JP5351565B2 - Information processing apparatus, information processing method, and program - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide an information processing device which compares applied and approved work application information with work record information as record information on operation work. <P>SOLUTION: The information processing device includes: a work application information receiving section 11 which receives work application information as an application for operation work to an information processing system; an approval information receiving section 15 which receives approval information showing whether the application shown by the work application information is approved or not; a work permission information accumulating section 16 which accumulates work permission information as the operation work showing approved work application information in a white list storing section 17; a work record information receiving section 19 which receives the work record information showing a record of the operation work performed to the information processing system according to the work application information; a work record information accumulating section 20 which accumulates the work record information; and an output section 21 which outputs the work permission information stored in the white list storing section 17 and the work record information accumulated by the work record information accumulating section 20. <P>COPYRIGHT: (C)2010,JPO&amp;INPIT

Description

  The present invention relates to an information processing apparatus or the like that performs processing for receiving work application information that is application information related to an operation work.

  Conventionally, in performing an operation work on an information processing system, an application is first made, and after the application is approved, the approved operation work has been executed. Also, when executing the operation work, the operation work is recorded, and the work is executed according to the approved operation work by comparing the record with the application of the approved operation work. It was confirmed manually whether it was done.

  As a related technique, a technique for acquiring an operation work history for an information processing system is already known (see, for example, Non-Patent Document 1).

"System Operation Inspection / Audit Solution", [online], [March 5, 2009 search], Internet (URL: http://www.et-x.jp/product/ess_rec/index.html)

  However, if a person compares the operation work that has been applied and approved with the record of the operation work that has actually been executed, there is a possibility that an error will occur. If double check or the like is performed in order to prevent such an error, more human resources are required, and there is a problem that a complicated process is imposed on a person who performs the comparison.

  The present invention has been made to solve the above-described problem, and is an information processing apparatus that supports processing for comparing work application information that has been applied and approved, and work record information that is record information of operation work. It is an object to provide an information processing apparatus that performs the comparison process.

  In order to achieve the above object, an information processing apparatus according to the present invention is information indicating an operation work on an information processing system, a work application information receiving unit that receives work application information that is information on an application for the operation work, and the work An approval information receiving unit that receives approval information that is information indicating whether or not the application indicated by the application information has been approved, a whitelist storage unit that stores work permission information that is permitted operation work, and the work application information Work permission information which is work application information received by the accepting unit and which is operation work information indicated by the work application information which has received approval information indicating that the approval information accepting unit has been approved, is the white list storage unit A work permission information storage unit for storing work records, and work record information indicating a record of operation work performed on the information processing system in accordance with the work application information. Work record information accepting unit, work record information accumulating unit for accumulating work record information accepted by the work record information accepting unit, work permission information stored in the white list storage unit, and the work record information And an output unit that outputs work record information accumulated by the accumulation unit.

  With such a configuration, it is possible to support processing for comparing work record information and work permission information. For example, it is possible to confirm whether or not the operation work indicated in the work permission information has been executed using the work record information and the work permission information output by the output unit.

In the information processing apparatus according to the present invention, the work record information storage unit stores the work record information in association with work permission information, and the output unit corresponds to the work permission information and the work permission information. Work record information may be output.
With such a configuration, the work permission information to be output is narrowed down, and the process of comparing the work record information and the work permission information can be made easier.

  In the information processing apparatus according to the present invention, the operation work indicated by the work record information matches the operation work indicated by any of the work permission information using the work permission information and the work record information output by the output unit. A determination unit that performs white list determination, which is determination as to whether or not to perform determination, and a determination result output unit that outputs a determination result of white list determination by the determination unit.

  With such a configuration, the executed operation work is an operation work that has been applied for and approved in advance based on the determination result of whether or not the operation work included in the work record information matches the operation work of the work permission information. You can easily check whether or not.

  The information processing apparatus according to the present invention further includes a black list storage unit that stores work disapproval information that is an operation operation that is not permitted, and the determination unit includes any operation permission that is indicated by the operation record indicated by the work record information. Although it does not match the operation work indicated by the information, it also performs a blacklist judgment that is a judgment as to whether or not it matches the operation work indicated by any of the work disapproval information. The determination result of the black list determination by may also be output.

  According to such a configuration, it is possible to easily identify an operation work that may not be applied and approved in advance but may be an unauthorized operation work based on the output determination result. As a result, an unauthorized operation can be easily detected.

  In the information processing apparatus according to the present invention, an application determination unit that determines whether the operation work indicated by the work application information received by the work application information reception unit matches the operation work indicated by any of the work non-permission information, And an application determination result output unit for outputting a determination result by the application determination unit.

  With such a configuration, if the operation work included in the work application information is executed without being approved, it is possible to know whether the operation work is highly likely to be judged as an unauthorized process. Become.

  In the information processing apparatus according to the present invention, the application determination result output unit may output the determination result before accepting approval information corresponding to the work application information with respect to certain work application information.

  With such a configuration, if the operation work included in the work application information is executed without being approved before approval, it is known whether the operation work is likely to be judged as an unauthorized process. Will be able to. As a result, at the time of approval, it can be determined whether or not to approve the operation work with particular attention. For example, when a lot of operation tasks are included in one task application information, it becomes difficult to distinguish between operation tasks that require attention and those that do not, and there is a possibility of oversight. However, by using the determination result by the application determination unit, it is possible to easily distinguish the operation work to be noted from the operation work that is not, so that an appropriate determination can be made.

In the information processing apparatus according to the present invention, the application determination result output unit includes work application information received by the work application information receiving unit, approval request information that is information for requesting approval for the work application information, The determination result by the application determination unit may be output in association with the determination result.
With such a configuration, the approval can be performed while referring to the determination result by the application determination unit, and the convenience at the time of approval is improved.

  In the information processing apparatus according to the present invention, the work application information may include at least information indicating a work content of the operation work.

  In the information processing apparatus according to the present invention, the information indicating the work content included in the work application information is text information described in a natural language, and information indicating the work content that is text information described in a natural language. And a correspondence information storage unit that stores correspondence information that is information for associating the information indicating the work content described by the code, and the determination unit is described in the natural language using the correspondence information The determination may be made using the work permission information converted from the information indicating the work content into the information indicating the work content described by the code.

  With such a configuration, the approval itself can be performed with information indicating the work content described in a natural language, so that the approver can better understand the work content and reduce mistakes in approval. Can do. Further, since the work content described in the natural language is automatically converted into the work content described by the code using the correspondence information, it is possible to eliminate an error during the conversion.

In the information processing apparatus according to the present invention, the work permission information is information indicating two or more operation works including a work order, and the determination unit is any one of the operation works indicated by the work record information. It may be determined whether or not two or more operation tasks indicated by the work permission information match, including whether or not the work order also matches.
With such a configuration, it is possible to determine whether or not the operation work indicated by the work record information matches the operation work indicated by the work permission information including the work order.

  According to the information processing apparatus or the like according to the present invention, for example, supporting the processing for comparing the work application information that has been applied and approved with the work record information that is the record information of the operation work, or the comparison process Can be done. In this way, for example, it is possible to check whether the operation work that has been performed matches the operation work that has been requested and approved, or whether there has been an unauthorized operation. sell.

The block diagram which shows the structure of the information processing apparatus by Embodiment 1 of this invention. The figure for demonstrating the white list and black list in the embodiment The flowchart which shows operation | movement of the information processing apparatus by the embodiment The flowchart which shows operation | movement of the information processing apparatus by the embodiment The flowchart which shows operation | movement of the information processing apparatus by the embodiment The figure which shows an example of the system containing the information processing apparatus in the embodiment The figure which shows an example of the black list in the embodiment The figure which shows an example of the correspondence information in the embodiment The figure which shows an example of the input screen of the work application information in the embodiment The figure which shows an example of the work application information in the embodiment The figure which shows an example of the approval / rejection screen of the work application information in the embodiment The figure which shows an example of the login screen in the embodiment The figure which shows an example of the work record information in the embodiment The figure which shows an example of permission / non-permission of each operation work of the work record information in the embodiment The figure which shows an example of permission / non-permission of each operation work of the work record information in the embodiment The figure which shows an example of permission / non-permission of each operation work of the work record information in the embodiment The schematic diagram which shows an example of the external appearance of the computer system in the said embodiment The figure which shows an example of a structure of the computer system in the said embodiment.

  Hereinafter, an information processing apparatus according to the present invention will be described using embodiments. In the following embodiments, components and steps denoted by the same reference numerals are the same or equivalent, and repetitive description may be omitted.

(Embodiment 1)
An information processing apparatus according to Embodiment 1 of the present invention will be described with reference to the drawings.
FIG. 1 is a block diagram showing a configuration of an information processing apparatus 1 according to the present embodiment. The information processing apparatus 1 according to the present embodiment includes a work application information reception unit 11, a work application information storage unit 12, an application determination unit 13, an application determination result output unit 14, an approval information reception unit 15, and a work permission. Information storage unit 16, white list storage unit 17, black list storage unit 18, work record information receiving unit 19, work record information storage unit 20, output unit 21, correspondence information storage unit 22, and determination unit 23 and a determination result output unit 24.

  The work application information receiving unit 11 receives work application information. The work application information is information indicating an operation work for the information processing system, and is information on an application for the operation work. The work application information may include information indicating that it is an application, or if the information processing apparatus 1 recognizes that the information is an application, the information indicating that it is an application. May not be included. The “operation work for the information processing system” includes various operation work related to the information processing system. For example, the operation work may be control or operation processing (for example, access to the device or change of setting information used in the device) for a system or device (stand-alone or not). May be a process for software or data (for example, a process for changing, adding, or deleting software or data), or may be another operation work. However, the operation work is executed electronically via, for example, a computer, a network, a user interface, or the like.

  It is assumed that the work application information includes at least information indicating the work content of the operation work. The information indicating the work content may be, for example, information indicating the work target of the operation work (for example, identification information such as a device, data, or software), and information indicating the processing content of the operation work (For example, processing such as change, addition, deletion, reading, backup, etc.), or both of them, or information indicating other work contents may be used. Further, the information indicating the operation content may be text information described in a natural language such as “Insert CD” or the like, such as “delete”, “update”, “insert”, etc. It may be information described by a prescribed command or code. In the present embodiment, the former case will be described. In the former case, the information indicating the operation content may be input from a keyboard or the like, or may be input by selection from a menu or the like. Further, in the work application information, two or more operation works are generally shown including a work order. For example, it may be described that the operation content A is executed first, the operation content B is executed second, and the operation content C is executed third. The work application information may indicate only one operation work. Further, the work application information may or may not include information for identifying the worker who performs the work. In addition, the work application information may or may not include information indicating the time when the work is performed. The information indicating the time when the work is performed may be, for example, information indicating the start of the time, information indicating the end of the time, or both.

  The work application information receiving unit 11 may receive work application information input from an input device (for example, a keyboard, a mouse, a touch panel, etc.), for example, and the work application information transmitted via a wired or wireless communication line May be received, and work application information read from a predetermined recording medium (for example, an optical disk, a magnetic disk, a semiconductor memory, etc.) may be received. Note that the work application information receiving unit 11 may or may not include a device (for example, a modem or a network card) for receiving. In addition, the work application information receiving unit 11 may be realized by hardware, or may be realized by software such as a driver that drives a predetermined device.

  The work application information accumulating unit 12 accumulates the work application information received by the work application information receiving unit 11 in a recording medium. The recording medium is, for example, a semiconductor memory, an optical disk, a magnetic disk, or the like, and may be included in the work application information storage unit 12 or may exist outside the work application information storage unit 12. Moreover, this recording medium may memorize | store temporary work application information, and may not be so.

  The application determination unit 13 matches the operation work indicated by the work application information received by the work application information reception unit 11 with the operation work indicated by any work disapproval information stored in the blacklist storage unit 18 described later. Judge whether or not. The work disapproval information is an operation work that is not permitted. Therefore, the application determination unit 13 determines whether or not the operation work indicated by the work application information is permitted. In addition, when the work application information includes information indicating two or more operation tasks, the application determination unit 13 generally determines for each operation task, but this need not be the case.

  The application determination result output unit 14 outputs the determination result by the application determination unit 13. It is preferable that the application determination result output unit 14 outputs a determination result for certain work application information before receiving approval information corresponding to the work application information (the approval information will be described later). This is because the determination result can be used when approving. In addition, the application determination result output unit 14 includes work application information received by the work application information receiving unit 11, approval request information that is information for requesting approval for the work application information, and an application determination unit 13 for the work application information. The determination result by may be output in association with each other. In this embodiment, this case will be described. The approval request information may be any information as long as it is understood that the approval is requested. For example, it may be information for displaying an “approval” button and a “reject” button, text information such as “please approve”, or other information that requires approval. It may be. Further, outputting the work application information, the approval request information, and the determination result in association with each other may be to output them simultaneously, or to output them in order, Any method may be used as long as it is output so that it can be seen that they are associated with each other.

  Here, the output may be, for example, display on a display device (for example, a CRT or a liquid crystal display), transmission via a communication line to a predetermined device, printing by a printer, or output to a recording medium. It may be accumulated or delivered to another component. Even if the output is transmission, storage in a recording medium, or delivery to another component, the information to be output is eventually displayed or printed, Shall be presented. The application determination result output unit 14 may or may not include an output device (for example, a display device or a printer). The application determination result output unit 14 may be realized by hardware, or may be realized by software such as a driver that drives these devices.

  The approval information receiving unit 15 receives approval information that is information indicating whether or not the application indicated by the work application information has been approved. The approval information preferably includes information for identifying work application information to be approved or rejected. As a result, it becomes possible to know which work application information has been approved or not. The information for identifying the work application information may be, for example, the work application information itself, a hash value of the work application information, or identification information such as an ID given to the work application information. Alternatively, it may be information for identifying other work application information. When the information for identifying the work application information is identification information such as an ID given to the work application information, the identification information is, for example, sent together with the work application information by the application determination result output unit 14. It is preferable that it is output.

  For example, the approval information receiving unit 15 may receive approval information input from an input device (for example, a keyboard, a mouse, a touch panel, etc.), and receives approval information transmitted via a wired or wireless communication line. Alternatively, approval information read from a predetermined recording medium (for example, an optical disk, a magnetic disk, a semiconductor memory, etc.) may be received. The approval information receiving unit 15 may or may not include a device (for example, a modem or a network card) for receiving. Further, the approval information receiving unit 15 may be realized by hardware, or may be realized by software such as a driver that drives a predetermined device.

  The work permission information accumulating unit 16 is the work application information received by the work application information receiving unit 11 and the operation work information indicated by the work application information received by the approval information receiving unit 15 as approval information indicating approval. The work permission information is stored in the white list storage unit 17 to be described later. That is, the work permission information is operation work information indicated by the approved work application information. The work permission information may or may not be the work application information itself. In the former case, for example, the approved work application information itself may be stored in the whitelist storage unit 17 by the work permission information storage unit 16. In the latter case, for example, the work permission information storage unit 16 extracts operation work information from the approved work application information, configures work permission information including the extracted operation work information, and stores the white list. It may be accumulated in the unit 17. In addition, when the work application information includes information indicating two or more operation works including the work order, the work permission information stored corresponding to the work application information is also two or more operation works. Is information including the work order.

  The white list storage unit 17 stores a white list including one or more work permission information that is permitted operation work. As described above, the work permission information stored in the whitelist storage unit 17 is accumulated by the work permission information accumulation unit 16.

  The storage in the white list storage unit 17 may be temporary storage in a RAM or the like, or may be long-term storage. The white list storage unit 17 can be realized by a predetermined recording medium (for example, a semiconductor memory, a magnetic disk, an optical disk, etc.).

  The black list storage unit 18 stores a black list including one or more work disapproval information that is an operation work that is not permitted. The work disapproval information included in the black list indicates an operation work that may be an illegal operation. For example, the work disapproval information indicates an operation work for important data, an operation work for deleting data or software, an operation work for changing settings of an apparatus or a system, and the like. Note that one piece of work disapproval information generally indicates one operation work, but this need not be the case. For example, the work disapproval information may be information indicating two or more operation works. In that case, information indicating two or more operation tasks may be included including the order.

The process of storing the black list in the black list storage unit 18 does not matter. For example, a black list may be stored in the black list storage unit 18 via a recording medium, and a black list transmitted via a communication line or the like is stored in the black list storage unit 18. Alternatively, the black list input via the input device may be stored in the black list storage unit 18. The storage in the black list storage unit 18 may be temporary storage in a RAM or the like, or may be long-term storage. The black list storage unit 18 can be realized by a predetermined recording medium (for example, a semiconductor memory, a magnetic disk, an optical disk, etc.).

  The work record information receiving unit 19 receives work record information indicating a record of operation work performed on the information processing system in accordance with the work application information. This work record information may be so-called operation work history information. In addition, the work record information is obtained by automatically recording an operation work performed according to the work application information by a computer or the like. For the recording, for example, the system introduced in Non-Patent Document 1 described above may be used. By using such a system, it is possible to record various operation tasks such as a moving image on the operation screen, a communication port, a file access, a process, and a keyboard stamp. For example, when the work record information is a moving image on the operation screen, the name of the table or database displayed in the moving image may be acquired by character recognition. Usually, since the position where the name of the table or database is displayed is often determined, character recognition may be performed only for the image at that position. In addition, when the button is clicked, the button color is changed, etc., and the clicked button is identified, and the character string displayed on the button is acquired by character recognition. Information for specifying the button, for example, “search” may be acquired. In this way, it is also possible to acquire information related to the operation work that the “search” button has been clicked from the moving image. In the present embodiment, a case will be described in which the work record information is information indicating a command, a communication port, a process, and the like.

  The work record information receiving unit 19 may receive work record information transmitted via, for example, a wired or wireless communication line, and read it from a predetermined recording medium (for example, an optical disk, a magnetic disk, a semiconductor memory, etc.). The issued work record information may be received. Note that the work record information receiving unit 19 may or may not include a device for receiving (for example, a modem or a network card). The work record information receiving unit 19 may be realized by hardware, or may be realized by software such as a driver that drives a predetermined device.

  The work record information storage unit 20 stores the work record information received by the work record information reception unit 19 in a recording medium. The recording medium is, for example, a semiconductor memory, an optical disk, a magnetic disk, or the like, and may be included in the work record information storage unit 20 or may exist outside the work record information storage unit 20. In addition, this recording medium may or may not store work recording information temporarily. Further, when storing the work record information, the work record information storage unit 20 may or may not store the work record information in association with the work permission information corresponding to the work record information. The accumulation in association may be to accumulate the link (link) between the work record information and the work permission information so as to be clear, or as a result, accumulate so that the link between both can be understood. It may be. In the former case, for example, when the work record information is stored, the work record information storage unit 20 stores the identification information of the work permission information corresponding to the work record information in association with the work record information. It may be. The identification information may be, for example, an ID of work permission information, a pointer indicating a position where the work permission information is stored, or information identifying other work permission information. Good. In the latter case, that is, as a result, when the work record information and the work permission information are stored so as to be associated with each other, for example, the items included in both pieces of information may be the same. This is because it can be determined afterwards whether or not the information is included by confirming whether the information included in each item matches.

  Here, the relationship between work permission information and work record information corresponding to the work permission information will be described. As described above, the work permission information is information indicating the same operation work as the approved work application information. Accordingly, work permission information indicating the same operation work as the approved work application information is referred to as work permission information corresponding to the approved work application information. The work record information is a record of operation work executed in accordance with the approved work application information. Accordingly, the work permission information that is a record of the operation work executed in accordance with the approved work application information is referred to as work record information corresponding to the approved work application information. Corresponding work permission information and work record information via the approved work application information become work permission information and work record information corresponding to each other.

  The output unit 21 outputs zero work permission information or one or more work permission information included in the white list stored in the white list storage unit 17 and the work record information accumulated by the work record information accumulation unit 20. To do. When the work record information storage unit 20 stores the work record information in association with the work permission information, the output unit 21 outputs the work record information and the work permission information corresponding to the work record information. May be. In this case, if there is no work permission information corresponding to the work record information, only the work record information is output. That is, zero work permission information and work record information are output. In the present embodiment, a case where one or more pieces of work permission information and work record information are output will be mainly described. Here, this output may be, for example, transmission via a communication line to a predetermined device, accumulation in a recording medium, or delivery to another component, but in this embodiment, this output Will be described in the case of delivery to the determination unit 23 described later. The output unit 21 may or may not include an output device (for example, a display device or a printer). The output unit 21 may be realized by hardware, or may be realized by software such as a driver that drives these devices.

  The correspondence information storage unit 22 stores one or more pieces of correspondence information that is information that associates work information that is text information described in a natural language with information that represents work content described by a code. The information indicating the work content, which is text information described in a natural language, may be information using a regular expression or the like, for example, “Server A. * Logon”, and “Log on to Server A”. It may be one that does not use a regular expression, such as “Log on to server A”. The information indicating the work content described by the code may be identification information of the work content, or may be information indicating a process of the work content, a communication port, a command, or the like. Further, the correspondence information stored in the correspondence information storage unit 22 may be related to the work content corresponding to the work non-permission information, or may include information related to other work content. In the present embodiment, the former case will be described. In the latter case, for example, in work application information and work permission information, all information indicating work contents described in natural language can be converted into information indicating work contents described in code. Information may be in place. Note that information indicating the work content described in the code may be simply referred to as a code.

  The process in which the correspondence information is stored in the correspondence information storage unit 22 does not matter. For example, correspondence information may be stored in the correspondence information storage unit 22 via a recording medium, and correspondence information transmitted via a communication line or the like is stored in the correspondence information storage unit 22. Alternatively, the correspondence information input via the input device may be stored in the correspondence information storage unit 22. The storage in the correspondence information storage unit 22 may be temporary storage in a RAM or the like, or may be long-term storage. The correspondence information storage unit 22 can be realized by a predetermined recording medium (for example, a semiconductor memory, a magnetic disk, an optical disk, etc.).

  Here, “corresponding information indicating work content that is text information described in natural language and information indicating work content described in code” is work content that is text information described in natural language This means that it is only necessary to obtain the other information from the information indicating the work content described in the code and the information indicating the work content. Therefore, the correspondence information may include information including both pieces of information as a set, or may be information that links both pieces of information. In the latter case, the correspondence information includes, for example, information indicating work content that is text information described in a natural language, and a pointer or address indicating a position where information indicating work content described in code is stored. May be information for associating. In the present embodiment, the former case will be described. Moreover, both information does not need to be directly matched. For example, the third information may correspond to one information, and the other information may correspond to the third information.

  The determination unit 23 uses the work permission information and work record information output from the output unit 21 to determine whether the operation work indicated by the work record information matches the operation work indicated by any of the work permission information. Make a whitelist decision. If it is determined that the whitelists match, the operation work is an operation work that has been applied and approved in advance. Therefore, it is possible to know that the operation work that has been applied and approved in advance has been appropriately executed. That is, this determination makes it possible to know whether or not the operation work has been executed within the range of the approved work application information. Note that the determination unit 23 determines whether or not only the operation work indicated by the work permission information matches the operation work indicated by the work permission information among the operation work indicated by the work record information. You may make it judge. The operation work that does not match the operation work indicated by the work disapproval information is considered not an illegal operation, so it may not be necessary to judge whether it matches the operation work indicated by the work permission information. Because it can. Further, the determination unit 23 may determine whether or not all of the operation work indicated by the work permission information is included in the work record information. If included, all operation operations included in the approved work application information have been executed. If not included, all operation operations included in the approved operation request information. Among them, there is an operation work that has not been executed.

  Further, the determination unit 23 determines whether the operation work indicated by the work record information does not match the operation work indicated by any work permission information, but matches the operation work indicated by any work permission information. The blacklist judgment which is judgment is also performed. In this blacklist judgment, if it does not match the operation work indicated by any work permission information, but it is judged that it matches the operation work indicated by any work permission information, it is not applied and approved in advance. An operation operation that is an operation operation that is not permitted is executed. That is, this determination makes it possible to know whether an unauthorized operation work has been performed.

  Note that the determination unit 23 uses the correspondence information stored in the correspondence information storage unit 22 to determine the work described in the code from the information indicating the work content described in the natural language. Judgment is made using the work permission information converted into the information indicating the contents. In the present embodiment, a case will be described in which information indicating work content using correspondence information is converted during the determination processing by the determination unit 23, but it is needless to say that the timing of the conversion does not matter. . For example, the conversion may be performed before accumulating in the white list storage unit 17, or the conversion may be performed when stored in the white list storage unit 17, and before being output to the determination unit 23. Alternatively, the conversion may be performed. Moreover, the subject of conversion using correspondence information is not limited. For example, as described in the present embodiment, conversion may be performed by the determination unit 23, or conversion may be performed by other components.

  When the work permission information or the work record information indicates two or more operation works, the determination unit 23 performs the above-described determination process for each operation work. When the output unit 21 outputs one piece of work record information and one piece of work permission information corresponding to the one piece of work record information to the decision unit 23, the decision unit 23 sets the one piece of work record. The determination process may be performed only on the information and the one work permission information.

  Further, when the work permission information is information indicating two or more operation works including the work order, the determination unit 23 determines that the operation work indicated by the work record information is two or more indicated by any of the work permission information. It may be determined whether or not it matches the operation work, including whether or not the work order also matches. For example, when the work permission information indicates that the backup is to be deleted after the backup, and the work record information indicates that the backup is to be performed after the deletion, the operation according to the work permission information is performed. It is not determined that the work has been performed. Even in the case where such a determination is made, it may or may not be determined whether or not they match without including the work order.

  In addition, when the work permission information and work record information include information other than the work content, for example, information for identifying the worker, information indicating the work time, etc., the information including these information should be matched or mismatched. It may be judged, or matching or mismatching may be determined without including such information. For example, in the case of a system that is set so that the worker identified by the information identifying the worker indicated by the work permission information can perform the operation work only at the work time indicated by the work permission information. Because it is natural that the work permission information and the work record information match the information identifying the worker and the work time, without using the information identifying the worker or the work time. It is.

  In addition, the determination of “match” may include that one is included in the other. For example, if one piece of information is a time, another piece of information is a date and time, and the date and time is included in the time, it may be determined that the two match. Also, for example, if one piece of information is information indicating a group of people and the other information is information indicating a single person, and if that single person is included in the group, the two pieces of information match. You may judge that. Also, for example, when one information is information described using a regular expression and the other information is information that is not, the other information is included in the information described using the regular expression. If it is, you may judge that both information corresponds.

  Also, here, when the determination unit 23 makes a determination using the work permission information converted from the information indicating the work content described in the natural language into the information indicating the work content described in the code by the correspondence information. As described above, the application determination unit 13 also converts the action application information converted from the information indicating the work content described in the natural language into the information indicating the work content described in the code, like the determination unit 23. May be used to determine whether or not the operation work indicated by the work application information matches the operation work indicated by the work non-permission information.

  The determination result output unit 24 outputs the determination result of the white list determination by the determination unit 23. The determination result of the white list determination is, for example, information on whether or not the operation work in the work record information matches the operation work in the work permission information. The determination result output unit 24 also outputs the determination result of the black list determination by the determination unit 23. The determination result of the black list determination is, for example, information on whether or not the operation work in the work record information matches the operation work in the work disapproval information. When the operation work of the work record information is not included in the white list or the black list, the determination result output unit 24 may output information indicating that. Thus, if the determination result output unit 24 outputs information on the determination result by the determination unit 23, the output target is not limited. Moreover, the expression method of this judgment result is not ask | required. The determination result by the determination unit 23 indicates whether each operation work included in the work record information matches the work permission information or whether it matches the work non-permission information by text, symbols, marks, colors, etc. It may be displayed. Further, when the determination including the order is performed, whether or not the operation operation according to the order is performed may be displayed by text, a symbol, or the like according to the determination result. Further, when there is an operation work that is not included in the work record information among the operation works included in the work permission information, the determination result may indicate the operation work.

  Here, the output may be, for example, display on a display device (for example, a CRT or a liquid crystal display), transmission via a communication line to a predetermined device, printing by a printer, or output to a recording medium. It may be accumulated or delivered to another component. The determination result output unit 24 may or may not include an output device (for example, a display device or a printer). The determination result output unit 24 may be realized by hardware, or may be realized by software such as a driver that drives these devices.

  The work application information storage unit 12 stores the work application information, the white list storage unit 17, the black list storage unit 18, the work record information storage unit 20 stores the work record information, Of the correspondence information storage unit 22, any two or more recording media and storage units may be realized by the same recording medium, or may be realized by separate recording media. In the former case, for example, the area storing the white list is the white list storage unit 17, and the area storing the black list is the black list storage unit 18.

  Here, the white list and the black list will be described. Originally, it is ideal that only the operation work included in the white list which is a set of work permission information indicating the operation work applied and approved in advance is permitted. However, in such a case, although the operation is not included in the white list, the operation of “A” key, which is considered not to be an unauthorized process, is not permitted and is not appropriate. Therefore, as shown in FIG. 2, a set B (black list) of operation operations that are considered to be illegal is set out of the set U of all operation operations, and the operations that have been applied and approved in advance are then set. A set of work A (white list) is registered afterwards. The set A is a set of a subset An (n is an integer of 1 or more). The subset An is assumed to correspond to one piece of work permission information. If the executed operation work is not included in the set B, it is determined that the operation work is not unauthorized. In addition, the executed operation work is included in the set B, but if it is also included in the set A, it is determined that it is not an unauthorized operation work because it is an approved operation work. Further, when the executed operation work and the operation work that is an element of the subset An match, it is determined that the operation work that has been applied and approved in advance has been executed. In this way, by comparing the operation work indicated by the work record information with the white list or black list, it is confirmed whether the operation work indicated by the work record information is an unauthorized work or not. It becomes possible to know whether or not a series of operation operations performed has been executed. Further, as described above, the whitelist determination is performed by determining whether the operation work indicated by the work record information is included in the subset An (for example, A2, A3, A6, A7) within the range included in the set B. Alternatively, it may be determined whether or not the operation work indicated by the work record information is included in all the subsets An (for example, A1 to A7).

  As is clear from the nature of such blacklists and whitelists, work permission information is generally more detailed information than work disapproval information, but this is not the case. Also good. For example, in the work disapproval information, the worker and the work time may not be limited, but in the work permission information, the worker and the work time may be limited.

Next, the operation of the information processing apparatus 1 according to the present embodiment will be described using the flowchart of FIG.
(Step S101) The work application information receiving unit 11 determines whether work application information has been received. If accepted, the process proceeds to step S102; otherwise, the process proceeds to step S105.

  (Step S102) The work application information storage unit 12 stores the work application information received by the work application information reception unit 11 in a recording medium.

  (Step S103) The application determination unit 13 determines whether the operation work indicated by the work application information received by the work application information reception unit 11 matches the operation work indicated by the work non-permission information. Details of this processing will be described later with reference to the flowchart of FIG.

  (Step S104) The application determination result output unit 14 receives the work application information received by the work application information reception unit 11, the determination result by the application determination unit 13 for the work application information, and information requesting approval for the work application information. The approval request information is output. Then, the process returns to step S101.

  (Step S105) The approval information receiving unit 15 determines whether approval information has been received. If the approval information is accepted, the process proceeds to step S106, and if not, the process proceeds to step S108.

  (Step S106) The work permission information accumulating unit 16 determines whether the approval information received by the approval information receiving unit 15 indicates that it has been approved or rejected. Then, if it is shown that it has been approved, the process proceeds to step S107, but if not, it returns to step S101 if it is shown that it has been rejected.

  (Step S <b> 107) The work permission information accumulation unit 16 accumulates work permission information, which is operation work information indicated by the approved work application information, in the white list storage unit 17. Then, the process returns to step S101.

  (Step S108) The work record information receiving unit 19 determines whether or not work record information has been received. If work record information has been received, the process proceeds to step S109; otherwise, the process returns to step S101.

  (Step S109) The work record information accumulating unit 20 accumulates the work record information received by the work record information receiving unit 19 in a recording medium.

  (Step S110) The output unit 21 reads and determines the work record information stored in the work record information storage unit 20 and the work permission information stored in the whitelist storage unit 17 corresponding to the work record information. To the unit 23. If there is no work permission information corresponding to the work record information, only the work record information is output.

  (Step S <b> 111) The determination unit 23 performs white list determination, black list determination, and the like using the work record information and the work permission information output from the output unit 21. The operation of this process will be described later using the flowchart of FIG.

  (Step S112) The determination result output unit 24 outputs the determination result by the determination unit 23. Then, the process returns to step S101.

  In the flowchart of FIG. 3, the process ends when the power is turned off or the process is terminated.

FIG. 4 is a flowchart showing details of the determination process (step S103) regarding the work application information in the flowchart of FIG.
(Step S201) The application determination unit 13 sets the counter i to 1.

  (Step S <b> 202) The application determination unit 13 determines whether the i-th work content included in the work application information matches any of the work disapproval information included in the black list stored in the black list storage unit 18. to decide. And when it corresponds with any work disapproval information, it progresses to step S203, and when that is not right, it progresses to step S204. At the time of this determination, in the present embodiment, the application determination unit 13 uses the correspondence information to describe information indicating the work content described in the natural language indicated by the work application information by a code. It is converted to information indicating the work content, and using the information indicating the work content after the conversion, it is determined whether or not it matches the work non-permission information.

  (Step S203) The application determination unit 13 gives to the work content that the i-th work content included in the work application information is non-permitted that matches the work non-permission information. The non-permitted thing may be text information such as “black list” and “non-permitted”, may be a predetermined color or the like, and may be a predetermined highlight (for example, The character may be bold, the font of the character is enlarged, or the character is surrounded by a frame.

  (Step S204) The application determination unit 13 increments the counter i by 1.

  (Step S205) The application determination unit 13 determines whether or not the i-th work content exists in the work application information. If it exists, the process returns to step S202. If not, it is determined that all work contents have been determined, and the process returns to the flowchart of FIG.

  In the flowchart of FIG. 4, when the work disapproval information included in the blacklist relates only to the work content, and it is determined whether the work content included in the work application information matches the work disapproval information. However, if the work disapproval information included in the blacklist is also related to the work time and workers other than the work content, the operation work included in the work application information matches the work disapproval information, A mismatch may be determined.

  FIG. 5 is a flowchart showing details of the determination process (step S111) in the flowchart of FIG. In the flowchart of FIG. 5, it is assumed that the worker can perform work only with the worker specified in the work application information that has been applied and approved. It is not judged whether they match. On the other hand, the timing shall be determined. Further, in this flowchart, it is assumed that the work non-permission information stored in the black list storage unit 18 is associated with an ID for identifying the work non-permission information. In this flowchart, the information indicating the work content described in the code, which is associated with the information indicating the work content described in the natural language by the correspondence information, is the code itself, and the code is not permitted to work. It is assumed that the ID is information. Further, in this flowchart, a case will be described in which one piece of work record information and one piece of work permission information corresponding thereto are output by the output unit 21.

  (Step S301) The determination unit 23 sets the counter i to 1.

  (Step S <b> 302) The determination unit 23 determines whether the i-th operation work included in the work record information matches any of the work disapproval information included in the black list stored in the black list storage unit 18. To do. And when it corresponds with any work disapproval information, it progresses to step S303, and when that is not right, it progresses to step S305.

  (Step S303) The determination unit 23 gives to the operation work that the i-th operation work included in the work record information is a non-permission that matches the work non-permission information. The non-permission information may be text information such as “black list” or “non-permission”, or may be a predetermined color (for example, red).

  (Step S304) The determination unit 23 reads the ID associated with the work disapproval information that matches the i-th operation work included in the work record information, and uses the ID of the work disapproval information as the work record information. It is given to the i-th operation work included. Giving an ID to an operation work may be, for example, storing the ID in a recording medium (not shown) in association with the operation work.

  In addition, since the objective of the process of step S303 can also be achieved by performing the process of step S304, the process of step S303 does not need to be performed.

  (Step S305) The determination unit 23 increments the counter i by one.

  (Step S306) The determination unit 23 determines whether or not the i-th operation work exists in the work record information. And when it exists, it returns to step S302, and when that is not right, it progresses to step S307.

  Note that it is determined whether or not each operation work included in the work record information corresponds to the work non-permission information included in the black list by the processing of steps S301 to S306.

  (Step S307) The determination unit 23 determines whether the information indicating the timing of the work record information matches the work permission information output in association with the work record information. If they match, the process proceeds to step S308. If they do not match, each operation work of the work record information is not included in the white list, and the process returns to the flowchart of FIG.

  (Step S308) The determination unit 23 sets the counter j to 1.

  (Step S309) The determination unit 23 determines whether there is correspondence information corresponding to the j-th work content of the work permission information output by the output unit 21. That is, the determination unit 23 determines whether there is information indicating the work content that is text information described in a natural language that matches the j-th work content. And when it exists, it progresses to step S310, and when that is not right, it progresses to step S314.

  (Step S <b> 310) The determination unit 23 acquires a code associated with the information indicating the work content that is text information described in a natural language that matches the j-th work content.

  (Step S311) The determination unit 23 determines whether or not the ID of the work non-permission information that matches the code acquired in step S310 is given to any operation work in the work record information. If it has been granted, the process proceeds to step S312; otherwise, the process proceeds to step S314.

  (Step S312) The determination unit 23 gives the fact that the operation work to which the ID of the work non-permission information that matches the acquired code is given is a permission that matches the work permission information. The permission information may be, for example, text information such as “white list” and “permission”, or may be a predetermined color (for example, yellow). In addition, the fact that it is a non-permission granted so far may be deleted or left.

  (Step S313) The determination unit 23 stores the order in the work record information of the operation work given permission in step S312 in a recording medium (not shown). For example, if the operation work given that it is permitted in step S312 is the Nth work in the work record information, the determination unit 23 accumulates the value of “N”. In this accumulation, accumulation is performed so that the order of accumulation can be understood.

  (Step S314) The determination unit 23 increments the counter j by 1.

  (Step S315) The determination unit 23 determines whether or not the j-th work content exists in the work permission information. If it exists, the process returns to step S309, and if not, the process proceeds to step S316.

  (Step S316) The determination unit 23 determines whether the order of the operation work in the work record information accumulated in step S313 is ascending order in the accumulation order. If there is a part that is not in ascending order, there is a place where the order of the operation work in the work permission information and the order of the operation work in the work record information are interchanged. Returning to the flowchart of FIG. On the other hand, when the order of the operation work in the work record information accumulated in step S313 is ascending order in the accumulation order, the order of the operation work in the work permission information matches the order of the operation work in the work record information. Therefore, the process proceeds to step S317.

  (Step S317) The determination unit 23 gives the fact that the order is also matched to the operation work given that it is granted in step S312. The fact that the order also matches may be text information such as “order matching”, or may be a predetermined color (for example, blue or green). Further, the fact that the permission has been granted so far may be deleted or left. And it returns to the flowchart of FIG.

  In the flowchart of FIG. 5, the case where the fact that the order is also matched is described in step S317. However, even if the order is matched, a plurality of work contents included in the work permission information are included. You can't know if everything was done. Therefore, in order to be able to know whether or not all of the plurality of work contents included in the work permission information have been executed, the determination unit 23 accumulates the order in the work record information of the operation work in step S313. At this time, the value of the counter j may also be accumulated. Then, after the processing for all the work contents of the work permission information is completed, it is determined whether or not the accumulated value of the counter j is continuous from 1 to the total number of work contents. If it is continuous, all work contents of the work permission information have been executed. On the other hand, if it is not continuous, any work content of the work permission information has not been executed. However, this determination can be made when all the work contents of the work permission information can be converted into codes in the correspondence information (that is, when NO in step S309).

  Further, the white list determination is performed in steps S308 to S315 in the flowchart of FIG. That is, in the processing, the operation work given that it is permitted is the operation work corresponding to the white list. However, in the flowchart of FIG. 5, the white list determination is performed within the range included in the black list. That is, it is not determined whether or not the subsets A1, A4, and A5 in FIG. In addition, in Steps S301 to S306 in the flowchart of FIG. 5, it is given that it is not permitted, and in Steps S308 to S315, the operation work that is not given that it is permitted corresponds to the black list. Operational work. Therefore, blacklist determination is performed in steps S301 to S315. If only the work record information is output in step S110 of the flowchart of FIG. 3, only the determination (steps S301 to S306) of whether or not it corresponds to the black list is executed in the flowchart of FIG. After that, since there is no work permission information, NO is returned in step S307 and the process returns to the flowchart of FIG.

  Further, in the flowchart of FIG. 5, a case has been described in which it is first determined whether or not it corresponds to the black list, and then whether or not it corresponds to the white list, but this need not be the case. For example, first, it is determined whether each operation work in the work record information corresponds to the white list, and then, it is determined whether the operation work that does not correspond to the white list corresponds to the black list. May be. In such a determination, for example, it is possible to determine a white list that is not related to the range of the black list, for example, whether or not it corresponds to the subsets A1, A4, and A5 in FIG.

  In the flowchart of FIG. 5, the case has been described in which the determination unit 23 makes a determination using one piece of work record information output from the output unit 21 and one piece of work permission information corresponding to the work record information. It does n’t have to be. For example, the output unit 21 may output one piece of work record information and all work permission information included in the white list, and the determination unit 23 may make a determination using the plurality of work permission information. In this case, the determination unit 23 may first identify work permission information that matches the worker and time of the work record information, and perform the same processing as in FIG. 5 using the identified work permission information. Good.

  Next, the operation of the information processing apparatus 1 according to this embodiment will be described using a specific example. In this specific example, as shown in FIG. 6, the information processing apparatus 1, the applicant terminal 2, the approver terminal 3, and the server 4 are connected via a wired or wireless communication line 500. And The communication line 500 is, for example, the Internet, an intranet, a public telephone line network, or the like. The applicant terminal 2 is a terminal through which the applicant inputs information included in the work application information. The approver terminal 3 is a terminal where the approver approves work application information. The server 4 is assumed to be a target for an operator who performs an approved operation work to perform the operation work.

  In this specific example, the black list storage unit 18 stores the black list shown in FIG. The black list in FIG. 7 has a plurality of records having non-permission IDs and work non-permission information. For example, in the first record, a process for accessing the IP address “192.168.105.170” is defined as work non-permission information, and the non-permission ID that is identification information of the work non-permission information is “B001”. Is shown. In the second record, it is defined as work disapproval information that media can be inserted into a CD or DVD drive, and the disapproval ID of the work disapproval information is “B002”. Yes.

  In this specific example, the correspondence information storage unit 22 stores the correspondence information shown in FIG. In the correspondence information in FIG. 8, a code that is a non-permission ID is associated with information that indicates the work content in a natural language. Note that regular expressions are used in the information indicating the work contents. For example, in the first record, the information indicating the work content is ““ Server A ”. * Connection”, and therefore, if “connection” follows ““ Server A ””, the information indicating the work content is displayed. That will be true. In the correspondence information of this specific example, since the code is a non-permission ID, when the work content corresponds to information indicating any work content included in the correspondence information, the work content is displayed in the black list. That will be true.

  First, it is assumed that an applicant who performs a work application operates the applicant terminal 2 and starts a program for applying an operation work. Then, it is assumed that a screen for inputting an operation work title, work start date / time, work end date / time, and the like is displayed on the applicant terminal 2, and the applicant inputs each piece of information using a keyboard or a mouse. FIG. 9 is a diagram showing a screen on which the input is performed. In FIG. 9, the application for installing the application B has been applied, and the title, the work start date / time, the work end date / time, the work content, the worker, and the password are input. As the work content, one work content is input for each number indicating the order, such as “1.” and “2.”. Specifically, "1." Log on "to" Server A "machine with" Work account "" is one work content. Further, the applicant and the worker may be the same or different. The password is a password that is used when an operation operation that has been applied and approved is executed. When the applicant clicks the “OK” button, work application information having each information input in FIG. 9 is configured and transmitted from the applicant terminal 2 to the information processing apparatus 1.

  The work application information transmitted from the applicant terminal 2 is received by the work application information receiving unit 11 of the information processing apparatus 1 (step S101) and passed to the work application information accumulating unit 12. The work application information storage unit 12 stores the received work application information in a recording medium (not shown) (step S102). FIG. 10 is a diagram illustrating work application information accumulated by the work application information accumulation unit 12. In FIG. 10, only one work application information is shown, but other work application information may also be accumulated. Further, when the work application information is stored, the work application information storage unit 12 assigns and stores an application ID as information for specifying the work application information (in FIG. 10, in the application ID, Is not shown). Assume that the application ID corresponding to the work application information shown in FIG. 10 is “E1005”. Therefore, the work application information shown in FIG. 10 and the application ID “E1005” are associated and stored.

  Since new work application information has been accumulated, the application determination unit 13 reads out the work application information and the corresponding application ID “E1005” and makes a determination regarding the work application information (step S103). Specifically, the application determination unit 13 shows the first work content “1.“ Log on ”to“ Server A ”with“ work account ”” shown in FIG. It is determined whether or not the correspondence information matches information indicating the work content (steps S201 and S202). In this case, since it matches the information indicating the work content of the first record, information indicating that the work content is not permitted is added to the work content (step S203). As described above, in this specific example, the work content that matches the information indicating the work content of the correspondence information corresponds to the work disapproval information. In this specific example, it is assumed that the information indicating the non-permission is a frame. Accordingly, the application determination unit 13 performs a process of enclosing the first work content “1.“ Log on ”to“ Server A ”with“ Work account ”” in a frame. Thereafter, similarly to the second and subsequent work contents, the application determination unit 13 repeatedly determines whether or not it matches the information indicating the work contents of the correspondence information up to the last work contents (steps S202 to S205). ).

  Thereafter, the application determination result output unit 14 transmits the work application information framed to indicate the determination result, the corresponding application ID “E1005”, and the approval request information, with the approver terminal 3 as the destination ( Step S104). It is assumed that the address corresponding to the approver terminal 3 is held in the information processing apparatus 1 in advance.

  The work application information transmitted from the information processing apparatus 1 is received by the approver terminal 3 and displayed on the display of the approver terminal 3 as shown in FIG. In the display of FIG. 11, it is assumed that “approval” and “reject” buttons are approval request information. In addition, the approver can know that the work contents that are enclosed in the box are on the blacklist, and can consider whether or not to approve more carefully at the time of approval. .

  In this specific example, it is assumed that the work application information shown in FIG. 11 is approved. Then, the approver operates the mouse and clicks the “Approve” button. Then, the approver terminal 3 configures approval information including the received application ID “E1005” and approval of work application information, and transmits the approval information to the information processing apparatus 1.

  The transmitted approval information is received by the approval information receiving unit 15 of the information processing apparatus 1 (step S105) and passed to the work permission information accumulating unit 16. The work permission information storage unit 16 determines that the approval information includes the approval (step S106), and reads the application ID “E1005” from the approval information. Then, the work application information corresponding to the application ID “E1005” stored in the work application information storage unit 12 is read out, and the work permission information and the application ID as the work application information are stored in the white list storage unit 17. (Step S107). That is, the information of FIG. 10 is accumulated in the white list storage unit 17. Further, the work permission processing unit (not shown) generates a work account “123456” and transmits the work account and the password “123ABC” in FIG. 10 to the server 4 on which the operation work is performed. Therefore, the server 4 is set so that the process can be executed when logging in using the work account and the password. Further, the work account is notified to the worker “Taro Tanaka” by e-mail or the like. Also, work account correspondence information is generated for associating the application ID “E1005” with the work account “123456” used in the work corresponding to the work application information identified by the application ID, and the work account correspondence information is generated. Are stored in a recording medium (not shown). In this specific example, the case where the work account correspondence information is generated has been described. However, as long as the work account can be associated with the work permission information, any method may be used. For example, the work account may be associated with the work permission information corresponding to the work account and accumulated in the whitelist storage unit 17.

  Assume that the worker “Taro Tanaka” logged in to the server 4 at 22:00 on March 10, 2009 using the work account “123456” and the password “123ABC” as shown in FIG. . Then, it is assumed that the work contents applied with the work application information are sequentially executed. Then, the work contents are sequentially recorded in the server 4 as shown in FIG. In the work record information of FIG. 12, the work account “123456” is included in the first line. When the series of work by the worker “Taro Tanaka” is finished, the information processing apparatus 1 is notified that the work using the work account “123456” is finished. Then, the work record information receiving unit 19 of the information processing apparatus 1 transmits a work account transmission request corresponding to the work account “123456” to the server 4. As a result, the work record information receiving unit 19 receives the work record information shown in FIG. 13 (step S108) and passes it to the work record information storage unit 20. The work record information storage unit 20 stores the received work record information in a recording medium (not shown) (step S109).

  Since the new work record information is accumulated, the output unit 21 reads the work record information, refers to the work account correspondence information, and applies to the work ID “123456” included in the work record information. “E1005” is acquired, and the work permission information corresponding to the application ID is read from the white list storage unit 17. Then, the read work record information and work permission information are transferred to the determination unit 23 (step S110).

  When receiving the work record information shown in FIG. 13 and the work permission information shown in FIG. 10 from the output unit 21, the determination unit 23 makes a determination using the information and the black list (step S111). . Specifically, the determination unit 23 reads the first operation work of the work record information, that is, the operation work on the first line, and the work content matches any work disapproval information shown in FIG. It is determined whether or not to perform (steps S301 and S302). In this case, the work disapproval information of the first record in the black list in FIG. 7 matches the first operation work in the work record information shown in FIG. The non-permission ID “B001” is read from the second record, and the non-permission ID “B001” is assigned to the first operation work of the work record information. Specifically, the determination unit 23 configures information that associates the date and time included in the work record information, the work content, and information indicating permission / non-permission, and holds the information on a recording medium (not shown). Then, “non-permission ID: B001” is input as the permission / non-permission information (steps S303 and S304). The first record in FIG. 14 is configured as described above. Thereafter, the determination unit 23 sequentially determines whether or not the second and subsequent operation operations in the operation record information match the operation disapproval information in the black list, and accumulates the determination results (step S302). To S306). As a result, the information shown in FIG. 14 is configured. In FIG. 14, when the work content does not match the work non-permission information, the information column indicating permission / non-permission is assumed to be blank.

  Thereafter, the determination unit 23 determines whether each date / time included in the work record information is included between the work start date / time and the work end date / time included in the work permission information (step S307). If there is anything that is not included, the information in FIG. 14 is used as a determination result. If all are included, it is determined whether or not the information is included in the white list. In this specific example, it is assumed that all the dates included in the work record information are included between the work start date and the work end date in the work permission information. Then, the determination unit 23 reads the first work content “1.“ Log on ”with“ work account ”to“ Server A ”machine” in the work permission information ”, and information indicating the work content that matches the first work content. It is determined whether it is included in the correspondence information of FIG. 8 (steps S308 and S309). In this case, since the information indicating the work content of the first record of the correspondence information matches the first work content of the work permission information, the determination unit 23 reads the code “ B001 "is read (step S310). Then, the determination unit 23 searches the table shown in FIG. 14 using the code as a search key (step S311). In this case, since the first record is hit, the determination unit 23 overwrites “non-permission ID: B001” of the first record with “permission” (step S312). In addition, the determination unit 23 stores the record number “1” in which the information indicating permission / non-permission is rewritten in a recording medium (not illustrated) (step S313). Thereafter, the determination unit 23 sequentially performs the same processing for the second and subsequent work contents of the work permission information (steps S309 to S315). As a result, the table of FIG. 14 is assumed to be as shown in FIG. In FIG. 15, when work contents not included in the work permission information are included in the work record information, it is assumed that a non-permission ID or the like remains in the information indicating permission / non-permission.

  Thereafter, the determination unit 23 sequentially determines whether the stored record numbers are in ascending order (step S316). In this case, it is assumed that the order is ascending. Then, the determination unit 23 determines that the order of the work contents in the work record information is also consistent with the work permission information, and in response to “permission” in the information indicating permission / non-permission in FIG. "Is added (step S317). As a result, the table shown in FIG. 16 is obtained.

  The determination result output unit 24 outputs the determination result shown in FIG. 16 (step S112). Then, by looking at the output determination result of FIG. 16, it is possible to know whether or not the series of work contents has been previously applied for and approved. For example, in each record of FIG. 16, by confirming whether the information indicating permission / non-permission is “permitted”, it is possible to easily know that what has been previously applied and approved has been executed. It becomes like this. Further, whether or not “order OK” is added to the “permitted” can easily know whether or not it matches the approved one including the order. In addition, if there is a record in which the information indicating permission / non-permission is “non-permitted”, the work content has not been applied for and approved in advance, and further, an illegal process corresponding to the black list. You can easily know that. Further, when the information indicating permission / non-permission is blank, it is possible to easily know that the processing does not correspond to the black list.

  As described in this specific example, when the process shown in the flowchart of FIG. 5 is executed, the work permission information is obtained because “permission” is given to each work content of the work record information. However, it is not known whether all the work contents included in the work permission information have been executed. Therefore, the determination unit 23 has a number indicating the order of work contents in the corresponding work permission information (for example, “1. "2." etc.) may be given. Then, after all the giving processes are completed, the determination unit 23 may determine whether all the work contents included in the work permission information have been executed. Specifically, the determination unit 23 acquires the minimum value and the maximum value of the numbers indicating the order of the work contents in the work permission information, and each number from the minimum value to the maximum value is the work record information work. Judge whether it is given to the content. If all numbers have been assigned, all the processes have been executed. If there is a number that has not been assigned, it can be determined that all the processes have not been executed. By determining whether the numbers are arranged in ascending order at the time of the determination, the determination unit 23 can also determine whether the work content has been executed in the order indicated by the work permission information. That is, when the items are arranged in ascending order, the work contents are executed in the order indicated by the work permission information. When the items are not arranged in ascending order, the work contents are executed in the order indicated by the work permission information. Will not be.

  In this specific example, when the work account or the like is transmitted to the server 4, the work start date and time and the work end date and time may be transmitted together. In that case, the server 4 may be able to execute the operation work only when logging in with the work account and password transmitted in advance between the work permission information and the work end date and time. However, the operation work can be executed only from the work permission information to the work end date and time. In this case, since each operation work included in the work record information is surely executed between the work start date and time and the work end date and time of the work permission information, step S307 in the flowchart of FIG. It is also possible to proceed from step S306 NO to step S308 without making this determination.

  In this specific example, the case where the code is a non-permission ID has been described. However, the code may be information indicating the work content, for example, “TYPE = IPPort,...”.

  Moreover, although this example demonstrated the case where the operation work requested | required by work application information was performed with the server 4, it may not be so. Needless to say, it may be executed in another device, server, system, or the like.

  As described above, according to the information processing apparatus 1 according to the present embodiment, when an operation work is executed based on the approved work application information, an unauthorized process (a process included in the blacklist) that is not approved. ) Can be easily known. Further, it is possible to easily know whether each operation work included in the work record information corresponds to each work content included in the approved work application information. In particular, by making a determination using both a white list and a black list, a fail safe determination can be made. For example, it is assumed that although the operation work for the server A is originally performed, the work application information describes that the operation work for the “server B” is erroneously performed, and the approval is obtained. In this case, if the operation on the server A corresponds to the black list, when the operator performs an operation operation on the server A, it is output that the operation corresponds to the black list. You can raise alerts about work and investigate them. In this way, if a blacklist is set in advance and an operation operation that may have a serious impact on the system or data due to some mistake or the like is executed without approval, this is indicated. Can be detected. In addition, since the operation work that is not included in the blacklist is not detected, even if an operation work that does not have a significant impact on the system or data is executed without approval It will not be detected, and only important items can be detected.

  In the present embodiment, among work application information accumulated by the work application information accumulation unit 12, work permission information that is operation work information indicated by the approved work application information is accumulated in the white list storage unit 17. However, as described in the specific example of the present embodiment, when the work application information and the work permission information are the same information, the accumulation of the work application information and the accumulation of the work permission information are performed. It may be performed by one accumulation. For example, the work permission information storage unit 16 stores the work application information received by the work application information reception unit 11. Then, the work permission information storage unit 16 may add information such as a flag indicating that the work application information is approved among the work application information stored by the work permission information storage unit 16. As a result, of the work application information stored by the work permission information storage unit 16, information to which information such as a flag indicating approval is given is work permission information. The area where the work permission information is stored is the white list storage unit 17. In this case, the information processing apparatus 1 may not include the work application information accumulation unit 12.

  Further, in the specific example of the present embodiment, the case where two or more operation tasks are included in the work application information and the work record information has been described. Only one operation work may be included in one work application information, and only one operation work may be included in one work record information.

  Moreover, although this Embodiment demonstrated the case where the information which shows work content was converted using correspondence information, it may not be so. Whether the information matches, using the information indicating the work content included in the work application information, the information indicating the work content included in the work record information, and the information indicating the work content included in the work non-permission information. If it can be determined, the correspondence information may not be used. In that case, the information processing apparatus 1 may not include the correspondence information storage unit 22.

  Moreover, although the case where the application determination result output unit 14 outputs the work application information, the approval request information, and the determination result by the application determination unit 13 has been described in the present embodiment, this need not be the case. For example, the application determination result output unit 14 may output a determination result by the application determination unit 13. The timing at which the application determination result output unit 14 outputs the determination result does not matter. For example, the application determination result output unit 14 may output the determination result by the application determination unit 13 for the work application information before receiving the approval information corresponding to the work application information, or output at other timings. May be.

  Moreover, although the case where the application determination result output unit 14 outputs the determination result by the application determination unit 13 has been described in the present embodiment, this need not be the case. That is, the determination result output by the application determination result output unit 14 may not be performed. In that case, the information processing apparatus 1 may not include the application determination unit 13 and the application determination result output unit 14.

  Further, in the present embodiment, the case where the determination unit 23 performs the determination using the work non-permission information stored in the black list storage unit 18 has been described, but this need not be the case. The determination unit 23 may not make a determination using the work non-permission information stored in the black list storage unit 18. In that case, the information processing apparatus 1 may not include the black list storage unit 18.

  Further, in the present embodiment, the case has been described in which the determination by the determination unit 23 is performed and the determination result is output, but this need not be the case. The information processing apparatus 1 performs processing up to the output of the work record information and the work permission information by the output unit 21, and the subsequent determination processing may be performed by another device. In this case, the information processing apparatus 1 includes a work application information reception unit 11, an approval information reception unit 15, a work permission information storage unit 16, a white list storage unit 17, a work record information reception unit 19, and a work The recording information storage unit 20 and the output unit 21 may be provided.

  In the present embodiment, the case where the work application information is detailed information including the worker and the time has been described. However, the work application information may be comprehensive. For example, it may include only the work content without limiting the worker and the time. In such a case, the work application information is approved and accumulated as work permission information, so that a white list that does not specify the worker or time is set.

  In the above embodiment, each process or each function may be realized by centralized processing by a single device or a single system, or may be distributedly processed by a plurality of devices or a plurality of systems. It may be realized by doing.

  In the above embodiment, information related to processing executed by each component, for example, information received, acquired, selected, generated, transmitted, or received by each component In addition, information such as threshold values, mathematical formulas, addresses, etc. used by each component in processing is retained temporarily or over a long period of time on a recording medium (not shown) even when not explicitly stated in the above description. It may be. Further, the storage of information in the recording medium (not shown) may be performed by each component or a storage unit (not shown). Further, reading of information from the recording medium (not shown) may be performed by each component or a reading unit (not shown).

  In the above embodiment, when information used by each component, for example, information such as a threshold value, an address, and various setting values used by each component may be changed by the user Even if it is not specified in the above description, the user may be able to change the information as appropriate, or it may not be. If the information can be changed by the user, the change is realized by, for example, a not-shown receiving unit that receives a change instruction from the user and a changing unit (not shown) that changes the information in accordance with the change instruction. May be. The change instruction received by the receiving unit (not shown) may be received from an input device, information received via a communication line, or information read from a predetermined recording medium, for example. .

  In the above embodiment, when two or more constituent elements included in the information processing apparatus 1 have communication devices, input devices, or the like, two or more constituent elements may physically have a single device. Or you may have separate devices.

  In the above embodiment, each component may be configured by dedicated hardware, or a component that can be realized by software may be realized by executing a program. For example, each component can be realized by a program execution unit such as a CPU reading and executing a software program recorded on a recording medium such as a hard disk or a semiconductor memory. In addition, the software which implement | achieves the information processing apparatus 1 in the said embodiment is the following programs. That is, this program is information indicating an operation work for the information processing system, and a work application information receiving unit that receives work application information that is information of an application for the operation work, and an application indicated by the work application information is An approval information receiving unit that receives approval information that is information indicating whether approval has been received, work application information received by the work application information receiving unit, and approval information indicating that the approval information receiving unit has been approved Depending on the work permission information, the work permission information accumulating unit that accumulates the work permission information that is the operation work information indicated by the work application information in the whitelist storage unit that stores the work permission information that is the permitted operation work. A work record information receiving unit for receiving work record information indicating a record of operation work performed on the information processing system; A work record information storage unit that stores work record information received by the reception unit, an output unit that outputs work permission information stored in the white list storage unit, and work record information stored in the work record information storage unit It is a program to make it function as.

  In the program, the functions realized by the program do not include functions that can be realized only by hardware. For example, functions that can be realized only by hardware such as a modem and an interface card in a reception unit that receives information and an output unit that outputs information are not included in at least the functions realized by the program.

  Further, this program may be executed by being downloaded from a server or the like, and a program recorded on a predetermined recording medium (for example, an optical disk such as a CD-ROM, a magnetic disk, a semiconductor memory, or the like) is read out. May be executed by Further, this program may be used as a program constituting a program product.

  Further, the computer that executes this program may be singular or plural. That is, centralized processing may be performed, or distributed processing may be performed.

  FIG. 17 is a schematic diagram illustrating an example of an external appearance of a computer that executes the program and realizes the information processing apparatus 1 according to the embodiment. The above-described embodiment can be realized by computer hardware and a computer program executed on the computer hardware.

  In FIG. 17, a computer system 900 includes a computer 901 including a CD-ROM (Compact Disk Read Only Memory) drive 905, an FD (Floppy (registered trademark) Disk) drive 906, a keyboard 902, a mouse 903, a monitor 904, and the like. Is provided.

  FIG. 18 is a diagram showing an internal configuration of the computer system 900. In FIG. 18, in addition to the CD-ROM drive 905 and the FD drive 906, a computer 901 is connected to an MPU (Micro Processing Unit) 911, a ROM 912 for storing a program such as a bootup program, and the MPU 911. A RAM (Random Access Memory) 913 that temporarily stores program instructions and provides a temporary storage space, a hard disk 914 that stores application programs, system programs, and data, and an MPU 911 and a ROM 912 are interconnected. And a bus 915. The computer 901 may include a network card (not shown) that provides connection to the LAN.

  A program that causes the computer system 900 to execute the functions of the information processing apparatus 1 according to the above embodiment is stored in the CD-ROM 921 or the FD 922, inserted into the CD-ROM drive 905 or the FD drive 906, and stored in the hard disk 914. May be forwarded. Instead, the program may be transmitted to the computer 901 via a network (not shown) and stored in the hard disk 914. The program is loaded into the RAM 913 when executed. The program may be loaded directly from the CD-ROM 921, the FD 922, or the network.

  The program does not necessarily include an operating system (OS) or a third-party program that causes the computer 901 to execute the functions of the information processing apparatus 1 according to the above-described embodiment. The program may include only a part of an instruction that calls an appropriate function (module) in a controlled manner and obtains a desired result. How the computer system 900 operates is well known and will not be described in detail.

  Further, the present invention is not limited to the above-described embodiment, and various modifications are possible, and it goes without saying that these are also included in the scope of the present invention.

  As described above, according to the information processing apparatus and the like according to the present invention, for example, it is possible to support the process of comparing the application request information that has been applied and approved with the operation record information that is the record information of the operation operation. An effect is obtained and it is useful as an information processing apparatus or the like for performing such processing.

DESCRIPTION OF SYMBOLS 1 Information processing apparatus 2 Applicant terminal 3 Approver terminal 4 Server 11 Work application information reception part 12 Work application information storage part 13 Application judgment part 14 Application judgment result output part 15 Approval information reception part 16 Work permission information storage part 17 White list Storage unit 18 Blacklist storage unit 19 Work record information receiving unit 20 Work record information storage unit 21 Output unit 22 Corresponding information storage unit 23 Judgment unit 24 Judgment result output unit

Claims (10)

Information indicating an operation work for the information processing system, a work application information receiving unit that receives work application information that is information of an application for the operation work,
An approval information receiving unit that receives approval information that is information indicating whether or not the application indicated by the work application information has been approved;
A whitelist storage unit that stores work permission information that is permitted operation work;
The work application information received by the work application information receiving unit, the work permission information being the operation work information indicated by the work application information receiving the approval information indicating that the approval information receiving unit has been approved, A work permission information storage unit to be stored in the white list storage unit;
A work record information receiving unit for receiving work record information indicating a record of operation work performed on the information processing system according to the work application information;
A work record information storage unit that stores the work record information received by the work record information reception unit;
An output unit that outputs the work permission information stored in the white list storage unit and the work record information stored in the work record information storage unit;
Using the work permission information and work record information output by the output unit, white list determination is a determination of whether or not the operation work indicated by the work record information matches the operation work indicated by any work permission information A determination unit for performing
A determination result output unit for outputting a determination result of the white list determination by the determination unit;
A blacklist storage unit that stores work disapproval information that is an operation work that is not permitted ,
The determination unit determines whether the operation work indicated by the work record information does not match the operation work indicated by any work permission information, but matches the operation work indicated by any work permission information. Make a blacklist decision,
The information processing apparatus , wherein the determination result output unit also outputs a determination result of blacklist determination by the determination unit. The work record information storage unit stores the work record information in association with work permission information,
The information processing apparatus according to claim 1, wherein the output unit outputs work permission information and work record information corresponding to the work permission information. An application determination unit that determines whether the operation work indicated by the work application information received by the work application information reception unit matches the operation work indicated by any work non-permission information;
The information processing apparatus according to claim 1 , further comprising: an application determination result output unit that outputs a determination result by the application determination unit. The information processing apparatus according to claim 3 , wherein the application determination result output unit outputs the determination result for certain work application information before accepting approval information corresponding to the work application information. The application determination result output unit associates the work application information received by the work application information receiving unit, approval request information that is information for requesting approval for the work application information, and a determination result by the application determination unit. The information processing apparatus according to claim 3 , wherein the information processing apparatus outputs the information. The working application information includes at least information indicating a work content of the operation work, the information processing apparatus according to any one of claims 1 to 5. Information indicating the work content included in the work application information is text information described in a natural language,
A correspondence information storage unit that stores correspondence information that is information that associates information indicating work content that is text information described in natural language with information indicating work content that is described in code;
The determination unit performs determination using work permission information converted from information indicating work content described in a natural language into information indicating work content described in a code using the correspondence information. Item 7. The information processing apparatus according to Item 6 . The work permission information is information indicating two or more operation works including a work order,
The determination unit, the operation work indicated by the operation record information, if it matches with any of the work permit two or more operators working indicated by the information, determines including whether work order also matches claim 1 The information processing apparatus according to claim 7 . Work application information receiving unit, approval information receiving unit, white list storage unit storing work permission information that is permitted operation work, work permission information accumulating unit, work record information receiving unit, work record information An information processing method processed using an accumulation unit, an output unit, a determination unit, a determination result output unit, and a blacklist storage unit in which work disapproval information that is an operation operation that is not permitted is stored ,
The work application information receiving unit is information indicating an operation work for the information processing system, and a work application information receiving step for receiving work application information which is information of an application for the operation work;
An approval information receiving step for receiving approval information, which is information indicating whether the application indicated by the work application information is approved by the approval information receiving unit;
Information on the operation work indicated by the work application information that has been accepted by the work permission information storage unit in the work application information acceptance step and is approved information indicating that it has been approved in the approval information acceptance step. A work permission information accumulating step for accumulating the work permission information in the white list storage unit,
A work record information receiving step for receiving work record information indicating a record of an operation work performed on the information processing system in accordance with the work application information;
The work record information storage unit stores the work record information received in the work record information reception step;
The output unit outputs the work permission information stored in the white list storage unit and the work record information accumulated in the work record information accumulation step;
Using the work permission information and work record information output by the determination unit in the output step, determining whether the operation work indicated by the work record information matches the operation work indicated by any work permission information A first determination step for determining a whitelist,
A first determination result output step in which the determination result output unit outputs a determination result of whitelist determination in the first determination step;
The determination unit determines whether the operation work indicated by the work record information does not match the operation work indicated by any work permission information, but matches the operation work indicated by any work permission information. A second decision step for making a blacklist decision;
An information processing method comprising: a second determination result output step in which the determination result output unit outputs a determination result of blacklist determination in the second determination step . Computer
Information indicating an operation work for the information processing system, a work application information receiving unit that receives work application information that is information of an application for the operation work,
An approval information receiving unit that receives approval information that is information indicating whether or not the application indicated by the work application information has been approved;
Permit work permission information which is work application information received by the work application information receiving unit and which is operation work information indicated by the work application information which has received approval information indicating that the approval information receiving unit has been approved. A work permission information accumulating unit that accumulates in a white list storage unit in which work permission information that is an operation operation to be performed is stored,
A work record information receiving unit for receiving work record information indicating a record of operation work performed on the information processing system in accordance with the work application information;
A work record information storage unit for storing the work record information received by the work record information reception unit;
An output unit that outputs the work permission information stored in the white list storage unit and the work record information stored in the work record information storage unit;
Using the work permission information and work record information output by the output unit, white list determination is a determination of whether or not the operation work indicated by the work record information matches the operation work indicated by any work permission information The decision part,
Function as a determination result output unit that outputs a determination result of the white list determination by the determination unit ;
The determination unit stores the operation work indicated by the work record information in a blacklist storage unit that stores work disapproval information that is an operation operation that is not permitted although the operation work indicated by any work permission information does not match. A blacklist determination is also performed, which is a determination as to whether or not the operation work indicated by any of the work disapproval information is present,
The determination result output unit also outputs a determination result of blacklist determination by the determination unit .

Images