JP6728757B2 - Security management device, information processing device, security management method, and program - Google Patents

Description

The present invention relates to a security management device, an information processing device, a security management method, and a program, and more particularly, to a security management device, an information processing device, a security management method, and a program that manage the security of confidential information.

For information processing devices such as complex devices and computers that handle confidential information, how to establish information security has become an important issue.

In addition, since a plurality of users may use the same information processing apparatus in a company or the like, the information processing apparatus has conventionally been roughly divided into two roles regarding the use of the information processing apparatus. Manages device security.

That is, the role of “administrator” that manages permission/non-permission of use of the information processing device by the security information, and “user” who uses the security information and receives permission to use the information processing device to use the information processing device. The roles and are assigned to the use of the information processing apparatus. Further, conventionally, in the security management of the information processing apparatus, the “administrator” sets the operation function level of the information processing apparatus in a plurality of stages and assigns the operation function level permitted to the authority of the user. When the user is permitted to use the security information, the user uses the information processing device at the operation function level assigned to his account.

In security management, conventionally, account information (for example, user identification information and user authentication information) is used as security information. Here, the user identification information is information for identifying a user who uses the information processing apparatus, and an ID (Identification) or the like is used. The user authentication information is information for authenticating that the person requesting the use of the information processing device is a valid user, and a password or the like is used.

Then, conventionally, in security management, this account information is divided into an administrator and a user, an authority is assigned, and the account information is associated with the account information to manage the usable operation function level of the information processing apparatus. .. In addition, the available operation function level of the information processing apparatus associated with the account information is rewritten based on the past or present job information requested by the user (see Patent Document 1 and the like).

However, in the above-mentioned conventional technique, security management is performed by account information such as ID (user identification information) and password (user authentication information). Therefore, in order to properly perform account information, especially security management. Password management is important. For example, if the administrator or user forgets the password or if the password is leaked, some kind of recovery method such as initialization or resetting of the password is required to operate and use the information processing device while ensuring security. Will be required. However, such management of account information, in particular, password recovery operation is an act that can be a kind of attack in terms of security, so how to suppress the security risk and recover the password. The issue is how to do it.

Therefore, an object of the present invention is to efficiently manage account information while ensuring appropriate security.

In order to achieve the above object, the security management device according to claim 1 is user identification information for identifying a user of a managed device, and user authentication for authenticating that the user is an authorized user of the managed device. storage means for storing as the account information in association with information and a plurality of privileges of different privilege levels on utilization of the managed device, the management based on the user identification information and the user authentication information of the account information Usage control means for controlling availability of the target device, and management means for managing operations on the management target device and the account information based on the authority level of the authority given to the user identification information. When the usage history of the user's account information satisfies a predetermined promotion condition, the user's account information is given a deletion authority capable of deleting the user authentication information of the account information different from that of the user. An authority adjustment means and an input means for inputting information are provided , and the management means uses the input means to set an account different from the user depending on the user of the account information to which the deletion authority is given. It is characterized in that, when a request to delete information user authentication information is input, the user authentication information is deleted .

According to the present invention, it is possible to efficiently manage account information while appropriately ensuring security.

1 is an external perspective view of a compound device to which an embodiment of the present invention is applied. The block diagram of a compound device. The figure which shows an example of account information. The figure which shows an example of an authority database. The figure which shows an example of usage history information. The figure which shows an example of a promotion condition. The functional block diagram of a compound device. The flowchart which shows a security management process. The figure which shows a password change process by the transition of a display screen. The figure which shows the account information and screen display example which made public ID easy to understand. The figure which shows the other example of an authority database. The figure which shows an example of the password change screen with respect to the trusted user of FIG. The flowchart which shows the security management process including demotion. The figure which shows an example of a promotion condition and a demotion condition. FIG. 14 is a diagram showing an example of usage history information used in the security management process of FIG. 13.

Hereinafter, preferred embodiments of the present invention will be described in detail with reference to the accompanying drawings. In addition, since the examples described below are preferred examples of the present invention, various technically preferable limitations are attached, but the scope of the present invention is unreasonably limited by the following description. Moreover, not all of the configurations described in the present embodiment are indispensable constituent features of the invention.

1 to 15 are diagrams showing an embodiment of a security management device, an information processing device, a security management method, and a program of the present invention. FIG. 1 is a security management device, an information processing device, and a security management of the present invention. It is an appearance perspective view of compound device 1 to which an example of a method and a program is applied.

In FIG. 1, the multifunctional device 1 is provided with two sheet feeding units 2a and 2b, a plotter unit 3, a scanner unit 4, and an operation display unit 5 in that order from the bottom. In the multifunction device 1, a document table 6 is arranged on the back side of the scanner unit 4, and a document conveying unit 7 that conveys the documents on the document table 6 one by one to the scanner unit 4 is provided. Further, the multifunction device 1 is provided with a document discharge tray 8 and a paper discharge tray 9 on the front side thereof.

The operation display unit 5 includes various operation keys 5a such as a numeric keypad, a start key, a mode selection key for selecting a mode such as a facsimile mode, a copy mode, and a scanner mode, and a display (for example, a liquid crystal display) 5b. Various commands such as a transmission operation are input from the key 5a, and the display 5b displays the content of the command input from the operation key and various information notified from the multifunction device 1 to the operator. In the multifunction device 1, the operation key 5a of the operation display unit 5 is used to operate the account information, and in particular, the deletion operation of the password, which is the user identification information in the account information, is performed. When operating the account information, the multifunction device 1 displays and outputs on the display 5b, necessary information, in particular, a public ID that may be disclosed among IDs (Identification) that are user identification information of the account information.

The paper feed units 2a and 2b respectively include a paper feed tray that stores a plurality of sheet-shaped papers, a paper feed roller that feeds out the papers in each paper feed tray one by one, and a paper fed by the paper feed roller. The plotter unit 3 is provided with a carrying unit and the like for carrying. The sheet feeding units 2 a and 2 b convey the sheets to the plotter unit 3 from the sheet feeding units 2 a and 2 b selected on the operation display unit 5 or the sheet feeding units 2 a and 2 b in which the sheets corresponding to the size of the formed image are stored. To do.

A plurality of originals can be set on the original table 6, and the original conveying section 7 conveys the originals set on the original table 6 one by one to the scanner section 4.

As the scanner unit 4, for example, an image scanner using a CCD (Charge Coupled Device) or a CMOS (Complementary Metal Oxide Semiconductor) is used. The scanner unit 4 scans the document conveyed from the document table 6 by the document conveying unit 7, reads the image of the document at a predetermined resolution, and discharges the read document onto the document discharge tray 8. (Scanner function) is executed.

The plotter unit 3 uses, for example, an electrophotographic recording device or the like, prints and outputs an image on a sheet sent from the sheet feeders 2a and 2b based on image data, and prints the recorded sheet. The recording output function (plotter function) of discharging onto the discharge tray 9 is executed. The plotter unit 3 uses the image data of the original read by the scanner unit 4 or the image data received by the network control unit (see FIG. 2) and the facsimile reception data received by the facsimile control unit (see FIG. 2) as image data. Form.

The hardware of the compound device 1 is configured as a block as shown in FIG. 2, and a CPU (Central Processing Unit) 11, a ROM (Read Only Memory) 12, a non-volatile memory 13, a RAM ( Random Access Memory) 14, an engine control unit 15, a network control unit 16, a facsimile control unit 17, and the scanner unit 4, the plotter unit 3, the operation display unit 5 and the like. Connected by 18.

The ROM 12 stores a basic program of the multifunction device 1, a program for executing a security management method of the present invention described later, and data necessary for executing these programs.

The RAM 14 is used as a work memory of the CPU 11 and also as a page memory in which the image data recorded and output by the plotter unit 3 is expanded.

The CPU 11 expands the program in the ROM 12 into the RAM 14 and executes the program to control each unit of the multifunction device 1 to perform the basic functions of the multifunction device 1 and to execute the security management method of the present invention.

The non-volatile memory 13 stores and reads data that should be stored even when the power of the multifunction device 1 is off, under the control of the CPU 11. The non-volatile memory 13 stores various data necessary for executing the security management method of the present invention. For example, the non-volatile memory 13 includes confidential image data, an administrator, a user, and a supervisor of the multifunction device 1, an account information database, an authority database DB1 (see FIG. 4), an account information use history (see FIG. 5), The promotion condition database (see FIG. 6) and the like are stored.

The account database includes, for example, as shown in FIG. 3, an ID (Identification), a password, authority information, a public ID, usage history information, and the like. 3A is an example of account information of a general user, and FIG. 3B is an example of account information of an administrator. The ID is user identification information that individually identifies the administrator, user, supervisor, and each account. As the ID, for example, a value such as a person's name such as "abcdef" or "ghijkl" that is easy for a human to understand can be arbitrarily designated. The ID cannot be changed once the account is created. The password is user authentication information that authenticates that a person who intends to use the multifunction device 1 is a legitimate user, that is, information for authenticating an account. Although any value can be set for the password, it is handled as confidential information that can only be set by the account owner in operation. Based on this password, the multifunction device 1 performs an authentication process of "because the password that is the secret information is known, the operator of this account must be the owner of this account". The authority information is information indicating the authority permitted to the account (ID). In the present embodiment, as shown as the authority database DB1 in FIG. 4, as authority, authority having different authority levels is divided into four levels of “normal user”, “administrator”, “supervisor” and “trusted user”. It is used and any one of the four rights is set for the account. The public ID is information for identifying an account, and is a public ID (public identification information) that is made public as necessary. The public ID is automatically generated by the multifunction device 1 based on other information, and cannot be changed by the user. In the present exemplary embodiment, the multifunction device 1 uses a rule fixed based on the authority information of the account as the public ID generation rule. For example, the multifunction device 1 has a public ID of “administrator”, and “supervisor” has a fixed value of “mnj_x” (x is a number:: “mnj_1” “mnj_2”...) when an account is created. Generate a value. The format mnj_x may be any format as long as it is not important and is fixed and cannot be changed. The public IDs of users other than the administrator and supervisor are assigned by the administrator and are fixed and cannot be changed. The multifunction device 1 of the present embodiment uses the ID as a public ID as it is, but if it has a feature that it is fixed and cannot be changed and that only an administrator can allocate it, It may be in any format. The usage history is history information of usage of the account, and, for example, as shown in FIG. 5, history information of the latest login information up to a predetermined number of times (10 times in FIG. 5) and the success or failure of login. And information on the total number of successful logins. This usage history is acquired every time the user of the account makes a login attempt, and is registered in the non-volatile memory 13 in association with the account.

The authority database DB1 shown in FIG. 4 has respective items of authority, document processing function, authority setting function, and account operation function. The account operation function further includes new creation, deletion of other account password, authority change and deletion. There are each item. As described above, in the multifunction device 1 of this embodiment, as described above, there are four types of authority: general user, administrator, supervisor, and trusted user. Here, the administrator manages operations such as use of the multifunction device 1 including security, and has an authority range (authority level) as an authority range for performing all functions other than the document processing function. There is. However, the administrator has the scope of authority to perform account operations of the administrator, general user, and trusted user as the scope of authority of the account operation function, and the authority of the supervisor account operations is from the viewpoint of ensuring security. Out of range. The supervisor is an authority that is also used in normal security management, and has a security management function such as password deletion while ensuring security. In the multifunction device 1 of the present embodiment, the supervisor has, as its authority range, only the authority range of deleting the password of the administrator. The general user has the lowest (narrowest) authority range, and has only the authority range of the document processing function. As described later, the trusted user has the authority that a general user can be promoted, and as the scope of the authority, in addition to the document processing function, the authority deletion function of the administrator and supervisor has the authority. ing.

Here, the document processing function is a document processing function that the multifunction device 1 has, and is a function of handling a document such as a “copy function” or a “facsimile transmission function”. The document processing function is given to the general user and the trusted user as described above. The device setting function is a function of setting and managing the conditions of device operation among the functions of the multifunction device 1, and is a setting function relating to security such as “whether or not to use the identification and authentication function”. The device setting function is a function given only to the administrator. The new creation function of the account operation function is a function for creating a new account and is a function given only to the administrator. The password erasing function for other accounts is a function for erasing the passwords of other people's accounts other than your own account, and it is granted to accounts with authority other than general users, but the range of accounts that can be deleted is Different as described above. The authority changing function is a function for changing the authority of the account and is given only to the administrator. The delete function is a function to delete an account and is given only to the administrator.

In the promotion condition database, promotion conditions for a general user to be promoted to a trusted user are registered as privileges, and there are promotion conditions as shown in FIG. 6, for example. The promotion conditions of FIG. 6 are: “History of the past 10 times is within 2 to 8 days.”, “History of the past 10 times is more successful.”, “Total login”. The number of times exceeds 100." is the condition. That is, when the general user satisfies the promotion condition of FIG. 6, the multifunctional apparatus 1 determines that the general user is a reliable user and promotes it to a trusted user having a wider authority range. In this embodiment, this trusted user has the authority to delete the password (user authentication information) of the administrator and supervisor.

Again, in FIG. 2, the scanner unit 4 and the plotter unit 3 are connected to the engine control unit 15, and the engine control unit 15 controls the operations of the scanner unit 4 and the plotter unit 3 under the control of the CPU 11. To do.

The network control unit 16 is connected to a network such as a LAN (Local Area Network), a WAN (Wide Area Network), the Internet, etc., and communicates with a computer on the network, other complex devices, etc. under the control of the CPU 11. Further, the network control unit 16 may exchange data and commands by communicating with a mobile terminal using a wireless communication system such as Wi-Fi or Bluetooth (registered trademark).

The facsimile control unit 17 is connected to a telephone line, and under the control of the CPU 11, performs facsimile transmission processing of facsimile data to a designated destination and reception processing of facsimile data from a destination.

The composite device 1 includes a ROM, an EEPROM (Electrically Erasable and Programmable Read Only Memory), an EPROM, a flash memory, a flexible disk, a CD-ROM (Compact Disc Read Only Memory), a CD-RW (Compact Disc Rewritable), a DVD ( Digital video disk), SD (Secure Digital) card, MO (Magneto-Optical Disc), or other computer-readable recording medium for executing the security management method of the present invention is loaded into the ROM 12 or the nonvolatile memory. By being introduced into the memory 13 or the like, it is constructed as an information processing apparatus that executes a security management method that efficiently manages account information while appropriately ensuring security described later. The program of this security management method is a computer-executable program written in a legacy programming language such as assembler, C, C++, C#, Java (registered trademark) or an object-oriented programming language, and is stored in the recording medium. Can be stored and distributed.

In the multifunction device 1, the CPU 11, the non-volatile memory 13, and the operation display unit 5 function as a security management unit (security management device) 20 that performs security management using the multifunction device 1 as a management target device.

The multifunction device 1 is constructed with a function block as shown in FIG. 7 as the security management unit 20 by introducing the program of the security management method. That is, when the program of the security management method is installed in the multifunction device 1, as illustrated in FIG. 7, the storage unit 21, the usage control unit 22, the management unit 23, the authority adjustment unit 24, the input unit 25, and the information output unit. 26 is constructed as the security management unit 20.

The storage unit 21 is constructed by the non-volatile memory 13. The storage unit 21 has an ID as user identification information for identifying a user of the compound device 1 that is a managed device, a password as user authentication information for authenticating that the user is an authorized user of the compound device 1, A plurality of authorities having different authority levels in using the multifunction device 1 are associated and stored as account information. Here, in this embodiment, the storage unit 21 stores general users, trusted users, supervisors, and managers as the authorities, and the authority level as the authority database DB1. The storage unit 21 also stores a public ID (discrimination information for public), and the public ID is a public ID associated with each ID. When deleting the password that is the user authentication information, the multifunction device 1 outputs the public ID associated with each ID to the information output unit 26. Therefore, the storage unit 21 functions as a storage unit.

The usage control unit 22 is constructed by the CPU 11 and controls the availability of the multifunctional apparatus 1 which is a management target apparatus based on the ID and password of the account information. Therefore, the usage control unit 22 functions as usage control means.

The management unit 23 is constructed by the CPU 11 and performs an operation on the multifunction device 1 which is a management target device and the account information based on one of a plurality of authorities with different authority levels given to the ID. to manage. Therefore, the management unit 23 functions as a management unit.

The authority adjusting unit 24 is constructed by the CPU 11, and adjusts and adjusts the authority of the account information based on the usage history of the user's account information. Further, the authority adjusting unit 24 changes the authority based on the promotion condition for promoting the authority to the authority having the higher authority level and the demotion condition for demoting the authority to the authority having the lower authority level. Therefore, the authority adjusting unit 24 functions as an authority adjusting means.

The input unit 25 is constructed by operation keys of the operation display unit 5, a touch panel of a display, and the like, and is used to input information. Therefore, the input unit 25 functions as an input unit.

Then, in the multifunction device 1, when the usage history of the user satisfies a predetermined usage history, the authority adjusting unit 24 can delete the authority of the user and the password that is the user identification information of another user. When the user is requested to delete the password of another user from the input unit 25, the management unit 23 deletes the password.

In addition, in the multifunction device 1, when the authority adjusting unit 24 satisfies a predetermined use history of the user's usage history, the authority of the user is set as administrator authority for managing the security management unit (security management apparatus) 20. Promote the password of the account information that is assigned to to a trusted user (administrator deletion authority) who can delete it. Further, at this time, the management unit 23 requests the password deletion request from the input unit 25 by the user having the ID to which the trusted user (administrator deletion authority) is given, which specifies the ID to which the administrator authority is given. If there is, the password is deleted.

The information output unit 26 is constructed by a display or the like of the operation display unit 5 and outputs information. Therefore, the information output unit 26 functions as an information output unit.

Then, in the multifunction device 1, when the password is deleted, the management unit 23 causes the information output unit 26 to output the public ID (public identification information) associated with each ID (user identification information).

In addition, the management unit 23 executes the deletion of the password based on the password deletion request from the user of the ID whose deletion authority has been acquired by changing and adjusting the authority, only to the password within the predetermined authority range. ..

In the above description, the multifunction device 1 includes the storage unit 21, the usage control unit 22, the management unit 23, the authority adjustment unit 24, the input unit 25, and the information output unit 26, which configure the security management unit 20, in the device. The case of built-in is explained. The security management device is not limited to the above-mentioned configuration, and for example, each unit constituting the security management device may be present in separate devices connected by a network or the like.

Next, the operation of this embodiment will be described. In the multifunction device 1 of the present embodiment, the security management unit 20 efficiently manages account information while appropriately ensuring security.

In the multifunction device 1, the security management unit 20 controls the normal use of the multifunction device 1 based on the account information, and also manages the security of the account information.

That is, when the user makes a usage request or an account operation request for the multifunction device 1, the multifunction device 1 inputs the ID and password of the account information as the identification and authentication information from the input unit 25, as shown in FIG. input. When the identification and authentication information is input (step S101), the multifunction device 1 checks whether the ID of the input authentication and identification information is registered in the storage unit 21 (step S102).

If the input ID is not registered in step S102 (NO in step S102), the usage control unit 22 notifies the user by causing the information output unit 26 to output that the login has failed. Then, the login failure process is performed and the process ends (step S103).

If the input ID is registered in step S102 (YES in step S102), the usage control unit 22 determines that the input password is the password of the account registered in association with the ID. It is checked whether they match (step S104).

If the input password does not match the registered password in step S104 (NO in step S104), the usage control unit 22 updates the usage history of the account information in the storage unit 21 as login failure (step S105). .. That is, the usage control unit 22 updates the history information of the corresponding ID of the account information with the information of login failure and login operation date and time. The use control unit 22 notifies the user by, for example, outputting the fact that the login has failed to the information output unit 6, performs the login failure process, and ends the process (step S106).

When the input password matches the registered password in step S104 (YES in step S104), the usage control unit 22 updates the usage history of the account information in the storage unit 21 as successful login (step S107). That is, the usage control unit 22 updates the history information of the corresponding ID of the account information by registering the information of the successful login and the date and time of the login operation.

Next, when the authority of the input ID is a general user, the authority adjusting unit 24 checks whether the usage history satisfies the promotion condition (step S108). This promotion condition is, for example, the promotion condition as shown in FIG.

If the promotion condition is not satisfied in step S108 (not applicable in step S108), the authority adjustment unit 24 does not perform the authority promotion, and the usage control unit 22 notifies the information output unit that the login is successful. The user is notified by outputting the information to 6, and the login success process is performed and the process ends (step S109). When the multifunction device 1 performs the login success process, the management unit 23 thereafter permits the use of the multifunction device 1 by the user who is permitted to log in according to the level of the authority.

When the promotion condition is satisfied in step S108 (when applicable in step S108), the authority adjusting unit 24 promotes and registers the authority of the logged-in ID in the storage unit 21 (step S110). In this embodiment, this promotion is specifically promotion of a general user to a trusted user. After that, the authority adjusting unit 24 notifies the user of the fact that the login is successful by outputting the information to the information output unit 6, performs the login success process, and ends the process (step S109). In addition, when the multifunction device 1 performs the login success process accompanied by the elevation of authority, the management unit 23 thereafter manages the use of the multifunction device 1 and the management of the account information by the user who is permitted to log in, and the authority after the elevation. Allow according to the level of.

Then, in the multifunction device 1, the security management unit 20 deletes the password based on the level of authority of the user registered in the authority database DB1 shown in FIG. 4 in response to the request from the user ( Account management processing such as deletion) is performed. The multifunction device 1 assigns the right to delete the password, in particular, the right to delete the password of the administrator or supervisor to the trusted user. That is, when the password is forgotten or leaked, the multifunction device 1 ensures security by erasing (deleting) the password and resetting it. The administrator's password can be deleted by the administrator. However, if the administrator or supervisor forgets or leaks the password and another user cannot delete the password, the security management itself of the multifunction device 1 cannot be properly operated.

Therefore, in the multifunction device 1 of the present embodiment, the security management unit 20 is provided with a trusted user as an authority that can erase (delete) the password of the administrator or the supervisor, as shown in FIG. .. Then, when the usage history of the general users satisfies a preset promotion condition, the security management unit 20 determines that the user is a reliable user, and promotes the trusted user to the trusted user. By making it possible to erase the passwords of users and supervisors, it is possible to ensure the security and to properly operate the security management itself.

That is, the security management unit 20 manages the password change process as shown in FIG. In addition, in order to perform the password change process of FIG. 9, the user must first be authenticated by inputting the ID and password. When the user operates the input unit 25 to display the initial screen on the information output unit 26 as shown in FIG. 9A and “setting” is selected and operated on the initial screen, FIG. As shown in b), the “setting screen” is displayed on the information output unit 26. This "setting screen" is a screen for selecting "change password" and other settings.

When the user is a general user and selects the password change, the security management unit 20 displays the “general user password change screen” shown in FIG. 7C on the information output unit 26 and uses it. Allows a person to change his or her own password.

Further, in FIG. 9B, when the user is a supervisor and selects the password change, the security management unit 20 displays the “supervisor password change screen” shown in FIG. 9D on the information output unit. 26 is displayed. This "password change screen for supervisor" is a screen for selecting whether to change the password of the supervisor itself or to erase the password of either the administrator or himself.

When “mnj_1” deletion is selected in the “Supervisor password change screen” of FIG. 9D, the security management unit 20 determines that the selected public ID is “mnj_1” as shown in FIG. 9E. Erase the password of the account that is. Now, in the present embodiment, as shown in FIG. 3, the public ID "mnj_1" is the public ID of the administrator, so the security management unit 20 deletes the password of the administrator.

Further, in the "supervisor password change screen" of FIG. 9B, the public IDs "mnj_1" and "mnj_2" of the account are displayed in order to specify the account whose password can be deleted. Therefore, the original ID is not displayed on the screen, and the secret of the ID is secured. As a result, it is possible to prevent both the ID and the password from being known to the user who has performed an operation such as changing the password, and it is possible to appropriately secure security.

Further, in FIG. 9B, when the user is a trusted user and the password change is selected, the “password change screen for trusted user” shown in FIG. 9F is displayed on the information output unit 26. .. This "trusted user password change screen" is a screen for selecting whether to change the password of the trusted user himself or erase the password of either the administrator or the supervisor.

When “mnj_1” deletion is selected on the “trusted user password change screen” in FIG. 9F, the security management unit 20 determines that the selected public ID is “as shown in FIG. 9E. Erase the password of the account that is "mnj_1". Now, in the present embodiment, as shown in FIG. 3, the public ID "mnj_1" is the public ID of the administrator, so the security management unit 20 deletes the password of the administrator.

In addition, in the “trusted user password change screen” of FIG. 9F, the public ID “mnj_1” of the account, in order to specify the account whose password can be erased, as in FIG. 9D. "Mnj_2" is displayed. Therefore, the original ID is not displayed on the screen, and the secret of the ID is secured. As a result, it is possible to prevent both the ID and the password from being known to the user who has performed an operation such as changing the password, and it is possible to appropriately secure security.

Further, in FIG. 9B, when the user is the administrator and selects the password change, the “password change screen for administrator” shown in FIG. 9G is displayed on the information output unit 26. The "administrator password change screen" is a screen for selecting whether to change the password of the trusted user himself or erase the password of any one of the administrator, the general user and the trusted user. Note that, in FIG. 9G, only the public IDs of the general user and the trusted user are displayed as the public ID, but the public ID of the administrator is also displayed.

When “abcde” deletion is selected on the “administrator password change screen” in FIG. 9G, the security management unit 20 selects the public ID selected in the same manner as shown in FIG. 9E. Erase the password for the account with "abcde". Now, in the present embodiment, as shown in FIG. 3, the public ID “abcde” is the public ID of the general user, so the security management unit 20 determines that the public ID of the general user is “abcde”. Delete the password.

Further, in the “administrator password change screen” of FIG. 9G, the public ID “abcde” of the account, “abcde”, and “ fhijklm" is displayed. Therefore, the original ID is not displayed on the screen, and the secret of the ID is secured. As a result, it is possible to prevent both the ID and the password from being known to the user who has performed an operation such as changing the password, and it is possible to appropriately secure security.

In this way, among the general users, the trusted user who satisfies the promotion condition can be changed to the administrator and supervisor passwords as the trusted user. Therefore, even if the password for the administrator or supervisor is forgotten or leaked, the trusted user can erase and change the password for the administrator and supervisor, ensuring security while maintaining the security management itself. It enables the proper operation of.

In the above example, as the public ID, the security management unit 20 automatically generates an ID that is difficult to associate with the original ID, but the ID is difficult for a trusted user to understand. Therefore, when the trusted user erases the password of the administrator or supervisor, it may be difficult to determine which is the public ID of the owner of the password to be erased from the public ID.

Therefore, the security management unit 20, for example, as shown in FIGS. 10A and 10B, sets the public ID to an ID that easily associates the user who is the owner of the ID. In FIG. 10A, when the user is a general user and the ID is the last name spelled in lowercase English letters "abcdef", the public ID is "○○○○". The last name spelled in Kanji is used. Further, in FIG. 10B, when the user is the administrator and the ID is the last name spelled in lowercase English letters "ghijkl", the name "H_Ghijkl" is used as the public ID. The capital letters of the initials and the last name spelled in lower case English letters are used.

As shown in FIG. 10C, when the trusted user deletes the password of the administrator or the like, the public user ID for easily identifying the account to be deleted may be displayed on the password change screen for the trusted user. it can.

The public ID is automatically generated by the security management unit 20 in the above description, but may be arbitrarily determined by the user.

Further, in the above description, the target that the trusted user can erase the password is the password of the administrator and the supervisor, but for example, as shown in the authority database DB2 in FIG. 11, only the password of the supervisor is used. May be limited to

In this case, when the trusted user selects the password deletion, the security management unit 20 displays the easy-to-understand trusted user password change screen as shown in FIG. 12 on the information output unit 26.

Furthermore, in the above description, only the case where a user's authority is promoted from a general user to a trusted user has been described, but as shown in FIG. 13, the user's authority is not only promoted but also demoted. Security management processing that involves processing may be performed. Note that, in FIG. 13, the same step number is given to the same processing step as in FIG. 8, and the description is simplified or omitted.

In this case, in the storage unit 21, for example, the promotion condition as shown in FIG. 14A and the demotion condition as shown in FIG. 14B are stored in advance.

Further, the storage unit 21 stores the usage history information as shown in FIG. This use history information is information in which the number of times of promotion login is further added to the use history information shown in FIG. The number of times of promotion login is the total number of times of login at the time when the promotion process is performed for the user.

In FIG. 13, when the identification/authentication information is input (step S101), the multifunction device 1 checks whether the ID of the input authentication identification information is registered in the storage unit 21 (step S101) (step S101). S102).

If the input ID is not registered in step S102, the usage control unit 22 notifies the user by causing the information output unit 6 to output that the login has failed, and performs the login failure process to perform the process. It ends (step S103).

When the input ID is registered in step S102, the usage control unit 22 checks whether the input password matches the password of the account registered corresponding to the ID (step S104). ..

If the input password does not match the registered password in step S104, the usage control unit 22 updates the usage history of the account information in the storage unit 21 as login failure (step S105).

Then, the authority adjusting unit 24 checks whether the authority of the user who has failed to log in is a trusted user, and if the user is a trusted user, checks whether the usage history satisfies the demotion condition (step S201). .. This demotion condition is, for example, the demotion condition as shown in FIG.

When the trusted user satisfies the demotion condition in step S201 (when applicable in step S201), the authority adjustment unit 24 demotes the authority of the ID for which login failed and registers it in the storage unit 21 ( Step S202). In this embodiment, this demotion is specifically a demotion of a trusted user to a general user. After that, the authority adjustment unit 24 notifies the user of the fact that the login has failed by causing the information output unit 6 to output the login failure process, and ends the process (step S106).

When the trusted user does not satisfy the demotion condition in step S201 (when not applicable in step S201), the authority adjustment unit 24 performs the login failure process by the usage control unit 22 without performing the authority demotion. (Step S106). That is, the usage control unit 22 notifies the user of the fact that the login has failed by causing the information output unit 6 to output the login failure process, and ends the process.

When the input password matches the registered password in step S104, the usage control unit 22 updates the usage history of the account information in the storage unit 21 as successful login (step S107).

Next, when the authority of the input ID is a general user, the authority adjusting unit 24 checks whether the usage history satisfies the promotion condition (step S108). This promotion condition is, for example, the promotion condition as shown in FIG.

If the promotion condition is satisfied in step S108, the authority adjusting unit 24 promotes and registers the authority of the logged-in ID in the storage unit 21 (step S110). In this embodiment, this promotion is specifically promotion of a general user to a trusted user. Then, when this promotion is performed, the authority adjustment unit 24 changes the value of the “number of logins during promotion” of the account to the “total number of logins” at that time.

Next, the authority adjusting unit 24, if promoted, checks whether the authority of the input ID is a trusted user, and if it is a trusted user, it checks whether the demotion condition is satisfied (step S203).

In step S108, if the promotion condition is not satisfied, the authority adjusting unit 24 checks whether the authority of the input ID is a trusted user without performing the authority promotion, and if it is the trusted user, the demotion condition is determined. It is checked whether or not is satisfied (step S203).

In step S203, if the demotion condition is not satisfied (in step S203, if not applicable), the authority adjusting unit 24 does not demote the authority, and the use control unit 22 informs that the login is successful. The user is notified by outputting the information to 6, and the login success process is performed and the process ends (step S109). When the multifunction device 1 performs the login success process, the management unit 23 thereafter permits the use of the multifunction device 1 by the user who is permitted to log in according to the level of the authority.

If the demotion condition is satisfied in step S203 (if applicable in step S203), the authority adjusting unit 24 demotes the authority of the ID for which login is successful and registers it in the storage unit 21 (step S204). In this embodiment, this demotion is specifically a demotion of a trusted user to a general user. After that, the authority adjusting unit 24 notifies the user of the fact that the login is successful by outputting the information to the information output unit 6, performs the login success process, and ends the process (step S109). In addition, when the multifunction device 1 performs the login success process, the management unit 23 thereafter permits the use of the multifunction device 1 by the user who is permitted to log in according to the level of the authority (authority after demotion). ..

As described above, in FIG. 13, the trusted user who has been promoted is judged based on the history information based on the history information under the demotion condition, and when it becomes untrustworthy, it is demoted to the general user. Therefore, once promoted to a trusted user, it can be demoted based on historical conditions such as time and number of logins, improving the reliability of the trusted user and further optimizing security management. be able to.

In the above description, the case where the security management device is applied to the multifunction device 1 as the information processing device has been described, but the application target is not limited to the multifunction device 1. The present invention can be similarly applied to a computer that handles information that needs to be kept confidential and other information processing devices.

Further, in the above description, the case where the promotion and demotion of authority are performed in one step has been described, but the rank of authority level is not limited to one step.

As described above, in the multifunction device 1 of the present embodiment, the security management unit 20 thereof has an ID (user identification information) for identifying a user of the multifunction device 1 that is a device to be managed, and a legitimate use of the multifunction device 1. Account information by associating a password (user authentication information) for authenticating that the user is a person and a plurality of authorities (general user, trusted user, administrator, supervisor) having different authority levels for using the multifunction device 1 A storage unit (storage unit) 21, a use control unit (use control unit) 22 that controls availability of the multifunction device 1 based on the ID of the account information and the password, and the ID A management unit (management unit) 23 that manages an operation on the multifunction device 1 and the account information based on the authority level of the granted authority, and the account based on a usage history of the user's account information. An authority adjusting unit (authority adjusting means) 24 for changing and adjusting the authority of information.

Therefore, even if the password of an account with higher authority such as the administrator is forgotten or leaked, the user with the authority adjusted to the higher level can operate the account information for which the password has been forgotten. it can. As a result, it is possible to efficiently manage account information while ensuring appropriate security.

Further, in the multifunction device 1 of the present embodiment, the security management unit 20 identifies the ID (user identification information) that identifies the user of the multifunction device 1 that is the management target device, and the authorized user of the multifunction device 1. A password (user authentication information) for authenticating that there is and a plurality of authorities having different authority levels for use of the multifunction device 1 are associated with the ID and the password of the account information in the storage unit 21 and stored as account information. A usage control processing step for controlling the availability of the multifunction device 1 based on the management, and a management for managing operations on the multifunction device 1 and the account information based on the authority level of the authority granted to the ID. A security management method including a processing step and an authority adjustment processing step of adjusting and adjusting the authority of the account information based on a usage history of the user's account information.

Therefore, even if the password of an account with higher authority such as the administrator is forgotten or leaked, the user with the authority adjusted to the higher level can operate the account information for which the password has been forgotten. it can. As a result, it is possible to efficiently manage account information while ensuring appropriate security.

Further, in the multifunction device 1 of this embodiment, the security management unit 20 causes the computer to identify an ID for identifying the user of the multifunction device 1 that is a device to be managed, and to confirm that the computer is an authorized user of the multifunction device 1. Whether or not the multifunction device 1 can be used based on the password and the ID of the account information in the storage unit 21 that stores as an account information a password to be authenticated and a plurality of different authority levels for using the multifunction device 1 A usage control process for controlling, a management process for managing operations on the multifunction device 1 and the account information based on the authority level of the authority given to the ID, and the account information of the user. A program for executing authority adjustment processing for changing and adjusting the authority of the account information based on the usage history is installed.

Therefore, even if the password of an account with higher authority such as the administrator is forgotten or leaked, the user with the authority adjusted to the higher level can operate the account information for which the password has been forgotten. it can. As a result, it is possible to efficiently manage account information while ensuring appropriate security.

Further, in the security management unit 20 of the multifunction device 1 according to the present embodiment, the authority adjusting unit 24 promotes the promotion condition to the authority having a higher authority level and the authority to the authority having a lower authority level. The authority is changed based on the demotion condition.

Therefore, the authority of the user can be adjusted clearly and appropriately based on the promotion condition and the demotion condition, and the account information can be managed more efficiently while ensuring security.

Further, the security management unit 20 of the multifunction device 1 of the present embodiment further includes an input unit (input unit) 25 for inputting information, and the authority adjustment unit 24 causes the user's usage history to be a predetermined usage history. When satisfied, the authority of the user is promoted to a trusted user (deletion authority) that can delete the password of another user, and the management unit 23 grants the deletion authority from the input unit 25. When there is a request to delete the password of another user by the user having the stored ID, the password is deleted.

Therefore, it is possible to give the trusted user the authority to delete the password and perform the operation of deleting the account information such as forgetting the password. As a result, it is possible to efficiently manage account information while ensuring appropriate security.

Further, the security management unit 20 of the multifunction device 1 according to the present embodiment further includes an input unit 25 for inputting information, and when the authority adjustment unit 24 satisfies the predetermined usage history of the user, The authority of the user is promoted to an administrator deletion authority capable of deleting the password of the account information to which the administrator authority for managing the security management section 20 is given, and the management section 23 When there is a request from the input unit 25 for deleting the password designating the ID given the administrator authority by the user (trusted user) having the ID given the administrator deletion authority, Delete the password.

Therefore, the authority to delete the password of the administrator can be given to the trusted user, and the operation of deleting the account information whose password has been forgotten can be performed. As a result, it is possible to efficiently manage account information while ensuring appropriate security.

Further, the security management unit 20 of the multifunction device 1 of the present embodiment further includes an information output unit (information output unit) 26 that outputs information, and the management unit 23 deletes the password for each ID. A public ID (discrimination information for publication) associated with the ID is output to the information output unit 26.

Therefore, it is possible to prevent the user who has the authority to delete the password from knowing both the ID and the password of the account to be deleted, and more appropriately secure the security while managing the account information. Can be efficiently performed.

Further, the security management unit 20 of the multifunction device 1 according to the present exemplary embodiment is configured to manage the password based on the password deletion request from the user of the ID having the deletion authority acquired by the management unit 23 by changing and adjusting the authority. Deletion is limited to the password within the predetermined authority range.

Therefore, the password deletion authority can be limited to an appropriate range, and the account information can be efficiently managed while ensuring the security more appropriately.

Although the invention made by the inventor has been specifically described based on the preferred embodiments, the invention is not limited to the above-described embodiments and various modifications are made without departing from the scope of the invention. It goes without saying that it is possible.

DESCRIPTION OF SYMBOLS 1 Multifunction device 2a, 2b Paper feeding section 3 Plotter section 4 Scanner section 5 Operation display section 5a Operation keys 5b Display 6 Document table 7 Document transport section 8 Document ejection tray 9 Paper ejection tray 11 CPU
12 ROM
13 Non-volatile memory 14 RAM
15 engine control unit 16 network control unit 17 facsimile control unit 18 bus 20 security management unit 21 storage unit 22 usage control unit 23 management unit 24 authority adjusting unit 25 input unit 26 information output unit DB1 authority database

JP, 2011-159105, A

Claims (8)

User identification information identifying the user of the managed device, to authenticate that it is a valid user user authentication information and the plurality of privileges of different privilege levels on usage of the managed device of the managed devices And a storage means for storing as account information in association with
A usage control unit that controls availability of the managed device based on the user identification information of the account information and the user authentication information;
Management means for managing operations on the managed device and the account information based on the authority level of the authority given to the user identification information;
Usage history of the account information of the user and a predetermined elevation condition is satisfied, the account information of the user, to grant delete permission deletable user authentication information of different account information and the user privileges Adjusting means,
An input means for inputting information ,
The management means is
When the user of the account information to which the deletion authority is given inputs a request for deleting the user authentication information of the account information different from the user from the input means, the user authentication information is deleted. A security management device characterized by being deleted . The authority adjusting means,
2. The security according to claim 1, wherein the authority is changed based on a promotion condition for promoting the authority to the authority having a higher authority level and a demotion condition for demoting the authority to the authority having a lower authority level. Management device. The authority adjusting means,
Wherein the user of the usage history satisfies a predetermined elevation conditions, the authority of the user, deletes the user authentication information of said account information that is granted administrative rights for managing security management device Grant the possible administrator delete permission,
The management means is
From the input means, it's to the user of the account information that has been granted the administrator delete permissions, the user authentication information you specify the user identification information that has been granted the administrator privileges The security management device according to claim 1 or 2 , wherein when a deletion request is input , the user authentication information is deleted. The security management device,
Information output means for outputting information,
Further preparation,
The management means is
As an option of the user authentication information to be deleted, according to claim claim 1, characterized in that for outputting the user identification information and the public identification information associated with each of the user identification information, said information output means The security management device according to any one of 3 above. The management means is
The deletion of the user authentication information based on the deletion request of the user authentication information from the user of the user identification information that has acquired the deletion right by the change and adjustment of the right is performed within the predetermined range of the right. security management device according to any one of claims 4 to run is limited to the authentication information from the claim 1, characterized in. An information processing device that manages users by a security management unit and processes information,
Examples security management unit, the information processing apparatus characterized by comprising a security management device according to any one of claims 1 to 4. User identification information identifying the user of the managed device, to authenticate that it is a valid user user authentication information and the plurality of privileges of different privilege levels on usage of the managed device of the managed devices A security management method executed by a computer that associates with and stores as account information ,
A usage control processing step for controlling availability of the managed device based on the user identification information of the account information and the user authentication information;
A management processing step of managing operations on the managed device and the account information based on the authority level of the authority given to the user identification information;
Usage history of the account information of the user and a predetermined elevation condition is satisfied, the account information of the user, to grant delete permission deletable user authentication information of different account information and the user privileges An adjustment processing step,
An input step of inputting information ,
In the management processing step,
In the input step, when the user of the account information to which the deletion authority is given inputs a request to delete the user authentication information of the account information different from the user, the user authentication information is input. A security management method characterized by deleting . On the computer,
User identification information identifying the user of the managed device, to authenticate that it is a valid user user authentication information and the plurality of privileges of different privilege levels on usage of the managed device of the managed devices A usage control process for controlling availability of the managed device based on the user identification information of the account information and the user authentication information of a storage unit that stores the account information in association with each other;
Management processing for managing operations on the managed device and the account information based on the authority level of the authority given to the user identification information;
Usage history of the account information of the user and a predetermined elevation condition is satisfied, the account information of the user, to grant delete permission deletable user authentication information of different account information and the user privileges Adjustment process,
Input process to input information, and execute ,
In the management process,
In the input process, when the user of the account information to which the deletion authority is given inputs a request to delete the user authentication information of the account information different from the user, the user authentication information is deleted. A program characterized by removal .

Images