manager of the team of a message notifying the extension. The access authority management system according to claim 1.

Images