JP5697626B2 - Access authority management system - Google Patents

Description

  The present invention relates to a technique for managing access authority to data, and more particularly to a technique that is effective when applied to an access authority management system capable of dynamically changing access authority.

  In general, for data that can be accessed by multiple users, access authority is set, and data is given to allow appropriate users to access only in an appropriate manner (for example, read, modify, execute, etc.) Access to is controlled. In particular, for example, in CRM (Customer Relationship Management) systems in companies, a large amount of data related to business information related to multiple customers is stored and managed centrally, so that multiple departments and employees can meet their business needs. Therefore, the access authority for each data is set so that each employee can use the data within the permitted range (customer, data type, etc.) only in the permitted mode. It is important to manage.

  Conventionally, for such data access authority, the access authority is normally set for each piece of data. In this case, the number of access authority settings required is simply data (or data type). ) And the number of users (or user groups, etc.), resulting in a very large number, which makes management complicated. In particular, reviewing or changing access authority in accordance with a change of user or a change in business role becomes a very heavy load on an administrator or the like when the number of target users increases.

  In response to such a problem, a technique for automatically setting or changing access authority has been proposed. For example, Japanese Patent Laying-Open No. 2006-92170 (Patent Document 1) discloses a hierarchical position detection device that detects a user's position and a resource accessed by the user, a user's position detected by the hierarchical position detection device, and A location detection / file access DB server that accumulates information about resources to be accessed, and the authority to resources set according to the user's location, and according to the location of the user who accessed the resource and the location of the user By having a server for user location-dependent file authority authentication that authenticates the user's action on the resource based on the authority to the set resource, security is improved and leakage of files and data is prevented. A resource access management system that can be described is described.

  In addition, JP 2009-21627A (Patent Document 2) associates an attribute information storage unit that stores time and attribute information of the user at the time with the content for performing access control for accessing the content. The access right of the user who can access the content is dynamically set based on the result of comparing the attribute information of the content and the attribute information of the content at the specified time and the time stored in the attribute information storage means with the attribute information of the user. Content that can dynamically set and change access restrictions on user content without burdening the user according to time and the user's situation at that time by providing access right control means to change An access control system is described.

  Japanese Unexamined Patent Application Publication No. 2009-294817 (Patent Document 3) describes a recording medium that is different from a storage device in which a file to which access authority is granted is recorded, and a counterpart apparatus (receiving apparatus) is provided. Recording means for recording a file on an available other recording medium (file server, removable medium, etc.), and when the file is recorded on the separate recording medium by the recording means, it is given to the file recorded on the separate recording medium. An access authority resetting means for changing the access authority according to the recording destination of the file, and a receiving device for controlling access to the file recorded on the separate recording medium according to the changed access authority, The access authority granted to the file depends on the file recording destination, such as the file transmission destination, upload destination, and copy destination. Described access authority management device to automatically change.

JP 2006-92170 A JP 2009-211627 A JP 2009-294817 A

  By using techniques such as those described in Patent Documents 1 to 3 above, for example, it is possible to set / change access authority to some extent automatically according to the user's location, time, data recording destination, etc. Become.

  On the other hand, in recent years, high-performance portable terminals such as so-called smartphones and tablet terminals have become widespread, and the number of scenes used in business is increasing. Users such as corporate employees should always carry these terminals not only within the company, but also when they are on the move or on the go, and access data such as internal business information from a remote location using the communication function. Is possible. That is, there are various places where the user accesses the data, and along with this, the surrounding environment (people and objects existing in the vicinity) also varies. Accordingly, the position where the device itself exists, the surrounding environment and situation, and the meaning content thereof (hereinafter, these may be collectively referred to as “peripheral context”) are variously different.

  Therefore, by acquiring information corresponding to the surrounding context at the location where it exists, and dynamically changing the access authority accordingly, it is possible to dynamically set and change the access authority more flexibly and finely It is considered to be. As portable terminals that have become popular in recent years usually have a short-range wireless communication function and can communicate wirelessly with information processing apparatuses including peripheral portable terminals, as one of peripheral context information In addition, it is possible to easily grasp information on devices existing in the vicinity. In addition, it is easy to grasp the position information of the portable terminal by using these communication functions and the GPS (Global Positioning System) function.

  On the other hand, in the prior art as described in the above-mentioned patent documents 1 to 3, access authority can be dynamically set according to the user's own context such as the user's position and time. The use of context is not considered.

  Therefore, the object of the present invention is to dynamically assign the right of access to each data to the user according to the content of the surrounding context corresponding to information such as the location where the user exists, the surrounding environment and situation, and the meaning content. An object is to provide an access authority management system that can be set and changed. The above and other objects and novel features of the present invention will be apparent from the description of this specification and the accompanying drawings.

  Of the inventions disclosed in this application, the outline of typical ones will be briefly described as follows.

  An access authority management system according to a representative embodiment of the present invention includes an access authority management system comprising a data management server for storing data, and one or more client terminals connectable to the data management server via a network. When the data management server receives an access request for the data from the first user via the client terminal, the data management server acquires peripheral context information about the location of the client terminal. And an access authority determining unit that determines an access authority to the data based on the access request.

  Among the inventions disclosed in the present application, effects obtained by typical ones will be briefly described as follows.

  That is, according to the representative embodiment of the present invention, each data for the user is determined according to the content of the surrounding context corresponding to the position where the user exists, the surrounding environment and situation, the meaning content, and the like. It is possible to dynamically set / change the access authority to the access point, thereby making it possible to set the access authority more flexibly and to reduce the management load of the access authority.

It is the figure which showed the outline | summary about the structural example of the access authority management system which is one embodiment of this invention. It is the figure which showed the outline | summary about the example of determination of the access authority which does not consider the surrounding context in one embodiment of this invention. It is the figure which showed the outline | summary about the example of determination of the access authority which considered the surrounding context in one embodiment of this invention. It is the figure which showed the outline | summary about the other example of determination of the access authority which considered the surrounding context in one embodiment of this invention. It is the figure which showed the outline | summary about the other example of determination of the access authority which does not consider the surrounding context in one embodiment of this invention. It is the figure which showed the outline | summary about the other example of determination of the access authority which considered the surrounding context in one embodiment of this invention. It is the figure which showed the outline | summary about the other example of determination of the access authority which considered the surrounding context in one embodiment of this invention.

  Hereinafter, embodiments of the present invention will be described in detail with reference to the drawings. Note that components having the same function are denoted by the same reference symbols throughout the drawings for describing the embodiment, and the repetitive description thereof will be omitted.

  An access authority management system according to an embodiment of the present invention is such that a user such as an employee uses a client terminal for data such as business information stored on a server in an in-house CRM system of a company. When accessed, the location acquired by the client terminal, information on the surrounding environment and situation, etc., and the meaning (for example, “There are general managers nearby”, “Working together”, “Customers” Information on the surrounding context corresponding to information such as “Visit to the location of” or “Business trip to XX”), and dynamically set the access authority to each user according to this content. It is a system that changes.

<System configuration>
FIG. 1 is a diagram showing an outline of a configuration example of an access authority management system according to an embodiment of the present invention. The access authority management system 1 is connected to the data management server 10 that is a server system that stores data such as business information in an in-house system such as a CRM system, and the data management server 10 via a network 40 such as the Internet or an intranet. It is configured to have one or more client terminals 20 that can be used. In the present embodiment, a system for setting and managing access authority for data such as business information in an in-house system such as a CRM system will be described. However, the present invention is not limited to this. The present invention can be applied to any system that sets and manages access authority for this.

  The data management server 10 includes various units such as a data access processing unit 11 and an access authority determination unit 12 that are implemented by middleware such as an OS (Operating System) or software such as an application program. Further, a user who is a database that holds information on business information 13 stored as a database, a file, etc., and users who can access each data in the business information 13 (employees of companies that own the data management server 10). It has information 14. Further, it has an access right setting rule 15 that is implemented as a file, a database, or the like, and that defines and sets a rule for dynamically setting / changing the access right for data in the business information 13.

  In response to a request for access (reading, writing, execution, etc.) to the business information 13 from the user via the client terminal 20, the data access processing unit 11 performs business information for the user by using the access authority determination unit 12 described later. The access authority to each data in 13 is determined and dynamically set / changed. When the access is permitted, the target data is transmitted to the client terminal 20, while when the access is not permitted, the client is notified to that effect. Responds to the terminal 20. In order to be able to accept access requests from various client terminals 20, for example, it may be implemented as a service that runs on a web server program (not shown).

  The access authority determination unit 12 receives the location information of the client terminal 20 attached to the access request in response to the access request to the business information 13 received from the user via the data access processing unit 11 and the peripherals described later. Based on the device information and information on the user's attribute and action schedule held in the user information 14, information on the peripheral context for the user (location of the client terminal 20) is obtained, and access right setting is performed on the information. The rule 15 is applied to determine the access authority, and set or changed.

  The user information 14 includes, for example, information that can determine the access authority based on the information regardless of the peripheral context information, such as information on departments and groups for each user, job title and role, and information on the customer in charge. . Further, identification information of a peripheral device 30 described later held by each user (employee) is also held. Further, in addition to these, for example, information on an action schedule related to the location of the user, such as a schedule of going out for each user and contents of a business trip application, is held. Thereby, the meaning content about a user's location can be determined as peripheral context information.

  The format of the access right setting rule 15 is not particularly limited. For example, for each data (or data type) in the business information 13 or for each user (or group or the like) registered in the user information 14, A rule or the like is set in advance by a manager or the like for setting the access authority. As a rule, for example, in addition to the default access authority, a condition for changing the access authority from the default value is defined. As conditions, for example, the default access authority is determined based on the information of the department or group for each user, the position or role, the information of the customer in charge as described above, or the surrounding context as described later. Based on the contents, it is possible to appropriately set the one that dynamically changes the access authority from the default value.

  The client terminal 20 is an information processing terminal such as a PC (Personal Computer), a tablet terminal, a smartphone, or a mobile phone, and is preferably a portable portable terminal. The client terminal 20 includes, for example, a general Web browser 21 as software that provides an interface for making a data access request to the data access processing unit 11 of the data management server 10. In addition, as a device or the like, it includes a position information acquisition unit 22 that acquires information about its own position, and a peripheral device detection unit 23 that acquires information about peripheral devices 30 existing in the vicinity.

  Although the position information acquisition unit 22 is not particularly limited, for example, the position in relation to the reader is grasped by a function of acquiring latitude / longitude information by a GPS sensor or a short-range wireless communication function such as Felica (registered trademark). A function (for example, an entrance system using an employee ID card), a function for obtaining an approximate position in relation to an access point by acquiring information on an SSID (Service Set IDentifier) of an access point that can be detected by a wireless LAN function, The location information as the peripheral context (or one piece of information for obtaining this) is acquired by the function of grasping the approximate location from the IP address information of the client terminal 20 or the like. In order to make it possible to grasp position information in various places and situations, a plurality of these functions / devices may be used or combined according to the situation (for example, underground with poor GPS signal conditions) Etc., use the SSID of the wireless LAN).

  The peripheral device detection unit 23 performs a short-range wireless communication such as Bluetooth (registered trademark) or RFID (Radio Frequency IDentification) with the peripheral device 30 existing in the vicinity, thereby enabling the peripheral (that is, the radio wave). By detecting the presence of the peripheral device 30 in the communication reachable range) and identifying each peripheral device 30 present, peripheral device information (identification information of the peripheral device 30 existing in the vicinity) as a peripheral context To get.

  The peripheral device 30 is, for example, a portable terminal such as a PC, a tablet terminal, or a smartphone owned by each employee belonging to the target company or the like, and the short-range wireless communication with the peripheral device detection unit 23 of the client terminal 20. A communication means capable of performing communication is provided. Therefore, the client terminal 20 can grasp the information of other employees in the vicinity by detecting the presence of the peripheral device 30 by short-range wireless communication. In addition, each employee can avoid the load of having a dedicated device only for grasping the location by using the owned peripheral device 30 as the client terminal 20 for the employee.

  Note that the communication protocol for short-range wireless communication between the client terminal 20 and the peripheral device 30 is not particularly limited. For example, each device (the client terminal 20 and the peripheral device 30) periodically identifies its own device. While transmitting information or the like and notifying the presence, various methods such as waiting for notification from other peripheral devices can be appropriately employed.

  When a user using the client terminal 20 performs an operation via the Web browser 21 in order to access data in the business information 13 on the data management server 10, for example, a client program running on the Web browser 21 is The location information and the peripheral device information of the client terminal 20 are acquired from the location information acquisition unit 22 and the peripheral device detection unit 23, respectively, added to the data access request, and transmitted to the data access processing unit 11 of the data management server 10. .

  In the data access processing unit 11 that has received the access request, according to the target data or user rules set in the access right setting rule 15 by the access right determination unit 12, for example, information on the department or group for each user, Access authority is determined based on job title, role, customer information, etc. Also, based on the identification information of the peripheral device 30 added to the access request, from the user information 14 acquired from the user information 14, information on the user's action schedule registered in the user information 14, etc. Information on the peripheral context that can be grasped is acquired, and the access authority is determined based on the content according to the rules set in the access right setting rule 15 as described later. As a result, when the access is permitted, the target data in the business information 13 is acquired and the client terminal 20 is responded.

<Judgment of access authority>
Below, the example of the content of the access authority determination process in the access authority determination part 12 of the data management server 10 is demonstrated. FIG. 2 is a diagram showing an outline of an example of determining access authority without considering the surrounding context. The access authority is a default access authority that is determined based on, for example, information on the department or group to which each user belongs, job title / role, customer information, and the like. In the example of FIG. 2, a case where access to the target data in the business information 13 is denied in response to an access request from the client terminal 20 is shown. Here, for example, in the access right setting rule 15, the attribute information such as the target user himself / herself, the department to which he belongs, the role, the customer in charge, or the like matches the condition for permitting access to the target data in the business information 13. It is determined that the user does not have access authority because it does not match or the access is denied.

  In the present embodiment, even in the above case, it is possible to strengthen / upgrade (or downgrade) access authority in consideration of the peripheral context of the user. 3 and 4 are diagrams showing an outline of an example of determination of access authority in consideration of the surrounding context. As shown in FIG. 3, there is an employee such as a supervisor (eg, a general manager) who has authorization authority for access to the data around the user (client terminal 20) of the employee or the like who wants to access the data. Is detected by short-range wireless communication with the peripheral device 30 owned by the boss or the like, the security risk is considered to be reduced, and the access authority is upgraded so that the same data can be accessed.

  At this time, considering the case where the boss or the like has just passed around the user (client terminal 20), for example, in the peripheral device detection unit 23 of the client terminal 20, the target peripheral device 30 is the client terminal. Only when it is detected that there has been a continuous presence in the vicinity of 20 for a predetermined time (for example, 5 minutes) or longer, the target peripheral device 30 (other employee such as a boss) exists in the vicinity of the client terminal 20 You may make it judge.

  On the other hand, even when the method shown in FIG. 3 is adopted, for example, when the general manager or the like is absent due to going out or a meeting and does not exist around the user, the access authority can be upgraded. Can not. As described above, even if there is no supervisor having approval authority, such as a general manager, in the present embodiment, as shown in FIG. 4, for example, more than a predetermined position / role such as a section manager or a leader. If there are more than a certain number of employees in the vicinity (three people in the example of FIG. 4), it is possible to upgrade the access authority as in the case where there is a supervisor with approval authority such as a general manager. .

  In this case, as shown in FIG. 3, there is a difference in the content of the access authority because it is different from the case where other employees having the original approval authority such as the general manager exist in the vicinity (for example, reference only) Or the like). In addition, an e-mail or the like indicating that the access authority has been changed is automatically sent to the general manager or the like, or the log data related to the access is retained in the data management server 10 for a longer period than usual. By holding more detailed contents, a trail for auditing or the like may be appropriately held.

  In the present embodiment, the peripheral device 30 is a portable terminal owned by another employee or the like. However, the peripheral device 30 is not limited to this, and a device (for example, a server device or the like) that is fixedly installed in a predetermined place. Printer, network device, etc.). In this case, for example, as an alternative to the case where an employee such as a supervisor having approval authority as shown in FIG. 3 exists in the vicinity, the user exists in the vicinity of a predetermined location (for example, a predetermined area of the office). This is a condition for accessing the target data.

  FIG. 5 is a diagram showing an outline of another example of access authority determination without considering surrounding context. Similar to the example of FIG. 2, the access authority is a default access authority that is determined based on, for example, information on departments and groups belonging to each user, job titles and roles, information on customers in charge, and the like. In the example of FIG. 5, unlike the example of FIG. 2, access to the target data in the business information 13 is permitted. However, as a restriction of access authority, the number of data that can be referred to is limited to 100. It shows that.

  In the present embodiment, even in the above case, it is possible to upgrade (or downgrade) the access authority in consideration of the peripheral context for the user. FIG. 6 is a diagram showing an outline of another example of access authority determination in consideration of the peripheral context. As shown in FIG. 6, there are more than a certain number of other employees (users) having similar positions, roles, authorities, etc. in the vicinity of the user (client terminal 20) who is trying to access data (example in FIG. 6). If there are a total of three people, for example, it is judged that they are gathered for common work such as proposal creation, and the limit on the number of data that can be referred to is relaxed to 1000 (access authority) To strengthen). In this case, as in the example shown in FIG. 3 and FIG. 4, the restriction on the number of data that can be referred to is relaxed when there are more than a certain number of other employees with higher positions, roles, authority, etc. It may be.

  FIG. 7 is a diagram showing an outline of another example of access authority determination in consideration of the peripheral context. Here, based on the action schedule information registered in advance in the user information 14 of the data management server 10 by the user, the meaning content (peripheral context) about the position where the user is and its surroundings is determined, and based on this The access authority can be upgraded (or downgraded).

  In the example of FIG. 7, the user registers an action schedule such as a visit schedule (date and visit customer) to the user information 14 of the data management server 10 via the client terminal 20 in advance. It may be information such as a business trip application. Thereafter, when the user makes an access request for data related to the target customer in the business information 13 so that access from an outside location such as an outside location is not normally permitted, Only when it is determined that the user is in the vicinity of the location, the access authority is upgraded to allow access.

  At this time, in order to determine that the user exists as a business around the location of the target customer, the client terminal 20 acquires the client terminal 20 acquired by the position information acquisition unit 22 in response to a data access request. Is added. The location information and the time information at the time of the process collate with the information of the action schedule (the information of the action place and the time zone) for the user registered in the user information 14, so that the user can find the location of the customer. It can be determined whether or not it exists as a business. In order to enable such a determination, the data management server 10 holds customer location information (for example, address, latitude / longitude, SSIDs of nearby wireless LAN access points, etc.) in a customer information database (not shown) or the like. You may do it.

  In this way, in addition to upgrading the access authority when the user exists in the vicinity of the location of the customer who is scheduled to visit, the number of visits to the customer may be considered. For example, the number of visits to the customer is determined by referring to a database or the like that holds an action history (not shown). For the first visit, only access to data consisting of general information is permitted. In the case of subsequent visits, for example, it may be controlled to allow access to more important data or data whose disclosure is restricted according to the number of visits.

  In addition, for example, access to data related to work in each region such as Tokyo and Hokkaido is controlled only to users belonging to the region, and access from users in other regions is controlled not to be permitted. When a user in Hokkaido comes to an office in the Tokyo region on a business trip, if the business trip application to the Tokyo region has been submitted and registered in advance as the user's action schedule, Control to upgrade access authority to allow access to data in the Tokyo area until a certain period of time (for example, 1 month) has passed since the last entry to the office in the Tokyo area. Is also possible.

  In this way, it is possible to grasp the meaning content at the location of the user, such as the location information and time information of the user (client terminal 20) and information such as the user's action schedule registered in advance in the system. It is possible to acquire peripheral context information and set / change the access authority to data based on this information.

  As described above, according to the access authority management system 1 according to an embodiment of the present invention, a user such as an employee is a client for data such as the business information 13 stored on the data management server 10. When accessed via the terminal 20, information on the peripheral context corresponding to information such as the position acquired by the client terminal 20, information on the surrounding environment and situation, information on its meaning, etc. is acquired. Accordingly, it becomes possible to dynamically set / change the access authority to each data for the user. As a result, the access authority can be set more flexibly, and the access authority management load can be reduced.

  As mentioned above, the invention made by the present inventor has been specifically described based on the embodiment. However, the present invention is not limited to the embodiment, and various modifications can be made without departing from the scope of the invention. Needless to say.

  INDUSTRIAL APPLICABILITY The present invention can be used for an access authority management system that can dynamically change access authority.

1 ... Access authority management system,
DESCRIPTION OF SYMBOLS 10 ... Data management server, 11 ... Data access process part, 12 ... Access authority determination part, 13 ... Business information, 14 ... User information, 15 ... Access right setting rule,
20 ... Client terminal, 21 ... Web browser, 22 ... Location information acquisition unit, 23 ... Peripheral device detection unit,
30 ... peripheral equipment,
40 ... Network.

Claims (7)

An access authority management system comprising a data management server for storing data and one or more client terminals connectable to the data management server via a network,
The client terminal includes a peripheral device detection unit that detects peripheral devices existing in a communicable range by performing short-range wireless communication with each other, and acquires identification information of the detected peripheral devices. When transmitting an access request to the data instructed by the user to the data management server, add peripheral device information consisting of identification information of the peripheral device acquired by the peripheral device detection unit,
The data management server, when receiving the client end late or found before Kia access request, and the peripheral device information added to the access request, the data management server maintains the each user's Based on the information related to the identification information of the peripheral device, the location information of the client terminal and the information of the peripheral context including the information on the role of each user who owns the peripheral device are acquired, and the access is performed based on the information. An access authority management system comprising an access authority determination unit that determines an access authority to the data related to a request. In the access authority management system according to claim 1 ,
Is the access authorization determining unit before Symbol data management server, a pre-Symbol neighborhood context, the communication range of the client terminal, although no authorization rights for access to the data according to the access request, the When it is determined that there are the peripheral devices held by a predetermined number or more of second users having higher roles than the first user, access to the data corresponding to the access request is permitted. Or an access authority management system characterized by enhancing access authority. In the access right management system according to claim 2,
When the access authority determination unit permits access to the data corresponding to the access request or strengthens the access authority, the data management server notifies the data related to the access request to that effect. An access authority management system for notifying a third user who has an authorization authority for access to a network. In the access right management system according to claim 2,
When the access authority determination unit permits access to the data corresponding to the access request or when the access authority is strengthened, the data management server displays a processing history related to the access request at a normal time. An access authority management system characterized in that it is retained for a longer period and / or more detailed contents are recorded than usual. In the access authority management system according to claim 1 ,
The access authority determination unit before Symbol data management server, a pre-Symbol neighborhood context, the communication range of the client terminal, the third user having approval authority for access to the data according to the access request An access authority management system that permits access to the data corresponding to the access request or reinforces access authority when it is determined that the peripheral device possessed is present. In the access authority management system according to claim 1 ,
Is the access authorization determining unit before Symbol data management server, a pre-Symbol neighborhood context, the said communication range of the client terminal, a fourth user more than a predetermined number having the first comparable role and user When it is determined that there is the peripheral device that each holds, an access authority management system that relaxes the restriction on the number of data that can be referred to corresponding to the access request. In the access authority management system according to any one of claims 1 to 6,
The data management server holds information on an action schedule of the first user registered via the client terminal,
The client terminal has a location information acquisition unit that acquires location information that is information about its own location, and the location information acquired by the location information acquisition unit in the access request transmitted to the data management server Add information,
The access authority determination unit of the data management server includes the location information added to the access request received from the client terminal, time information at the time of the process, and the first information held by the data management server. Based on the action schedule information of the user, when it is determined that the first user exists in the location related to the action schedule in the time zone related to the action schedule as the peripheral context, An access authority management system, wherein access to the data corresponding to the action schedule is permitted or access authority is enhanced.

Images