JP5302712B2 - Client terminal, user management method, terminal management processor, program - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To reduce time and efforts of user management when an OS environment is used according to a plurality of utilization purposes at one client terminal. <P>SOLUTION: This client terminal includes an executing section, a terminal managing section, a network interface section, and an input/output section. The terminal managing section includes at least a terminal management recording section, an executing object managing section, a user managing section, and a user interface section. The terminal management recording section stores the using mode management information for associating at least an executing object, context identification information, and user interface information with one another, context management information for associating the context identification information with credential, and the credential used for authentication to a device of a connection destination. The user managing section includes a holder confirming means and a credential selecting means. The executing object managing section includes a context acquiring means, a user interface information acquiring means, and a credential setting means. <P>COPYRIGHT: (C)2010,JPO&amp;INPIT

Description

  The present invention relates to a client terminal that has a plurality of usage modes for executing different processes depending on the purpose of use, and switches between these usage modes, and in particular, switches a user's identity according to the usage purpose of each usage mode. The present invention relates to a client terminal to be used, a user management method, a terminal management processor, and a program.

  Due to recent advances in virtualization technology, it has become common to implement a plurality of computer environments virtually on a single piece of hardware. If this virtualization technology is applied to a client terminal such as a PC, a plurality of OS environments can be used properly on a single terminal. For example, an OS that has many applications, an OS that excels in media processing, an OS that is lightweight and quick to start, and an older version of the OS that is required for the operation of old applications, run on the virtual machine and switch according to the purpose. It becomes available (Non-Patent Document 1).

  However, if the number of OS environments to be used increases, there arises a problem that user management becomes complicated. For example, there is a problem that the operation becomes complicated such that user registration is required for each OS environment at the time of initial setting, and a password needs to be input every time the OS environment is logged in. Furthermore, re-setting is required when changing the OS environment. By the way, when using virtualization in a server, a method of creating a template for one OS environment and deploying it to a plurality of virtual machines is generally used. However, when various OS environments are operated on the client terminal, since the setting differs depending on the purpose of use of each OS environment, the above method cannot be used. Can't solve the problem.

Paul Barham, Boris Dragovic, Keir Fraser, Steven Hand, Tim Harris, Alex Ho, Rolf Neugebauer, Lan Pratt, and Andrew Warfield, “Xen and the Art of Virtualization”, Proceedings of SOSP, pp.164-177, 2003.

  As described above, the conventional virtual machine environment has a problem that user management such as user registration at the time of initial setting and login to each OS environment becomes complicated for a plurality of OS environments. An object of the present invention is to solve the above problems. That is, it is to reduce the labor of user management when using different OS environments according to a plurality of usage purposes in one client terminal.

  The client terminal of the present invention can execute a plurality of execution targets. Note that the execution target has some utility by executing. The client terminal according to the present invention provides information to and from an execution unit that executes a plurality of execution target processes, a terminal management unit that performs user management, a network interface unit that has a function of connecting to a network, and a terminal holder. Input / output unit.

  The terminal management unit includes at least a terminal management recording unit, an execution target management unit, a user management unit, and a user interface unit. The terminal management recording unit includes at least usage mode management information that associates execution targets, context identification information, and user interface information, context management information that associates contexts with environment setting information, and credentials used for authentication of a connection destination device. Is recorded. The user management unit includes a holder confirmation unit and a credential selection unit. The execution target management unit includes a context acquisition unit, a user interface information acquisition unit, and an environment setting unit.

  The holder confirmation means confirms the legitimacy of the holder. The credential selection means selects a credential corresponding to the holder's context. The context acquisition means acquires the context identification information corresponding to the currently used usage mode using the usage mode management information. The user interface information acquisition unit acquires user interface information using the use mode management information and passes it to the user interface unit. The environment setting means acquires environment setting information (credential setting information) corresponding to the context using the context management information, and performs environment setting such as selecting a credential according to the usage purpose of the execution target.

  According to the virtual client terminal of the present invention, since the user management is performed collectively by the terminal management unit separated from the OS environment, it is possible to reduce the time and effort of login authentication that is conventionally required for each OS environment. As for client authentication for a server on the network, by managing credentials for each purpose of use of the OS environment, the user ID and credentials for the server used when the purpose of use is switched are simultaneously switched. Accordingly, it is possible to perform appropriate authentication such as concealing credentials for execution environments having different usage purposes, and it is possible to share user IDs and credential settings for a plurality of OS environments for the same usage purpose. Further, even when the OS running on the virtual machine for a specific usage purpose is updated and changed to another OS, if the usage purpose of each OS is the same, re-setting is not necessary. As described above, according to the present invention, user management according to the purpose of use of the terminal can be easily performed, and convenience is improved.

1 is a diagram illustrating a virtual client system using a virtual client terminal according to Embodiment 1. FIG. FIG. 3 is a diagram illustrating a functional configuration example of a virtual client terminal according to the first embodiment. FIG. 6 is a diagram illustrating an example of a processing flow of the terminal management unit 120 according to the first embodiment. The conceptual diagram showing the relationship between a terminal, an execution object, and an execution environment. The figure which shows the example of a use mode management table. The figure which shows the example of the screen display to a notebook type virtual client terminal. The figure which shows the example of a background image. The figure which shows the example of a context management table. The figure which shows the state transition of the virtual client terminal of Example 1. FIG. The figure which shows the example of a state transition table. FIG. 3 is a diagram illustrating an overall operation procedure of the virtual client terminal according to the first embodiment. The figure which shows the example of a display of the display of an input-output part.

  Hereinafter, embodiments of the present invention will be described in detail. In addition, the same number is attached | subjected to the structure part which has the same function, and duplication description is abbreviate | omitted.

  FIG. 1 is a diagram illustrating a virtual client system using the virtual client terminal according to the first embodiment. The virtual client system is configured by connecting a virtual client terminal 100 and a service providing server 200 via a network 10. The network 10 is, for example, the Internet or a corporate network. The service providing server 200 is a Web server that provides a service to the user via the virtual client terminal 100.

  FIG. 2 shows a functional configuration example of the virtual client terminal according to the first embodiment. The virtual client terminal 100 is a terminal (apparatus) that can execute a plurality of execution targets, and has an execution unit 110 that executes a plurality of execution targets, a terminal management unit 120 that performs user management, and a function that connects to a network. A network interface unit 190, an input / output unit 140 for exchanging information with a user (holder), and an execution target recording unit 130 for accumulating program code to be executed and data accessed from the execution target. . Specifically, the network interface unit 190 is a cellular wireless network interface, an Ethernet (registered trademark) interface, a WiFi network interface, or the like. Specifically, the input / output unit 140 is a display, a keyboard, a mouse, or the like.

  The terminal management unit 120 includes a terminal management recording unit 129, an execution target management unit 121, a user management unit 122, a user interface unit 124, a network connection management unit 125, and a control unit 126. The terminal management recording unit 129 includes a usage mode management table in which usage mode management information for associating at least an execution target, context identification information, and user interface information (information indicating screen display characteristics and the like) in a table format, A context management table in which context management information to be associated with environment setting information is tabulated and a credential that is information used in an authentication algorithm are recorded. The context is information representing the use and purpose of execution, and a specific example will be described later. The usage mode represents a specific execution target executed under a specific context. The context ID (context identification information) is a number specifying a context, and the usage mode ID (use mode identification information) is a number specifying a usage mode. The user management unit 122 includes a holder confirmation unit 1221 and a credential selection unit 1222. The execution target management unit 121 includes a context acquisition unit 1211, a user interface information acquisition unit 1212, and an environment setting unit 1213. Note that the usage mode management information and context management information may be recorded by a method other than the table format as long as the information to be managed is recorded so as to correspond.

  The user interface unit 124 sets a user interface in the input / output unit 140 in accordance with an instruction from the execution target management unit 121. In addition, the terminal holder inputs to the execution target being executed by the execution unit 110 via the keyboard and mouse of the input / output unit 140, and the output from the execution target to the holder is displayed on the input / output unit 140 display. Or go through. Further, a screen prompting the holder to select the usage mode is output via the display of the input / output unit 140, and an input intended to select the usage mode from the holder is input to the keyboard or mouse of the input / output unit 140. The input is converted into a usage mode ID and notified to the execution target management unit 121.

  The network connection management unit 125 manages the connection between the execution target and the network. The control unit 126 controls the terminal management unit 120 as a whole. More specifically, the network connection management unit 125 manages a network interface unit 190 (for example, a cellular wireless network interface, an Ethernet (registered trademark) interface, a WiFi network interface, etc.) corresponding to various access media, Control communication with the network through each access medium.

  An execution target is something that brings some utility when executed, and an execution environment represents an element necessary for execution of the execution target. For example, when an application program is considered as an execution target, a runtime library, an OS, terminal hardware, and an input / output device are execution environments. Alternatively, if the application program, runtime library, and OS are considered as execution targets, terminal hardware and input / output devices are the execution environment. As described above, the relationship between the execution target and the execution environment is relative. In the following description, the latter example is assumed. In other words, the state of the OS including the application is the execution target, and the hardware or virtual machine that operates the OS is the execution environment. However, as described above, the idea of the present invention is not limited to this example.

  In this description, a person (holder) holding the virtual client terminal 100 and a user viewed from the service providing server 200 will be described separately. The holder means an entity (person) who holds and operates the virtual client terminal at a certain point in time. A user represents an entity that uses a service as viewed from the service providing server 200. Usually, the holder at a certain point becomes the user who uses the service at that point, but the identity of the user may look different depending on the service (or service providing server) to be used. For example, the holder X may be identified by different user identifiers such as “ID0001” for the service A and “membership number 2009” for the service B. Also, the user identifier space for each service may be different. The user identity is a set of information that enables the user to be identified, and may include, for example, a user identifier.

  The credential includes a user identity (user identifier, etc.) to be presented to the service providing server 200, a certificate, secret information necessary for authentication, for example, a secret key used in an authentication algorithm, a password, a password, or the like, or Of these, the information consists of at least one. Credentials are basically prepared for each service providing server. However, as an exception, credentials of the same user (when recognized as the same user) may be shared by a plurality of servers. Further, here, a group of a plurality of credentials for a plurality of service providing servers is referred to as a credential set. Further, a credential set may be prepared for each usage purpose to be executed. The terminal management recording unit 129 stores a plurality of credential sets prepared for each usage purpose to be executed.

  FIG. 3 shows an example of the processing flow (S120) of the terminal management unit 120 of the first embodiment. First, the usage mode is determined by the operation of the user (holder) via the input / output unit 140, for example, the selection from the menu screen (S1241). The holder confirmation unit 1221 confirms the legitimacy of the holder (S1221). For example, information on the content prompting the holder to enter the password is displayed on the display of the input / output unit 140, and the validity of the holder is verified by checking the password input from the holder with the correct password held in advance. Check. The context acquisition unit 1211 acquires context identification information (for example, context ID) corresponding to the currently used usage mode using the usage mode management table (S1211). The user interface information acquisition unit 1212 acquires user interface information using the use mode management table and passes it to the user interface unit (S1212). Then, the user interface unit 124 sets a user interface in the input / output unit 140 according to the acquired user interface information (S1242). More specifically, a screen display corresponding to the usage mode is presented to the user. The environment setting unit 1213 acquires and sets environment setting information corresponding to the context based on the context management table and the acquired context identification information (S1213). Specifically, the credential selection means 1222 selects the credential corresponding to the holder's context (S1222). Then, the environment setting unit 1213 sets the acquired credentials. The environment setting unit 1213 may be a unit for performing settings other than the credentials, but may be considered as a credential setting unit, particularly focusing on the fact that it has a function of setting credentials important for the present invention. For example, a credential set stored in the terminal management recording unit 129 is selected and set based on context identification information (representing the purpose of use of the execution target) managed by the execution target management unit 121. Furthermore, the credential corresponding to the specific service providing server 200 is selected from among them, the identity of the user to be presented to the service providing server 200 is extracted, and the service providing server 200 is authenticated. The service providing server 200 provides a service to the user based on the user authentication.

  FIG. 4 is a conceptual diagram showing the relationship between the terminal, the execution target, and the execution environment. FIG. 4A is a conceptual diagram of a terminal that does not use virtualization. The terminal 900 includes a pair of an execution target 9001 and an execution environment 9002. FIG. 4B is an example of a conceptual diagram of a virtual client terminal using virtualization. The virtual client terminal 100 includes three pairs of execution targets and execution environments, and virtually operates as three terminals (virtual machines 101, 102, 103). The execution targets 1011, 1021, and 1031 are executed by the execution unit 110 of the virtual client terminal 100. Execution environments 1012, 1022, and 1032 that provide virtual hardware for the execution targets 1011, 1021, and 1031 are virtualized by the terminal management unit 120, the execution target recording unit 130, the input / output unit 140, and the network interface unit 190. Is realized. The virtual client terminal 100 is characterized by including a terminal management unit 120. Then, the user management is collectively managed by the terminal management unit 120, and the environment setting can be easily performed by performing the environment setting according to a plurality of usage purposes (usage modes).

  The virtual client terminal of the present invention includes the terminal management unit 120 as described above. Since the user management is performed collectively by the terminal management unit 120 separated from the OS environment, it is possible to reduce the time and effort of login authentication that is conventionally required for each OS environment. As for client authentication for a server on the network, by managing credentials for each purpose of use of the OS environment, the user ID and credentials for the server used when the purpose of use is switched are simultaneously switched. Accordingly, appropriate authentication can be performed, and user IDs and credential settings can be shared for a plurality of OS environments for the same purpose of use. Further, even when the OS running on the virtual machine for a specific usage purpose is updated and changed to another OS, if the usage purpose of each OS is the same, re-setting is not necessary. As described above, according to the present invention, user management according to the purpose of use of the terminal can be easily performed, and convenience is improved.

Specific Example of Management Table FIG. 5 shows an example of the usage mode management table. The context represents the use and purpose of execution. The usage mode is a mode in which screen display information is associated with a specific execution target (virtual machine image or the like) executed under a specific context. The context ID is a number that identifies a context, and the usage mode ID is a number that identifies a usage mode. The screen display information is determined in advance so that the terminal holder can easily identify the usage mode, represents the characteristics of the screen display, and corresponds to the usage mode on a one-to-one basis. The usage mode management table is composed of a plurality of rows each representing one usage mode, each row being a usage mode ID for identifying the usage mode, screen display information indicating the characteristics of the screen display when using the usage mode, It consists of a context ID representing the purpose of use of the usage mode and an execution target (virtual machine image or the like) executed under the usage mode. Note that if the execution target is different even if the context is the same, such as M2 and M3 or M6 and M7 in the example of the usage mode in FIG. 5, the holder is recognized as another usage mode. The entity of the screen display information is held in the user interface unit 124, and is presented to the holder via the display of the input / output unit 140 under the control of the execution target management unit 121.

  Next, an example of presentation of screen display information is shown with reference to FIGS. FIG. 6 shows an example of screen display on a notebook virtual client terminal, and FIG. 7 shows an example of a background image. In the example of FIG. 6A, the input / output unit 140 is configured to include an LED indicating a use mode below the display. In this example, the third LED from the left is lit, indicating that the use mode M3 is selected. In the example of FIG. 6B, the right portion of the display is a special display area indicating the usage mode, and the usage mode M3 is selected because the color of the third tab from the top is different. It is shown that. Alternatively, the screen display information may be a background image corresponding to the usage mode displayed in this display area. The background image may be a pattern as shown in FIG. 7, or may be an image such as a photograph or a picture. In this way, the screen display indicating the usage mode may be one that controls the display area on hardware (FIG. 6A), or one that controls the display area on software (FIG. 6). 6 (B), FIG. 7). In any of these examples, the portion displaying the usage mode may be configured so that it cannot be controlled from each execution target executed on the execution unit 110. With such a configuration, the mode in which the device operates can not be fake depending on each execution target. That is, the configuration independent of the execution unit 110 in which the virtual machine is executed controls the display area of the usage mode. Therefore, it is possible to prevent misidentification of the currently used usage mode. Note that it is also possible to display a screen representing the usage mode as the background (wallpaper) on the left side of the screen in FIG. 6B on which the operation result to be executed is displayed. However, in this case, it is necessary to prohibit writing from the execution target to the background portion so that the background cannot be intentionally rewritten from the execution target.

  FIG. 8 shows an example of the context management table. The context represents the purpose of use of the execution target. The context management table predefines the attributes of each context and the setting of the execution environment for the execution target executed under each context. In the example of the context of FIG. 8, “C1 (important work)” is a purpose of business and handling important data, “C2 (normal work)” is a use of normal work such as sending and receiving mail, and “C3 (net survey). ) "Is used to search for sites on the Internet to conduct survey work," C4 (settlement) "is used for online shopping for personal purposes," C5 (private) "is used to browse online content for personal purposes, etc. “C6 (Guest)” represents a purpose of temporarily providing a terminal function to a third party. Each context has attributes such as processing purpose, importance, and necessity of holder confirmation, and a required security level is defined based on importance and necessity of holder confirmation. Based on the above context attributes, execution environment settings are defined in advance. For example, the credential setting designates a credential set including a set of credentials used under each context, and is determined by the attributes such as the processing purpose and the security level. For example, under the context of “C1 (important work)”, the credential setting selects “credential set 1 (important work)” using a highly secure certificate authentication method, and “C3 (net survey)” or In the context of “C6 (guest)”, “credential set 3 (free service)” using a simple authentication method such as a password is selected. The entity of the credential set is stored in the terminal management recording unit 129 as described above. Further, when the importance level and the holder confirmation are set when setting the context management table, the security level may be automatically set based on the rules stored in advance. Further, when the processing purpose and the security level are set, the credential setting may be automatically set based on the rule stored in advance. This rule may be stored in the execution target management unit 121.

The state transition virtual client terminal 100 of the execution environment further records in the terminal management recording unit 129 a state transition table that associates the state transition conditions and actions of the execution target with each other, and the execution target management unit 121 stores the state transition state. It may also have state transition execution means 1214 that transitions the state to be executed according to the transition table and executes necessary actions.

  FIG. 9 is a diagram illustrating state transition of the virtual client terminal 100. The state of the virtual client terminal 100 includes the state of each usage mode (M1 to M8). For example, when the state of the usage mode M1 is expressed as S (1), the state of the virtual client terminal 100 includes eight sets <S (1), S (2),..., S (8)>. The state of each usage mode is one of the states T0 to T7 shown in FIG. Each state can be expressed as a direct product of the following three states. That is, either connection (cn) or disconnection (dc), either unlock (ul) or lock (lk), activation (up) or deactivation (dn). The connection / disconnection indicates whether the execution target related to the usage mode is connected to the user interface unit 124, that is, whether the execution target is selected as an operation target. “Unlock / lock” indicates whether or not an operation on the execution target is permitted, for example, when the holder inputs a password via the input / output unit 140. Although the input for unlocking has been described with the password in the above, it may be based on a personal identification number or biometric information such as a fingerprint or a glow. The start / stop indicates whether or not an execution target related to the use mode has been started, for example, whether or not the execution unit 110 has started the OS on the virtual machine. The direct product of the above three states defines the following eight states for the usage mode. For example, T0 is an initial state composed of a combination of disconnection (dc), lock (lk), and stop (dn). Similarly, T1 is only connected, T2 is only unlocked, T3 is connected, unlocked and waiting for activation, T4 is only activated, T5 is connected, activated and unlocked , T6 represents an unlocked and activated state waiting for connection, and T7 represents a connected, unlocked and activated state where execution targets related to the use mode are being executed. For example, a state T6 that is activated and unlocked but not connected is a state in which an execution target is running in the background. Hereinafter, for the sake of simplicity, state transition for one usage mode will be described. As described above, the state of the entire virtual client terminal 100 is a set of states of each usage mode, for example, <S (1), S (2),..., S (8)> are defined. In the present embodiment, the state of each usage mode is independent.

  FIG. 9B shows an event that causes a transition between states related to the use mode. For example, cn / dc represents a connection request / disconnection request based on the input of the holder. ul / lk represents an unlock request / lock request by a PIN input by the holder. The lk event is generated by a direct instruction from the holder or a timeout. The timeout occurs when a certain time has elapsed since the last unlocking or when a certain time has elapsed since the terminal operation was last performed. Any of these intervals may be set differently in each usage mode. Depending on the usage mode, an lk event may be forcibly generated when the usage mode is selected. In other words, when the use mode is selected, unlocking by force such as password entry is required. Depending on the usage mode, an lk event may be generated when a specific application is activated. In this way, it is possible to more safely execute processing when switching to a more important usage mode or starting a more important application. up / dn represents a start request / stop request to the execution target related to the use mode based on the input of the holder or the like. FIG. 9C shows a state transition. FIG. 10 is a table (state transition table) showing the state transition. For example, when the event cn is input in the state T0, the state transits to the state T1, and the execution target related to the usage mode is connected (selected). As described above, the state transition table associates the state transition condition with the action. Since the state transition table is also provided, it becomes easy to grasp the state and specific processing (action), so that the setting (change) of the execution environment and the state management become easy.

  FIG. 11 shows an overall operation procedure of the virtual client terminal 100. FIG. 12 shows an example of display on the display of the input / output unit 140. 12A is an example of the setting screen in the initial state, FIG. 12B is an example of the setting screen after the state transition, FIG. 12C is an example of the execution target display screen, and FIG. Is an example of an unlocked screen. First, when the virtual client terminal 100 is activated, the execution target management unit 121 of the terminal management unit 120 performs initial setting (S100). Specifically, the system state is set to the initial state, that is, the state of all use modes is set to T0, and the setting screen (FIG. 12A) is displayed on the input / output unit 140. Next, the execution target management unit 121 inputs an instruction from the holder via the user interface unit 124 and the input / output unit 140 (S140). Specifically, the input includes pressing a specific key or clicking a specific icon on the screen. Next, it is determined whether the input information is an instruction to the execution target management unit 121 (input to the selected execution target) (S124). This determination is performed according to a predetermined rule. For example, the determination is made based on the content of the input information. Alternatively, when a setting screen (FIG. 12B or the like) is displayed on the display, the input is regarded as an instruction to the execution target management unit 121, and a usage mode screen (FIG. 12C) is displayed. Is determined as an input to the execution target corresponding to the selected usage mode. If NO is determined in step S124, that is, if it is determined to be input to the execution target, the input information is transmitted to the execution unit 110, the processing is continued on the execution target (S110), and the process returns to step S140. On the other hand, if YES is determined, that is, if it is determined that there is an input to the execution target management unit 121, state transition is performed according to the state transition table (FIG. 10), and necessary actions are executed (S120). Then, the process returns to step S140. The process of step S120 is the process shown in FIG. However, the step which becomes a duplication process is abbreviate | omitted. For example, if it is already determined which use mode the action is for, step S1241 is omitted. If the holder confirmation has been completed, step S1221 is omitted. Further, when the connection with the network is terminated, steps S1222, S1211, S1213, etc. are omitted. Then, the state transition execution unit 1214 changes the state of the usage mode (S1214).

  Next, an example of a display screen of the virtual client terminal 100 is shown with reference to FIG. FIG. 12A shows an example of a menu screen when the system is in the initial state. Here, an unlock event (ul) is generated by entering the password in the password dialog box at the top of the screen. If the selection button for the use mode is clicked, a connection event (cn) or disconnection (dc) event for the selected use mode is generated according to the current connection state. That is, if a button is clicked when in a connected state, a disconnect event is generated. On the other hand, if the button is clicked in the disconnected state, a connection event is generated. Similarly to the selection button, the start button generates a start (up) event or a stop (dn) event depending on the start state. Also, from FIG. 12A, if a password is input, the system status is unlocked and the screen display becomes FIG. 12D. In this case, since it is not necessary to input the password further, the password cannot be input. However, if no operation is performed for a certain time from this state, a lock event (lk) occurs due to a timeout, the system returns to the initial state T0, and the screen display also returns to FIG. Further, in the state of FIG. 12A, when the holder clicks on the activation button of the usage mode 2, an activation event (up) is generated for the usage mode 2, and the execution target corresponding to the usage mode 2 is activated. . Further, FIG. 12B shows a state in which usage modes 4 and 7 are activated and usage modes 2 and 4 are selected. When “OK” is clicked in the state of FIG. 12B, the setting screen is exited and the execution target display screen (FIG. 12C) is transitioned to. Here, the screens of usage modes 2 and 4 selected on the screen of FIG. 12B are displayed. When a specific key is pressed on the execution target display screen, the screen transitions to a setting screen (for example, FIG. 12B).

  Note that the state transition diagram shown in FIG. 9 and the state transition table shown in FIG. 10 are examples of state transitions for the usage mode. The state transition for each usage mode need not be the same, and a different state transition diagram may be used for each context of the usage mode. For example, in the state transition of FIG. 9, the connection / disconnection, unlock / lock, and start / stop states are independent, but these states may be treated as related by different state transitions. For example, in the context of C1 (important business), a state transition that automatically starts after connection and stops automatically after disconnection may be used. In this case, the startup time can be minimized and the safety can be increased. In another usage mode, the activation waiting time may be reduced by automatically activating the execution target when the terminal is activated. Further, in the context of C6 (guest), it is also possible to use a state transition that does not require holder confirmation and does not perform locking. Furthermore, you may change the frequency which requires a holder confirmation for every context. For example, C1 (important work) requires an hourly holder confirmation, C2 (normal work) requires a daily holder confirmation, and C5 (private) requires a weekly holder confirmation. Is also possible. In this case, depending on the time of the last confirmation of the holder, a state where a certain usage mode is locked and another usage mode is unlocked may occur. As described above, even when the state transition is properly used for each context in the usage mode, the result of the holder confirmation can be shared between the usage modes. In any of the above cases, the state transition of each usage mode is simpler than that of FIG. 9, and the user's operation is also simplified. In particular, it is not necessary to separately perform login authentication for the execution target of each usage mode, and by sharing the result of the holder confirmation, the effort of user authentication is reduced. In addition, since the credential can be switched and used according to the context of the use mode based on the holder confirmation, authentication to the service providing server can be performed safely.

Processor, Program, Medium In the above description, the virtual client terminal 100 including the terminal management unit 120 has been described. The terminal management unit 120 may form a virtual client terminal by forming only it with one processor and incorporating it into the terminal. In this case, the terminal management unit 120 described above serves as a terminal management processor.

  Further, when the virtual client terminal or the terminal management apparatus is realized by a computer, the processing contents of functions that each component should have are described by a program. The processing functions are realized on the computer by executing the program on the computer.

  The program describing the processing contents can be recorded on a computer-readable recording medium. As the computer-readable recording medium, any recording medium such as a magnetic recording device, an optical disk, a magneto-optical recording medium, and a semiconductor memory may be used.

  The program is distributed by selling, transferring, or lending a portable recording medium such as a DVD or CD-ROM in which the program is recorded. Furthermore, the program may be distributed by storing the program in a storage device of the server computer and transferring the program from the server computer to another computer via a network.

  A computer that executes such a program first stores, for example, a program recorded on a portable recording medium or a program transferred from a server computer in its own storage device. When executing the process, the computer reads a program stored in its own recording medium and executes a process according to the read program. Note that the program in this embodiment includes information that is used for processing by an electronic computer and that conforms to the program (data that is not a direct command to the computer but has a property that defines the processing of the computer).

  In this embodiment, the present apparatus is configured by executing a predetermined program on a computer. However, at least a part of these processing contents may be realized by hardware.

  The present invention can be used for a virtual client terminal that has a plurality of usage modes for executing different processes according to the purpose of use and switches between the usage modes.

DESCRIPTION OF SYMBOLS 100 Virtual client terminal 110 Execution part 120 Terminal management part 121 Execution object management part 122 User management part 124 User interface part 125 Network connection management part 126 Control part 129 Terminal management recording part 130 Execution target recording part 140 Input / output part 190 Network interface part 1211 Context acquisition unit 1212 User interface information acquisition unit 1213 Environment setting unit (credential setting unit)
1214 State transition execution means 1221 Holder confirmation means 1222 Credential selection means

Claims (10)

A client terminal that executes a plurality of execution targets,
An execution unit for executing a plurality of execution target processes;
A terminal management unit for user management;
A network interface unit having a function of connecting to a network;
An input / output unit for exchanging information with users,
Context is information that indicates the usage and purpose of execution.
A usage mode represents a specific execution target that is executed under a specific context.
The terminal management unit
Records the usage mode management information that associates the execution target, the usage mode identification information, the context identification information that identifies the context, and the user interface information, the context management information that associates the context identification information and the credentials, and the credentials that are used for authentication. The terminal management recording unit,
An execution target management unit for managing a use mode for the execution target and a state of the execution target;
A user management unit for managing users;
A user interface unit configured to set a user interface according to the user interface information in the input / output unit,
The user management unit
A holder verification means for checking the legitimacy of the terminal holder,
Credential selection means for selecting a credential corresponding to the context identification information using the context management information, and
The execution target management unit
Context acquisition means for acquiring context identification information corresponding to the usage mode used by the terminal holder using the usage mode management information;
User interface information acquisition means for acquiring user interface information using the usage mode management information and passing it to the user interface unit;
A client terminal comprising: credential setting means for setting the selected credential. A client terminal according to claim 1,
The terminal management recording unit also records a state transition table that associates the state transition condition with the action and the action,
The execution target management unit
A client terminal comprising: state transition execution means for causing the state to be executed to transition according to the state transition table and executing a necessary action. The client terminal according to claim 2, wherein
The state transition of the execution target is a transition of a combination of connection / disconnection, unlock / lock, start / stop states,
State transition can be determined for each usage mode or for each context,
In addition, state transitions between usage modes can be set to independent or related, and combinations of connection / disconnection, unlock / lock, and start / stop states are independent or related to each other. A client terminal that can be set in a combined state. A client terminal capable of executing a plurality of execution targets, including an execution unit for executing a plurality of execution target processes, a network interface unit having a function of connecting to a network, and an input / output unit for exchanging information with a user User management method,
Context is information that indicates the usage and purpose of execution.
A usage mode represents a specific execution target that is executed under a specific context.
Recording usage mode management information that associates the execution target, usage mode identification information, context identification information, and user interface information, context management information that associates the context with environment setting information, and credentials used for authentication,
A holder verification step to verify the legitimacy of the device holder,
A context acquisition step of acquiring context identification information corresponding to a usage mode used by the terminal holder using the usage mode management information;
A credential selection step of selecting a credential corresponding to the acquired context identification information using the context management information;
A credential setting step for setting the selected credential; a user interface information acquisition step for acquiring user interface information using the usage mode management information;
A user interface setting step of setting a user interface according to the user interface information. The user management method according to claim 4, comprising:
Also record a state transition table that correlates the state transition condition and action of the execution target,
A user management method comprising: a state transition execution step of performing a necessary action by transitioning the state to be executed according to the state transition table. The user management method according to claim 5, wherein:
The state transition of the execution target is a transition of a combination of connection / disconnection, unlock / lock, start / stop states,
State transition can be determined for each usage mode or for each context,
In addition, state transitions between usage modes can be set to independent or related, and combinations of connection / disconnection, unlock / lock, and start / stop states are independent or related to each other. A user management method characterized in that it can be set in a combined state. Client including an execution unit that executes a plurality of execution target processes, a terminal management unit that performs user management, a network interface unit that has a function of connecting to a network, and an input / output unit that exchanges information with a user A terminal management processor for incorporation into a terminal,
Context is information that indicates the usage and purpose of execution.
A usage mode represents a specific execution target that is executed under a specific context.
Records the usage mode management information that associates the execution target, the usage mode identification information, the context identification information that identifies the context, and the user interface information, the context management information that associates the context identification information and the credentials, and the credentials that are used for authentication. The terminal management recording unit,
An execution target management unit for managing a use mode for the execution target and a state of the execution target;
A user management unit for managing users;
A user interface unit configured to set a user interface according to the user interface information in the input / output unit,
The user management unit
A holder verification means for checking the legitimacy of the terminal holder,
Credential selection means for selecting a credential corresponding to the context identification information using the context management information, and
The execution target management unit
Context acquisition means for acquiring context identification information corresponding to the usage mode used by the terminal holder using the usage mode management information;
User interface information acquisition means for acquiring user interface information using the usage mode management information and passing it to the user interface unit;
And a credential setting means for setting the selected credential. A terminal management processor according to claim 7,
The terminal management recording unit also records a state transition table that associates the state transition condition with the action and the action,
The execution target management unit
A terminal management processor, further comprising: a state transition execution unit that transitions the state to be executed according to the state transition table and executes a necessary action. A terminal management processor according to claim 8,
The state transition of the execution target is a transition of a combination of connection / disconnection, unlock / lock, start / stop states,
State transition can be determined for each usage mode or for each context,
In addition, state transitions between usage modes can be set to independent or related, and combinations of connection / disconnection, unlock / lock, and start / stop states are independent or related to each other. A terminal management processor that can be set in a combined state.   A program that causes a computer to operate as the client terminal according to any one of claims 1 to 3 or the terminal management processor according to any one of claims 7 to 9.

Images