JP6576387B2 - Information processing apparatus, information processing method, information processing program, recording medium, and access control system - Google Patents

Description

  The present invention relates to an information processing apparatus, an information processing method, an information processing program, a recording medium, and an access control system.

  The output of certain software (for example, Web access control software, Patent Document 1) may be used by other software (for example, integrated log management software). When both providers are different, the former output format and the latter acceptance format often do not match. In that case, it is necessary to customize the former output format, which is very troublesome.

JP2015-141609A

  The present invention has been made in view of such problems, and an object of the present invention is to provide an information processing apparatus, an information processing method, an information processing program, a recording medium, and an access control system capable of flexibly setting an output mode. Is to provide.

  According to one aspect of the present invention, an output mode acquisition unit that acquires user-set output mode setting information, an operation history acquisition unit that acquires information related to a user's operation history, and an output according to the output mode setting information An information processing apparatus comprising: an output unit that outputs information related to the operation history in an aspect.

  The information related to the operation history may include a plurality of items, and the operation history acquisition unit may acquire at least a part of the plurality of items according to the output mode setting information.

  In this case, the output unit sets at least one of the output order of the acquired items, the separator between the acquired items, and the output format of the acquired items according to the output mode setting information. Also good.

  The output unit may output information related to the operation history in an output mode for each group composed of one or a plurality of users based on the output mode setting information.

Information about the operation history is as follows:
Information about access history to web pages,
Information about file download history,
History of characters entered in the input form of access destination, or
It may be a mail communication history.

  According to another aspect of the present invention, user-set output mode setting information and user operation history information are acquired, and the operation history is output in an output mode according to the output mode setting information. An information processing method is provided.

  According to another aspect of the present invention, the computer includes an output mode acquisition unit that acquires user-set output mode setting information, an operation history acquisition unit that acquires information related to a user's operation history, and the output mode setting information. And an information processing program that functions as an output unit that outputs information related to the operation history in an output mode according to the above.

  According to another aspect of the present invention, a recording medium on which the information processing program is recorded is provided.

  According to another aspect of the present invention, there is provided an access control system including a terminal device and an access control device, wherein the terminal device accesses a web page via the access control device, and the access control device A URL acquisition unit that acquires a URL from a terminal device, a Web access control unit that controls access to a Web page based on the URL, and an access history that acquires information related to an access history by the terminal device from the Web access control unit An access control system having an acquisition unit, an output mode acquisition unit that acquires user-set output mode setting information, and an output unit that outputs information related to the access history in an output mode according to the output mode setting information Provided.

  The output mode can be set flexibly.

1 is a block diagram showing a schematic configuration of an access control system according to an embodiment. 5 is a flowchart showing an example of processing operation of the access control apparatus 200. FIG. 3 is a block diagram showing a schematic configuration of an access history output unit 6.

  Embodiments according to the present invention will be specifically described below with reference to the drawings. In the following description, “or” also includes the meanings of “and”, and “A or B” means any of A, B, and A and B.

  FIG. 1 is a block diagram illustrating a schematic configuration of an access control system according to an embodiment. The access control system includes a terminal device 100 and an access control device 200 (information processing device). In the following, an example in which such an access control system is built in a company and a plurality of terminal devices 100 are connected to one access control device 200 will be described.

  The terminal device 100 is a personal computer or the like.

  The access control device 200 is a server or the like. Note that the terminal device 100 and the access control device 200 do not necessarily have to be located in the same company, and may be installed at remote locations as long as they can communicate with each other.

  In the present embodiment, the terminal device 100 accesses a Web page via the access control device 200 in response to a user operation. Then, the access control device 200 determines whether or not access to the Web page is possible. If the access control apparatus 200 determines that access is possible, the access control apparatus 200 acquires a Web page and transmits it to the terminal apparatus 100. On the other hand, if the access control device 200 determines that access is not possible, the access control device 200 transmits to the terminal device 100 that access is not possible. Then, the access control device 200 outputs information related to the access history to the Web page.

  Hereinafter, the access control apparatus 200 will be described in detail. The access control device 200 includes an output mode setting unit 1, a URL acquisition unit 2, a local determination unit 3, a local URL storage unit 3 a, a cloud determination unit 4, a web access control unit 5, and an access history output unit 6.

  The output mode setting unit 1 sets an output mode by the access control device 200 in accordance with an operation of the administrator of the access control system, and generates information for determining the output mode (hereinafter referred to as output mode setting information). The output mode setting information may include an item to be output, an output format, and an output policy (details will be described later). The administrator may directly operate the access control apparatus 200, or a browser that can set an output mode is installed in the terminal apparatus 100 in advance, and the administrator operates the terminal apparatus 100. You may make it set an output mode via a browser.

  The URL acquisition unit 2 acquires the URL (information indicating the access destination) of the Web page that the terminal device 100 tries to access from the terminal device 100. This URL is notified to the local determination unit 3, the cloud determination unit 4, and the web access control unit 5.

  The local determination unit 3 determines whether or not the URL acquired by the URL acquisition unit 2 is accessible based on information stored in the local URL storage unit 3a provided in the access control apparatus 200. Then, the local determination unit 3 notifies the determination result to the cloud determination unit 4 and the web access control unit 5.

  As an example, a list of URLs that can be accessed is stored as a database in the local URL storage unit 3a. The local determination unit 3 determines that the URL can be accessed if the URL acquired by the URL acquisition unit 2 is stored in the local URL storage unit 3a. If the URL is not stored, the local determination unit 3 determines whether the URL is accessible. Judged as unknown.

  The local URL storage unit 3a may store URLs classified for each category (news site, adult site, company site for adoption, SNS (Social Networking Service) site, etc.). And the local determination part 3 may acquire the information of the group (Human Resources Department, Public Relations Department, etc.) to which the user of the terminal apparatus 100 belongs from the terminal apparatus 100, and may determine whether the access is possible in consideration of the belonging group. For example, news site is accessible to all employees, adult site is not accessible to all employees, company site for recruitment is accessible only to employees belonging to Human Resources Department, SNS site is accessible only to employees belonging to Public Relations Department, Etc.

  The cloud determination unit 4 determines whether the URL acquired by the URL acquisition unit 2 is accessible based on information stored in the cloud URL storage unit 300 provided outside the access control device 200. Then, the cloud determination unit 4 notifies the Web access control unit 5 of the determination result.

  As an example, the cloud URL storage unit 300 stores a list of URLs that can be accessed in a database. Then, the cloud determination unit 4 determines that the URL acquisition unit 2 is accessible, and determines that access to the URL is not possible if it is not stored. Since the cloud URL storage unit 300 is provided outside the access control apparatus 200, the cloud URL storage unit 300 can have a larger capacity than the local URL storage unit 3a and can store more URLs.

  As with the local URL storage unit 3a and the local determination unit 3, the cloud URL storage unit 300 stores URLs classified for each category, and the cloud determination unit 4 allows access by considering the group to which the user of the terminal device 100 belongs. May be determined.

  The Web access control unit 5 controls access to the Web page for the URL acquired by the URL acquisition unit 2. Specifically, when the local determination unit 3 or the cloud determination unit 4 determines that access is possible, the Web access control unit 5 acquires information for displaying a Web page corresponding to the URL via the Internet. Then, the Web access control unit 5 transmits the acquired information to the terminal device 100. On the other hand, when the cloud determination unit 4 determines that access is not possible, the Web access control unit 5 transmits information indicating that the Web page corresponding to the URL cannot be accessed to the terminal device 100.

  The access history output unit 6 cooperates with the web access control unit 5 and the like in the access control device 200 to organize the history of web pages accessed by each terminal device 100 via the web access control unit 5, and output mode setting information Is output in an appropriate manner according to.

FIG. 2 is a flowchart showing an example of processing operation of the access control apparatus 200.
First, the URL acquisition unit 2 acquires a URL in response to a Web access request from the terminal device 100 (step S1). Subsequently, the local determination unit 3 refers to the local URL storage unit 3a and determines whether or not the URL can be accessed (step S2). In the local determination in step S2, the local determination unit 3 does not need to communicate with the outside of the access control apparatus 200. Therefore, determination in a short time is possible.

  When the local determination unit 3 cannot determine whether access is possible (NO in step S2), the cloud determination unit 4 refers to the cloud URL storage unit 300 to determine whether or not the URL can be accessed ( Step S3). In the cloud determination in step S3, since many URLs can be stored in the cloud URL storage unit 300, it is possible to determine whether access is possible with higher accuracy.

  Thus, first, local determination is performed, and cloud determination is performed as necessary. This makes it possible to achieve both determination speed and accuracy.

  When the local determination unit 3 or the cloud determination unit 4 determines that access is possible (YES in step S2, YES in step S3), the web access control unit 5 accesses the web page and displays information for displaying the web page. It transmits to the terminal device 100 (step S4). Further, the access history output unit 6 acquires information about the accessed web access history from the web access control unit 5 (step S5).

  On the other hand, when the cloud determination unit 4 determines that access is not possible (NO in step S3), the web access control unit 5 blocks access to the web page and transmits information indicating that access is not possible to the terminal device 100 (step S6). ). In this case, a warning may be displayed on the terminal device 100. Then, the access history output unit 6 acquires information on the web access history that has blocked access from the web access control unit 5 (step S7).

  Note that the access history output unit 6 may acquire information about the Web access history only when it is determined that access is possible and the user actually accesses (that is, step S5 may be performed and step S7 may be omitted). ). In addition, the access history output unit 6 acquires information about the Web access history only when access is determined to be inaccessible and access is blocked (when access is attempted from the terminal device 100 but access is not possible). (That is, step S7 may be performed and step S5 may be omitted). As described above, the information related to the web access history may be only information when actually accessed, or only information when access is blocked, or includes both information. Also good.

  Note that the URL stored in the cloud URL storage unit 300 may be updated at an appropriate timing, or the update may be reflected in the local URL storage unit 3a.

  Next, the access history output unit 6 will be described. The access history output unit 6 may output to a printer for printing, may be output to the terminal device 100 for the administrator for display, or may be output as an electronic file. Then, an output (export) for use by other software (for example, integrated log management software) is particularly considered.

  When the access control device 200 and other software providers are different, it is necessary to match the former output mode with the latter reception mode. Therefore, in the present embodiment, the following is performed.

  First, the administrator performs a necessary operation on the access control apparatus 200 for the administrator, and the output mode setting unit 1 generates output mode setting information. The output mode setting information is notified to the access history output unit 6.

  FIG. 3 is a block diagram showing a schematic configuration of the access history output unit 6. The access history output unit 6 includes an output mode acquisition unit 61, an access history acquisition unit 62 (operation history acquisition unit), an access history storage unit 63, and an output unit 64.

  The output mode acquisition unit 61 acquires output mode setting information set by the administrator from the output mode setting unit 1 (FIG. 1).

  The access history acquisition unit 62 acquires information related to the Web access history by the terminal device 100 and stores it in the access history storage unit 63.

  More specifically, the access history acquisition unit 62 sets a column for storing one or more items included in the information related to the web access history in the access history storage unit 63 in advance. Then, the access history acquisition unit 62 acquires information about the Web access history from the Web access control unit 5 in FIG. 1 and stores necessary items in the set column. Various types of information can be conceived, and examples include the following.

  There are standard items that must be stored regardless of the output mode setting information, and items that are custom-added according to the output mode setting information (that is, according to the administrator's request). Good.

  The standard items include the connection source IP address (information indicating the terminal device 100 that performed the Web access), the connection destination IP address (information indicating the accessed Web page), the accessed URL (or access blocked), and its Date and time, access availability, etc.

  Items to be added as custom are determined to be inaccessible to the cache state, authentication state, FQDN (Fully Qualified Domain Name), socket ID (socket descriptor), client port number, and Web page of the terminal device 100 that has performed Web access. Block conditions (such as the relationship between the group and the category described above), UNIX time (information indicating the time when the Web access was performed), and the like. Further, there may be non-encoded information (group name, URL, UA, etc.) of the URL encoding target column.

  Note that the access history acquisition unit 62 may store only necessary items according to the output mode setting information, but it is desirable to comprehensively store items that may be output. .

Further, the format of the UNIX time and other time information may be specified by the output mode setting information. For example, “May 8, 2017 (Monday) 13:00:00” may be specified to be stored as “Mon 8 5 2017 13:00:00”, or “05/08/2017” You may specify to store like "13: 00: 00: 00".
Further, the value of the specified request header may be output.

  The output unit 64 refers to the access history storage unit 63 and outputs information related to the web access history in a mode according to the output mode setting information. The output unit 64 may output all items acquired by the access history acquisition unit 62, but it is desirable that the items to be output can be specified by the output mode setting information.

  The output mode setting information may include an output format. For example, the order in which the items stored in the column are output is set by the output mode setting information, or a delimiter (separator) between items is set by the output mode setting information. An arbitrary character string may be inserted and output in the form of “Key (item name) = Value (stored information)”. Alternatively, the format may be described at the beginning of the web access history. Further, it may be possible to specify whether to output in the CEF (Common Event Format) format or in the LEEF (Log Event Extended Format) format.

  The output mode setting information may include an output policy. More specifically, the output policy may be set with rule parts (connection source IP address list or group, header detailed control set, filter action, etc.). And an output format may be defined according to rule parts (or its combination). Thereby, an output mode can be set for each group composed of one or a plurality of users. For example, the output format of the Web access history of employees belonging to the personnel department and the output format of the Web access history of employees belonging to the public relations department can be set separately.

  Furthermore, the output mode setting information may be replaced with an arbitrary character string designating User-Agent to be output to the Web access history and output. As a result, it is possible to easily display the Web access history and reduce the size.

  Thus, in this embodiment, the user can flexibly set output modes such as output items, output formats, and output policies. As a result, cooperation between software becomes easy.

  In addition, embodiment mentioned above is only an example to the last, and various deformation | transformation are possible. 1 or 3 may be implemented by hardware or may be realized by software. When implemented by software, a processor (not shown) in the access control apparatus 200 may execute a predetermined program so that the processor functions as each unit. In addition, the access control device 200 may be composed of a plurality of devices, and in that case, the plurality of devices may be provided in different places (for example, some in the company and the other in the outside).

  In FIG. 1, the access control device 200 is a server, but each terminal device 100 may have some functions in the access control device 200. For example, a browser corresponding to the URL acquisition unit 2 may be introduced into the terminal device 100, and the determination as to whether or not the web page can be accessed may be performed by a server located outside the company. In this case, the access history output unit 6 may be in the terminal device 100 or in a server.

  The information processing apparatus according to the present embodiment is generated by installing a program such as a server program. This program may be distributed by e-mail, may be obtained by logging in after accessing a predetermined URL, or may be recorded on a recording medium. The information processing program according to the present embodiment is used to generate at least a part of each unit shown in FIG. 1 or FIG. 3, and the recording medium according to the present embodiment is used to record the program. Moreover, the information processing method of this embodiment is implemented by the information processing apparatus in which the program is installed.

  The local URL storage unit 3a and the cloud URL storage unit 300 may store a database of URLs that are prohibited from being accessed, instead of a database of URLs that may be accessed. In the present embodiment, it is assumed that a web access history is output. However, an arbitrary operation history, for example, a file download history, a history of characters entered in an input form of an access destination, a mail communication (transmission or reception) history. (As a specific example, the present invention is applied when outputting service usage history of MTA (Message Transfer Agent), SMTP (Simple Mail Transfer Protocol), POP (Post Office Protocol), IMAP (Internet Message Access Protocol) server, etc.) Is possible. Further, the terminal device 100 may generate the output mode setting information and transmit it to the output mode acquisition unit 61 of the access control device 200.

  The description of the above-described embodiment and the disclosure of the drawings are merely examples for explaining the invention described in the claims, and are described in the claims by the description of the above-described embodiments or the disclosure of the drawings. The invention made is not limited. The description of the scope of claims at the beginning of the application can be changed as appropriate within the scope of the present patent specification, and the scope can be expanded.

100 terminal device 200 access control device 300 cloud URL storage unit 1 output mode setting unit 2 URL acquisition unit 3 local determination unit 3a local URL storage unit 4 cloud determination unit 5 web access control unit 6 access history output unit 61 output mode acquisition unit 62 Access history acquisition unit 63 Access history storage unit 64 Output unit

Claims (9)

An output mode acquisition unit configured to acquire output mode setting information including an item to be output and an output format set by the user;
An operation history acquisition unit that acquires information about the user's operation history;
Information and an output unit for outputting as electronic files available in different other software and the information relating to the operation history, achieve the operation history acquiring unit software output mode according to the output mode setting information Processing equipment. The information related to the operation history includes a plurality of items,
The information processing apparatus according to claim 1, wherein the operation history acquisition unit acquires at least a part of the plurality of items according to the output mode setting information. The output unit, according to the output mode setting information,
Output order of retrieved items,
Delimiter between acquired items, and
Output format of the retrieved item,
The information processing apparatus according to claim 2, wherein at least one of the following is set. In the output mode setting information, an output mode is set for each group composed of one or a plurality of users.
The information processing apparatus according to claim 1, wherein the output unit outputs information related to the operation history of the user based on the set output mode. Information about the operation history is as follows:
Information about access history to web pages,
Information about file download history,
History of characters entered in the input form of access destination, or
The information processing apparatus according to claim 1, wherein the information processing apparatus is a mail communication history. An information processing method executed by an information processing apparatus including an output mode acquisition unit, an operation history acquisition unit, and an output unit,
The output mode acquisition unit acquires user-set output mode setting information including an item to be output and an output format;
The operation history acquisition unit acquiring information related to a user's operation history;
The output unit, information related to the operation history in the output mode according to the output mode setting information, and outputs it as electronic files available in different other software and software that realize the operation history acquiring unit, information Processing method. Computer
An output mode acquisition unit configured to acquire output mode setting information including an item to be output and an output format set by the user;
An operation history acquisition unit that acquires information about the user's operation history;
Information on the operation history in the output mode according to the output mode setting information, to function as an output unit for outputting as electronic files available in different other software and software that realize the operation history acquiring unit Information processing program.   A recording medium on which the information processing program according to claim 7 is recorded. An access control system comprising a terminal device and an access control device,
The terminal device accesses a web page via the access control device,
The access control device
A URL acquisition unit for acquiring a URL from the terminal device;
A web access control unit that controls access to a web page based on the URL;
An access history acquisition unit that acquires information related to an access history by the terminal device from the Web access control unit;
An output mode acquisition unit configured to acquire output mode setting information including an item to be output and an output format set by the user;
Access to and an output unit for outputting as electronic files available in different other software and the information on the access history, the provide access history acquiring unit software output mode according to the output mode setting information Control system.

Images