JP7183908B2 - System operation lock release system, operation lock cooperation agent, server, method, and program - Google Patents

Description

The present disclosure relates to a system operation lock release system, operation lock cooperation agent, server, method, and program.

Systems in IT (Information Technology) have long had mechanisms for user management and user authentication. The number of IT systems used by companies and organizations has been steadily increasing, and users have to memorize user IDs (Identifiers) and passwords for each system and enter them manually in order to perform their duties. . There is a concept of single sign-on as a means to solve such a situation. Single sign-on is realized by using, for example, "a technique of storing a user ID and password necessary for a linked system and performing substitute input on behalf of the user when an authentication screen is displayed." Alternatively, single sign-on is defined as "setting the system to trust each other's authentication results, and if you have the authentication information of any system, you can trust it and use other systems as authenticated. It is realized by "technology to By using such a mechanism, the user of the system can reduce the number of sets of user IDs and passwords that he/she remembers.

For example, in recent OA (office automation) work, remote work may be performed using an information terminal. In remote work, a user logs in to an information terminal at hand, and then securely connects to the company's business network using a VPN (Virtual Private Network) connection. Further, the user logs in to a virtual desktop terminal placed on the business network, connects to the business system, and performs business. In such an environment, each device has an authentication. Therefore, the user needs to perform the login action many times. In single sign-on, when a user inputs one piece of authentication information, login to the device behind it is automatically performed by linking the authentication information, thereby eliminating the troublesomeness of the user.

In the above example, for example, the user performs face authentication on the information terminal and logs in to the information terminal. The facial recognition system automatically logs into VPN authentication. The VPN device automatically logs in to the VPC (Virtual Personal Computer) login authentication, and the VPC login authentication automatically logs in to the business system login authentication. The important point here is that single sign-on is a mechanism for linking authentication information, so the fact that each system performs user management and user authentication remains unchanged. At each stage, the login mechanism is different. Therefore, at each stage, authentication is performed by an independent method, and the authentication information is not handed over.

Here, as a related technique, Patent Literature 1 discloses an information processing apparatus that provides a predetermined service to a terminal device. The information processing apparatus receives authentication information of one terminal device (terminal A) authenticated by the authentication server, among a plurality of terminal devices authenticated by the same authentication information. Further, the information processing apparatus acquires authentication information from the terminal B in the authentication of another terminal device (terminal B) among the plurality of terminal devices. Based on the authentication information of terminal B and the authentication information of terminal A, the information processing device performs authentication of the terminal device on behalf of the authentication server.

WO2016/143027

In single sign-on, for example, authentication cooperation can be realized starting from logging in to an information terminal equipped with a face authentication system by face authentication. Specifically, starting from the login by face authentication, connection authentication from the information terminal to the VPN device, login authentication from the information terminal to the virtual desktop terminal via VPN, and login authentication from the virtual desktop terminal to the business system can be realized.

Here, when a plurality of devices each have an authentication mechanism, each device may have a mechanism (operation lock mechanism or operation timeout mechanism) that prompts re-authentication over time. . In an environment configured to enable single sign-on to a business system with a single facial recognition, it is thought that there is a need to unlock the operation lock of each device by facial recognition. However, as described above, each authentication method is independent, and authentication information is not handed over. Therefore, when the operation lock is applied to any device, the operation lock cannot be released because the face authentication is different from the authentication method expected by the device.

For example, in VPN devices, virtual desktop terminals, and business systems, if there is no operation for a long time, an operation lock or connection timeout occurs. In VPN devices, virtual desktop terminals, and business systems, it is necessary to enter a user ID and password corresponding to each device in order to release the operation lock or connection timeout. However, users are logging into these devices through facial recognition. Therefore, the user may not know the user ID and password for releasing the operation lock of each device. In that case, the user cannot release the operation lock.

As a countermeasure to the above problem, it is conceivable to lock the operation only for the face authentication portion and not to request re-authentication (lock the operation) on the subsequent devices. However, in that case, for example, when logging in from another information terminal, the subsequent device can be used without re-authentication. This poses a security risk. Patent Document 1 simply performs proxy authentication for terminal B, and does not provide any means for unlocking the operation lock when the operation lock occurs.

In view of the above circumstances, the present disclosure provides a system operation unlocking system, an operation lock cooperation agent, a server, a method, and a program that cooperate with a single sign-on system that can improve user convenience while maintaining device security. intended to provide

In order to achieve the above object, the present disclosure provides, as a first aspect, a device to be authenticated in the first stage that is authenticated using authentication means, and a device that is authenticated by single sign-on using the authentication result of the authentication means. A plurality of authentication target devices including the authentication target device described in the latter part, and whether or not each authentication target device is in an authentication required state, which is a state in which authentication is required, which is arranged corresponding to each of the plurality of authentication target devices authentication required state information arranged corresponding to each of the plurality of authentication target devices and indicating whether each authentication target device is in the authentication required state; and in each authentication target device an operation lock cooperation agent that generates operation lock information including an authentication result; and the operation lock information that is received from the operation lock cooperation agent and that is received from the operation lock cooperation agent corresponding to each of the plurality of authentication target devices. an operation lock cooperation server that generates cooperation data by combining operation lock information and transmits the cooperation data to the operation lock cooperation agent, and the operation lock cooperation agent authenticates the authentication target device in the single sign-on. is performed, operation lock information including an authentication result indicating successful authentication is transmitted to the operation lock cooperation server, and the operation lock cooperation agent detects that the authentication target device is Operation lock information including authentication required state information indicating the authentication required state is transmitted to the operation lock cooperation server, and the operation lock cooperation server cooperates including the operation lock information indicating the authentication required state. When data is generated and transmitted to the operation lock cooperation agent, and the operation lock cooperation agent corresponding to the first-stage authentication target device prompts the authentication means to perform authentication, and the authentication in the authentication means is performed normally. and a system operation unlocking system in which authentication of an authentication target device in which the authentication required state is detected is performed using the single sign-on mechanism.

As a second aspect, the present disclosure includes a first stage authentication target device authenticated using an authentication means, and one or more subsequent authentication target devices authenticated by single sign-on using the authentication result in the authentication means. authentication required state information indicating whether or not the authentication target device to be monitored is in an authentication required state in which authentication is required; an operation lock information generating means for generating operation lock information including the result of authentication in the authentication target device; operation lock information transmitting means for transmitting to an operation lock cooperation server generating cooperation data combining lock information; cooperation data receiving means for receiving the cooperation data from the operation lock cooperation server; and the authentication required state for the cooperation data. and when the authentication target device to be monitored is the first-stage authentication target device, authentication prompting the authentication means to perform authentication requesting means, wherein the operation lock information generating means generates operation lock information including a result of the authentication when the authentication target device to be monitored is authenticated, and the operation lock information generating means generating operation lock information including authentication required state information indicating that the authentication target device to be monitored is in the authentication required state when the authentication required state is detected in the authentication target device to be monitored; After receiving the cooperation data containing the operation lock information including the authentication required state information indicating the authentication state, when the authentication is normally performed by the authentication means, the single sign-on mechanism is used to perform the authentication. To provide an operation lock cooperation agent that performs authentication of an authentication target device in which an authentication required state is detected.

As a third aspect, the present disclosure includes a first-stage authentication target device authenticated using an authentication means, and one or more subsequent authentication target devices authenticated by single sign-on using the authentication result of the authentication means. authentication required state information indicating whether or not each authentication target device is in an authentication required state, which is a state requiring authentication, and the authentication result for each authentication target device and the operation lock information received from the operation lock cooperation agent corresponding to each of the plurality of authentication target devices. and a cooperation data transmission means for transmitting the cooperation data to the operation lock cooperation agent, wherein the operation lock information reception means receives the authentication When the target device is authenticated, operation lock information including an authentication result indicating authentication success is received from the operation lock cooperation agent, and the operation lock information receiving means detects the authentication required state in each authentication target device. When the authentication target device is in the authentication required state, the operation lock information including the authentication required state information indicating that the authentication target device is in the authentication required state is received from the operation lock cooperation agent, and the cooperation data transmission means receives the authentication required state. is transmitted to the operation lock cooperation agent, and the authentication means is prompted to perform authentication by the operation lock cooperation agent corresponding to the first-stage authentication target device, and authentication in the authentication means is performed. is performed normally, the single sign-on mechanism is used to authenticate the authentication target device for which the authentication required state has been detected.

As a fourth aspect, the present disclosure includes a first-stage authentication target device that is authenticated using authentication means, and one or more subsequent authentication target devices that are authenticated by single sign-on using the authentication result of the authentication means. authentication required state information indicating whether or not the authentication target device to be monitored is in an authentication required state in which authentication is required; generating operation lock information including the authentication result of the authentication target device, receiving the operation lock information about the plurality of authentication target devices, and combining the received operation lock information Sending data to an operation lock cooperation server that generates data, receiving the cooperation data from the operation lock cooperation server, and including operation lock information including authentication required state information indicating that the authentication is required in the cooperation data and when the authentication target device to be monitored is the authentication target device of the first stage, the authentication means is urged to perform authentication, and the authentication target device to be monitored is authenticated. In this case, operation lock information including the result of the authentication is generated, and indicates that the authentication target device to be monitored is in the authentication required state when the authentication required state is detected in the authentication target device to be monitored. After the operation lock information including the authentication required state information is generated and the cooperation data including the operation lock information including the authentication required state information indicating that the authentication is required is received, the authentication means performs normal authentication. provided is an operation lock cooperation method for performing authentication of an authentication target device in which the authentication required state is detected, using the single sign-on mechanism.

As a fifth aspect, the present disclosure includes a first-stage authentication target device authenticated using authentication means, and one or more subsequent authentication target devices authenticated by single sign-on using the authentication result of the authentication means. authentication required state information indicating whether or not the authentication target device to be monitored is in an authentication required state in which authentication is required; generating operation lock information including the result of authentication in the authentication target device, receiving the operation lock information for the plurality of authentication target devices, and combining the received operation lock information is sent to the operation lock cooperation server that generates the operation lock cooperation server, the cooperation data is received from the operation lock cooperation server, and the operation lock information including the authentication required state information indicating that the authentication is required is included in the cooperation data and when the authentication target device to be monitored is the authentication target device of the first stage, the program causes a computer to execute a process for prompting the authentication means to perform authentication, wherein the authentication target device to be monitored is is performed, operation lock information including the result of the authentication is generated, and when the authentication-required state is detected in the authentication-required device to be monitored, the authentication-required device to be monitored is the authentication-required device. After the operation lock information including the authentication required state information indicating the authentication required state is generated and the linked data including the operation lock information including the authentication required state information indicating the authentication required state is received, the Provided is a program for performing authentication of an authentication target device in which the authentication required state is detected by using the single sign-on mechanism when authentication is normally performed by the authentication means.

The system operation lock release system, operation lock cooperation agent, server, method, and program according to the present disclosure can improve user convenience while maintaining device security.

1 is a block diagram illustrating an exemplary system operating unlocking system of the present disclosure; FIG. 1 is a block diagram illustrating a system operation unlocking system and a single sign-on system according to one embodiment of the present disclosure; FIG. 4 is a block diagram showing a configuration example of an operation lock cooperation agent; FIG. The figure which shows an example of information terminal operation lock information. The figure which shows an example of VPN operation lock information. The figure which shows an example of virtual desktop terminal operation lock information. FIG. 5 is a diagram showing an example of business system operation lock information; 4 is a block diagram showing a configuration example of an operation lock cooperation server; FIG. FIG. 10 is a diagram showing a combination of information terminal operation lock information and VPN operation lock information; FIG. 10 is a diagram showing the combination of virtual desktop terminal operation lock information; FIG. 10 is a diagram showing coupling of business system operation lock information; 4 is a flowchart showing the operation procedure of the operation lock cooperation agent; 4 is a flowchart showing an operation procedure of the operation lock cooperation server 101; FIG. 5 is a diagram showing a schematic operation of updating operation lock information linkage data in each device or system; FIG. 5 is a diagram showing a schematic operation when a connection timeout occurs in the business system 500; FIG. 5 is a diagram showing a schematic operation when face authentication is performed in the information terminal 200;

An outline of the present disclosure will be described prior to description of the embodiments of the present disclosure. FIG. 1 illustrates an exemplary system-operated unlocking system of the present disclosure. The system operation lock release system 10 has a plurality of authentication target devices 20 , a plurality of detection means 30 , a plurality of operation lock cooperation agents 40 , and an operation lock cooperation server 50 . The authentication target device 20 includes an initial authentication target device having the authentication means 21 and one or more subsequent authentication target devices authenticated by single sign-on using the authentication result of the authentication means 21 .

The detection unit 30 is arranged corresponding to a plurality of authentication target devices 20 and detects whether or not each authentication target device 20 is in a state requiring authentication (authentication required state). The operation lock cooperation agent 40 generates authentication required state information indicating whether or not each authentication target device 20 is in an authentication required state, and operation lock information including the authentication result in each authentication target device 20 . When the authentication target device 20 is authenticated in single sign-on, the operation lock cooperation agent 40 generates operation lock information including an authentication result indicating successful authentication. When the detection unit 30 detects the authentication required state, the operation lock cooperation agent 40 generates operation lock information including authentication required state information indicating that the authentication target device 20 is in the authentication required state. The operation lock cooperation agent 40 transmits the operation lock information to the operation lock cooperation server 50 .

The operation lock cooperation server 50 receives operation lock information from the operation lock cooperation agent 40 . The operation lock cooperation server 50 generates cooperation data by combining the operation lock information received from the operation lock cooperation agents 40 corresponding to each of the plurality of authentication target devices 20 . The operation lock cooperation server 50 transmits the cooperation data to the operation lock cooperation agent 40 . When the operation lock cooperation server 50 receives the operation lock information including the authentication required state information indicating the authentication required state from any of the operation lock cooperation agents 40, the operation lock cooperation server 50 sends the cooperation data including the operation lock information to the operation lock cooperation agent 40. Send to

The operation lock cooperation agent 40 corresponding to the authentication target device 20 in the first stage prompts the authentication means 21 to perform authentication when the cooperation data including the operation lock information including the authentication required state information indicating the authentication required state is received. When the authentication by the authentication means 21 is normally performed, the authentication target device 20 for which the authentication required state is detected is authenticated using the single sign-on mechanism.

Here, for example, if the authentication target device 20 has been in a non-operating state and/or a connection timeout has occurred, the operation is locked and re-authentication is required. In this embodiment, when the device to be authenticated 20 in the latter stage of the device to be authenticated in the first stage authenticated by the authentication means 21 requires authentication, the authentication of the device to be authenticated is performed based on the authentication result of the authentication means 21. can be implemented using By doing so, the user can authenticate the authentication target device 20 by the authentication in the authentication means 21 without knowing the password or the like used for authentication of the authentication target device 20 in the subsequent stage. Therefore, the user can safely use the device to be authenticated in the latter stage, and convenience for the user can be improved while maintaining security.

Hereinafter, embodiments of the present disclosure will be described in detail with reference to the drawings. FIG. 2 illustrates a system operation unlock system and single sign-on system according to one embodiment of the present disclosure. System Operation The unlocking system works in conjunction with the single sign-on system. The system operation lock release system 100 has an operation lock cooperation server 101 and a plurality of devices or systems each including an operation lock cooperation agent. In the example of FIG. 2, the information terminal 200, the operation lock cooperation agent device 300, the virtual desktop terminal 400, and the business system 500 are shown as a plurality of devices or systems including the operation lock cooperation agent.

In the information terminal 200, the operation lock cooperation agent device 300, the virtual desktop terminal 400, and the business system 500, the operation lock cooperation agent monitors devices or systems that require authentication when used. The operation lock cooperation server 101 and the operation lock cooperation agents of each device or system are communicably connected. The operation lock cooperation server 101 corresponds to the operation lock cooperation server 50 in FIG. The information terminal 200, the virtual desktop terminal 400, the business system 500, and the VPN device 600 correspond to the authentication target device 20 in FIG.

The information terminal 200 includes a face authentication system 201, a VPN client 202, an operation lock cooperation agent 203, a MAC (Media Access Control) address acquisition unit 204, an IP (Internet Protocol) address acquisition unit 205, an operation lock detection unit 206, and a local storage. 207. A face authentication system 201 corresponds to the authentication means 21 in FIG. The operation lock cooperation agent 203 corresponds to the operation lock cooperation agent 40 in FIG. The operation lock detector 206 corresponds to the detector 30 in FIG.

VPN device 600 has VPN authentication unit 601 . The operation lock cooperation agent device 300 monitors the VPN device 600 . The operation lock cooperation agent device 300 connects to, for example, a mirror port of the VPN device 600 and monitors the VPN device 600 . The operation lock cooperation agent device 300 has an operation lock cooperation agent 301 , an IP address acquisition unit 302 , a timeout detection unit 303 and a local storage 304 . The operation lock cooperation agent 301 corresponds to the operation lock cooperation agent 40 in FIG. A timeout detection unit 303 corresponds to the detection unit 30 in FIG. Note that the operation lock cooperation agent device 300 may be a part of the VPN device 600 .

The virtual desktop terminal 400 has a login authentication unit 401 , a business system client 402 , an operation lock cooperation agent 403 , an IP address acquisition unit 404 , an operation lock detection unit 405 and a local storage 406 . An operation lock cooperation agent 403 corresponds to the operation lock cooperation agent 40 in FIG. An operation lock detector 405 corresponds to the detector 30 in FIG. The business system 500 has a login authentication unit 501 , an operation lock cooperation agent 502 , an IP address acquisition unit 503 , a timeout detection unit 504 and a local storage 505 . An operation lock cooperation agent 502 corresponds to the operation lock cooperation agent 40 in FIG. A timeout detection unit 504 corresponds to the detection unit 30 in FIG.

In the system operation lock release system 100, single sign-on is configured as follows, for example. A face authentication system 201 of the information terminal 200 uses a camera 208 connected to the information terminal 200 or built in the information terminal 200 to perform face authentication of the user. A user logs in to the information terminal 200 by face authentication using the face authentication system 201 . After the user logs in, the information terminal 200 activates the VPN client (software) 202 . VPN client 202 stores a user ID and password for VPN connection. The VPN client 202 transmits to the VPN device 600 the user ID and password corresponding to the user who has logged into the information terminal 200 .

A VPN authentication unit 601 of the VPN device 600 performs authentication using the user ID and password transmitted from the VPN client 202 . When the login to the VPN device 600 is normally performed, the VPN client 202 converts the communication between the information terminal 200 and the VPN device 600 into a VPN.

After that, the user activates virtual desktop terminal connection software (not shown) and connects from the information terminal 200 to the virtual desktop terminal 400 . The virtual desktop terminal connection software stores a user ID and password for virtual desktop connection. The virtual desktop terminal connection software transmits to the virtual desktop terminal 400 the user ID and password corresponding to the user who logged into the VPN device 600 . The login authentication unit 401 of the virtual desktop terminal 400 performs authentication using the user ID and password transmitted from the virtual desktop terminal connection software.

After logging in to the virtual desktop terminal 400, the user connects to the business system 500 from the business system client 402 on the virtual desktop terminal 400 and starts business. The virtual desktop terminal 400 stores user IDs and passwords for using the business system 500 . The virtual desktop terminal 400 transmits the user ID and password corresponding to the logged-in user to the business system 500 . The login authentication unit 501 of the business system 500 performs authentication using the user ID and password received from the virtual desktop terminal 400 . As the face authentication system 201 and the VPN client 202 in the information terminal 200 and the VPN authentication unit 601 in the VPN device 600, existing ones can be used. Also, the existing ones can be used for the login authentication unit 401 and the business system client 402 in the virtual desktop terminal, and the login authentication unit 501 in the business system 500 .

Note that the single sign-on configuration described above is merely an example, and the present disclosure can also be used in single sign-on configurations other than the above. For example, a single sign-on configuration may have an ID management server that holds user IDs and passwords for logging into each device or system. When a single sign-on target device or system is accessed, the ID management server supplies a user ID and password to the target device or system to realize automatic login. The present disclosure can also be applied to a configuration in which another ID management server is used.

FIG. 3 shows a configuration example of an operation lock cooperation agent. The operation lock cooperation agent 150 has operation lock information generation means 151 , operation lock information transmission means 152 , cooperation data reception means 153 , and authentication request means 154 . The operation lock cooperation agent 150 is used as the operation lock cooperation agents 203, 301, 403, and 502 in FIG.

The operation lock information generating means 151 generates authentication required state information indicating whether or not the device or system to be monitored is in an authentication required state, and operation lock information including the result of authentication in the device or system to be monitored. The operation lock information generating means 151 generates operation lock information including the result of the authentication when the authentication is performed. The operation lock information generating means 151 generates operation lock information including authentication required state information indicating that the authentication target device to be monitored is in the authentication required state when the authentication target device to be monitored is in the authentication required state. do. The operation lock information transmitting means 152 transmits the operation lock information to the operation lock cooperation server 101 (see FIG. 2).

The operation lock cooperation server 101 receives operation lock information about a plurality of devices or systems to be authenticated by single sign-on, and generates cooperation data (operation lock information cooperation data) by combining the received operation lock information. The cooperation data receiving unit 153 receives cooperation data from the operation lock cooperation server 101 . The authentication requesting means 154 sends the face authentication system 201 to the face authentication system 201 when the operation lock information including the authentication required state information indicating that the authentication required state is included in the cooperation data and when the monitoring target device is the information terminal 200 . Encourage implementation of face recognition. After the authentication required state is detected in any of the monitored authentication target devices, if the face authentication is performed normally, the single sign-on mechanism is used to authenticate the authentication target device that detected the authentication required state. is carried out.

The operation of each device to be authenticated will be described below. In information terminal 200 , operation lock detection unit 206 detects user login (execution of authentication) to information terminal 200 . The operation lock detection unit 206 notifies the operation lock cooperation agent 203 of the user login. MAC address acquisition unit 204 acquires the MAC address of information terminal 200 . IP address acquisition unit 205 acquires the IP address of information terminal 200 . The operation lock cooperation agent 203 acquires the MAC address from the MAC address acquisition unit 204 and the IP address from the IP address acquisition unit 205 . The operation lock cooperation agent 203 generates operation lock information (information terminal operation lock information) related to the information terminal including the MAC address and IP address of the information terminal 200 .

FIG. 4 shows an example of information terminal operation lock information. The information terminal operation lock information includes the MAC address of the information terminal, the IP address of the information terminal, the login user ID, the authentication result, the operation lock state, the update time, the issue ID, and the chain order. The operation lock cooperation agent stores the MAC address obtained from the MAC address obtaining unit 204 in "MAC address". Further, the operation lock cooperation agent 203 stores the IP address obtained from the IP address obtaining unit 205 in "IP address".

The operation lock cooperation agent 203 stores the ID of the user who has logged in to the information terminal 200 in the "login user ID". The operation lock cooperation agent 203 can acquire the user's ID from the face authentication system 201, for example. The operation lock cooperation agent 203 stores the result of face authentication login in "authentication result". When the user is able to log in to the information terminal 200, the operation lock cooperation agent 203 stores a value indicating "success" in the "authentication result".

The operation lock cooperation agent 203 stores a value indicating whether or not the information terminal 200 is in the operation lock state in the “operation lock state”. The operation lock cooperation agent 203 stores the time when the information terminal operation lock information was generated or updated in the "update time". The operation lock cooperation agent 203 stores an ID for identifying the information terminal operation lock information in "issuance ID". The operation lock cooperation agent 203 generates, for example, a UUID (Universally Unique Identifier) for the information terminal operation lock information, and stores the value in "issuance ID". The operation lock cooperation agent 203 sets “chain order” to a null value. "Chain order" stores a value generated by the operation lock cooperation server 101 as described later.

The operation lock cooperation agent 203 transmits the generated operation lock information to the operation lock cooperation server 101 . The operation lock cooperation agent 203 also stores the generated operation lock information in the local storage 207 .

The information terminal 200 shifts to the operation lock state when the non-operation state continues for a predetermined time. When the information terminal 200 shifts to the operation lock state, the user cannot use the information terminal 200 without re-authentication. The operation lock detection unit 206 detects the operation lock state when the information terminal 200 shifts to the operation lock state. The operation lock cooperation agent 203 generates operation lock information in the same manner as described above. At this time, the operation lock cooperation agent 203 stores a value indicating the operation lock state in the “operation lock state”. Also, the operation lock cooperation agent 203 updates the “update time”. The operation lock cooperation agent 203 transmits the generated operation lock information to the operation lock cooperation server 101 .

After logging in to the information terminal 200 , the user activates the VPN client 202 on the information terminal 200 to VPN communication between the information terminal 200 and the VPN device 600 . The VPN client 202 transmits the user ID and password to the VPN authentication unit 601 and logs into the VPN device 600 . The timeout detection unit 303 of the operation lock cooperation agent device 300 detects user login (execution of authentication) to the VPN device 600 . When the timeout detection unit 303 detects user login, the timeout detection unit 303 notifies the operation lock cooperation agent 301 to that effect.

IP address acquisition unit 302 acquires the IP address assigned to information terminal 200 by VPN device 600 and the IP address of information terminal 200 . Operation lock cooperation agent 301 acquires the IP address assigned to information terminal 200 and the IP address of information terminal 200 from IP address acquisition section 302 . The operation lock cooperation agent 301 generates VPN operation lock information (VPN operation lock information) including the IP address assigned to the information terminal 200 and the IP address of the information terminal 200 .

FIG. 5 shows an example of VPN operation lock information. The VPN operation lock information includes connection source MAC address, connection source IP address, VPN issue IP address, authentication result, timeout status, update time, issue ID, and chain order. The operation lock cooperation agent 301 stores the IP address obtained from the IP address obtaining unit 302 in the “connection source IP address” and the “VPN issued IP address”.

The operation lock cooperation agent 301 stores the result of VPN connection establishment in "authentication result". The operation lock cooperation agent 301 stores a value indicating "success" in the "authentication result" when the VPN authentication unit 601 performs the authentication normally. The operation lock cooperation agent 301 stores a value indicating whether or not the established VPN connection has timed out in "timeout status". The operation lock cooperation agent 301 stores the time when the VPN operation lock was generated or updated in the "update time".

The operation lock cooperation agent 301 stores an ID for identifying the VPN operation lock information in "Issue ID". The operation lock cooperation agent 301 generates, for example, a UUID for the VPN operation lock information, and stores the value in "issuance ID". The operation lock cooperation agent 301 sets "chain order" to a null value. The operation lock cooperation agent 301 transmits the generated VPN operation lock information to the operation lock cooperation server 101 . The operation lock cooperation agent 301 also stores the generated VPN operation lock information in the local storage 304 .

The VPN device 600 shifts to a timeout state when there is no connection from the information terminal 200 for a predetermined period of time. When the VPN device 600 transitions to the timeout state, the user cannot perform VPN communication without re-authentication. A timeout detection unit 303 detects a connection timeout when the VPN device 600 transitions to a timeout state. The operation lock cooperation agent 301 updates the operation lock information stored in the local storage 304 . At this time, the operation lock cooperation agent 301 stores a value indicating a timeout state in "timeout state". Also, the operation lock cooperation agent 301 updates the “update time”. The operation lock cooperation agent 301 transmits the generated operation lock information to the operation lock cooperation server 101 .

The user activates the virtual desktop terminal connection software on the information terminal 200 and logs into the virtual desktop terminal 400 from the information terminal 200 . The virtual desktop terminal connection software sends the user ID and password to the login authentication unit 401 to log in to the virtual desktop terminal 400 . The operation lock detection unit 405 of the virtual desktop terminal 400 detects user login to the virtual desktop terminal 400 . Upon detecting user login (execution of authentication), the operation lock detection unit 405 notifies the operation lock cooperation agent 403 to that effect.

The IP address acquisition unit 404 acquires the local IP address of the virtual desktop terminal 400 and the IP address of the connection source to the virtual desktop terminal 400 . The operation lock cooperation agent 403 acquires the local IP address and the connection source IP address from the IP address acquisition unit 404 . The operation lock cooperation agent 403 generates operation lock information (virtual desktop operation lock information) regarding the virtual desktop including the local IP address and the connection source IP address.

FIG. 6 shows an example of virtual desktop terminal operation lock information. The virtual desktop operation lock information includes connection source IP address, local IP address, login user name, authentication result, operation lock state, update time, issue ID, and chain order. The operation lock cooperation agent 403 stores the IP address obtained from the IP address obtaining unit 404 in the "connection source IP address" and the "local IP address".

The operation lock cooperation agent 403 stores the user ID of the user who has logged in to the virtual desktop terminal 400 in the "login user ID". The operation lock cooperation agent 403 stores the result of logging into the virtual desktop terminal 400 in "authentication result". The operation lock cooperation agent 403 stores a value indicating "success" in the "authentication result" when the login authentication unit 401 performs the authentication normally. The operation lock cooperation agent 403 stores a value indicating whether or not the virtual desktop terminal 400 is in the operation lock state in the “operation lock state”. The operation lock cooperation agent 403 stores the time when the virtual desktop terminal operation lock information was generated or updated in the “update time”.

The operation lock cooperation agent 403 stores an ID for identifying the virtual desktop terminal operation lock information in "issuance ID". The operation lock cooperation agent 403 generates, for example, a UUID for the virtual desktop terminal operation lock information, and stores the value in "issuance ID". The operation lock cooperation agent 403 sets "chain order" to a null value. The operation lock cooperation agent 403 transmits the generated virtual desktop terminal operation lock information to the operation lock cooperation server 101 . The operation lock cooperation agent 403 also stores the generated virtual desktop terminal operation lock information in the local storage 406 .

The virtual desktop terminal 400 transitions to the operation lock state when the state of no operation continues for a predetermined time. When the virtual desktop terminal 400 shifts to the operation lock state, the user cannot use the virtual desktop terminal 400 without performing authentication again. The operation lock detection unit 405 detects the operation lock state when the virtual desktop terminal 400 shifts to the operation lock state. The operation lock cooperation agent 403 updates the operation lock information stored in the local storage 406 . At this time, the operation lock cooperation agent 403 stores a value indicating the operation lock state in the “operation lock state”. Also, the operation lock cooperation agent 403 updates the “update time”. The operation lock cooperation agent 403 transmits the generated operation lock information to the operation lock cooperation server 101 .

The user activates the business system client 402 on the virtual desktop terminal 400 and logs into the business system 500 from the virtual desktop terminal 400 . The virtual desktop terminal 400 transmits the user ID and password to the login authentication unit 501 and logs into the business system 500 . The timeout detection unit 504 of the business system 500 detects user login (execution of authentication) to the business system 500 and notifies the operation lock cooperation agent 502 .

The IP address acquisition unit 503 acquires the IP address of the connection source connecting to the business system 500 (connection source IP address). The operation lock cooperation agent 502 acquires the connection source IP address from the IP address acquisition unit 503 . The operation lock cooperation agent 502 generates operation lock information (business system operation lock information) related to the business system including the connection source IP address.

FIG. 7 shows an example of business system operation lock information. The business system operation lock information includes connection source IP address, authentication result, timeout status, update time, issue ID, and chain order. The operation lock cooperation agent 502 stores the IP address obtained from the IP address obtaining unit 503 in the "connection source IP address".

The operation lock cooperation agent 502 stores the log-in result to the business system 500 in "authentication result". The operation lock cooperation agent 502 stores a value indicating "success" in the "authentication result" when the login authentication unit 501 performs the authentication normally. The operation lock cooperation agent 502 stores a value indicating whether or not the business system is in a timeout state in "timeout state". The operation lock cooperation agent 502 stores the time when the business system operation lock information was generated or updated in the "update time".

The operation lock cooperation agent 502 stores an ID for identifying the business system operation lock information in "Issue ID". The operation lock cooperation agent 502 generates, for example, a UUID for the business system operation lock information, and stores the value in "issuance ID". The operation lock cooperation agent 502 sets "chain order" to a null value. The operation lock cooperation agent 502 transmits the generated business system operation lock information to the operation lock cooperation server 101 . The operation lock cooperation agent 502 also stores the generated business system operation lock information in the local storage 505 .

The business system 500 transitions to a timeout state when there is no connection from the virtual desktop terminal 400 for a predetermined period of time. When the business system 500 has entered a timeout state, the user cannot use the business system 500 without performing authentication again. A timeout detection unit 504 detects a connection timeout when the business system 500 transitions to a timeout state. The operation lock cooperation agent 502 updates the operation lock information stored in the local storage 505 . At this time, the operation lock cooperation agent 502 stores a value indicating a timeout state in "timeout state". Also, the operation lock cooperation agent 502 updates the “update time”. The operation lock cooperation agent 502 transmits the generated operation lock information to the operation lock cooperation server 101 .

The operation lock cooperation server 101 receives operation lock information from each of the information terminal 200 , the operation lock cooperation agent device 300 , the virtual desktop terminal 400 and the business system 500 . The operation lock cooperation server 101 generates operation lock information cooperation data by combining operation lock information. The operation lock cooperation server 101 stores the operation lock information cooperation data in the operation lock cooperation database 102 . The form of connection between the operation lock cooperation server 101 and the operation lock cooperation database 102 is not particularly limited. The operation lock cooperation server 101 and the operation lock cooperation database 102 may be directly connected by hardware, or may be connected via a network.

FIG. 8 shows a configuration example of the operation lock cooperation server 101. As shown in FIG. The operation lock cooperation server 101 has operation lock information reception means 111 , cooperation data generation means 112 , and cooperation data transmission means 113 . The operation lock information receiving unit 111 receives operation lock information from the operation lock cooperation agents 203 , 301 , 403 and 502 . The linkage data generation unit 112 combines the operation lock information received by the operation lock information reception unit 111 in, for example, a chain structure to generate operation lock information linkage data. The cooperation data transmission means 113 transmits the operation lock information cooperation data to the operation lock information cooperation agent which is the transmission source of the operation lock information included therein.

In linking the operation lock information, the linkage data generating means 112 determines whether at least one of the IP address and the MAC address included in the received operation lock information matches the address included in the already received operation lock information. do. When the linkage data generating means 112 determines that they do not match, it stores the operation lock information in the operation lock linkage database 102 as new operation lock information linkage data. At this time, the linkage data generation unit 112 stores "1" in "chain order" of the operation lock information linkage data. Linked data transmission unit 113 transmits operation lock information linked data in which "1" is stored in "chain order" to the transmission source of the linked data of operation lock information.

When determining that the addresses match, the linked data generation unit 112 combines the received operation lock information and the received operation lock information (the linked data). At this time, the linked data generating means 112 sets the value of the "chain order" to the value next to the maximum value of the "chain order" in the received operation lock information. The linkage data generating means 112 stores the generated operation lock information linkage data in the operation lock linkage database 102 . The cooperation data transmission means 113 transmits the operation lock information cooperation data in which several pieces of operation lock information are combined to each of the operation lock cooperation agents that have sent the operation lock information contained therein.

For example, the operation lock cooperation server 101 receives information terminal operation lock information (see FIG. 4) from the operation lock cooperation agent 203 of the information terminal 200 . The operation lock cooperation server 101 searches the operation lock cooperation database 102 to check whether there is any operation lock information including an address that matches the MAC address and IP address included in the information terminal operation lock information. If there is no hit as a result of the search, the operation lock cooperation server 101 stores "1" in the "chain order" of the information terminal operation lock information. The operation lock cooperation server 101 stores information terminal operation lock information in which "1" is stored in "chain order" in the operation lock cooperation database 102 as operation lock information cooperation data. Further, the operation lock cooperation server 101 transmits to the information terminal 200 the operation lock information cooperation data in which “1” is stored in “chain order”.

The operation lock cooperation agent 203 of the information terminal 200 receives the operation lock information cooperation data from the operation lock cooperation server 101 . When the operation lock information cooperation data is received, the operation lock information cooperation agent 203 searches the local storage 207 to find operation lock information (or its cooperation data). If operation lock information with the same issue ID is stored in the local storage 207, the operation lock cooperation agent 203 overwrites the data in the local storage 207 with the received data.

The operation lock cooperation server 101 receives VPN operation lock information (see FIG. 5) from the operation lock cooperation agent 301 of the operation lock cooperation agent device 300 . The operation lock cooperation server 101 searches the operation lock cooperation database 102 to check whether there is operation lock information cooperation data including an address that matches the MAC address and IP address contained in the VPN operation lock information. As a result of the search, the operation lock cooperation server 101 determines that the address in the operation lock information cooperation data matches the address in the VPN operation lock information cooperation data. In this case, the operation lock linking server 101 links the stored operation lock information linking data with the VPN operation lock information linking data.

FIG. 9 shows the combination of information terminal operation lock information and VPN operation lock information. The operation lock cooperation server 101 compares the "MAC address" in the information terminal operation lock information with the "connection source MAC address" in the VPN operation lock information. The operation lock cooperation server 101 also compares the "IP address" in the information terminal operation lock information with the "connection source IP address" in the VPN operation lock information. When the addresses match, the operation lock cooperation server 101 combines the information terminal operation lock information and the VPN operation lock information. Further, the operation lock cooperation server 101 stores the value "2" next to the "chain order" of the information terminal operation lock information in the "chain order" of the VPN operation lock information.

The operation lock cooperation server 101 stores the operation lock information cooperation data combined with the VPN operation lock information in the operation lock cooperation database 102 . At this time, the operation lock information linkage server 101 stores the operation lock information linkage data combined with the VPN operation lock information by updating the already stored operation lock information linkage data. The operation lock cooperation server 101 transmits operation lock information cooperation data to each of the information terminal 200 and the operation lock cooperation agent device 300 .

The operation lock cooperation agent 301 of the operation lock cooperation agent device 300 receives the operation lock information cooperation data from the operation lock cooperation server 101 . When the operation lock information cooperation data is received, the operation lock information cooperation agent 301 searches the local storage 304 to find operation lock information (or its cooperation data). If the operation lock information cooperation data with the same issue ID is stored in the local storage 304, the operation lock cooperation agent 301 overwrites the data in the local storage 304 with the received data.

Similarly, the operation lock cooperation agent 203 of the information terminal 200 also searches the local storage 207 to check whether there is operation lock information cooperation data including the same issue ID as the issue ID included in the received operation lock information cooperation data. If there is operation lock information linkage data containing the same issue ID, the operation lock information linkage data on the local storage 207 is overwritten by the operation lock information linkage data newly received from the operation lock linkage server 101. do.

The operation lock cooperation server 101 receives virtual desktop terminal operation lock information (see FIG. 6) from the operation lock cooperation agent 403 of the virtual desktop terminal 400 . The operation lock cooperation server 101 searches the operation lock cooperation database 102 to check whether there is operation lock information cooperation data including an address matching the IP address included in the virtual desktop terminal operation lock information. As a result of the search, the operation lock cooperation server 101 determines that the address in the operation lock information cooperation data matches the address in the virtual desktop terminal operation lock information. In this case, the operation lock cooperation server 101 further combines the virtual desktop terminal operation lock information with the operation lock information cooperation data in which the information terminal operation lock information and the VPN operation lock information are combined.

FIG. 10 shows the combination of virtual desktop terminal operation lock information. The operation lock cooperation server 101 compares the "VPN issued IP address" in the VPN operation lock information with the "connection source IP address" in the virtual desktop terminal operation lock information. When the addresses match, the operation lock cooperation server 101 further combines the virtual desktop terminal operation lock information with the operation lock information cooperation data. Further, the operation lock cooperation server 101 stores the value "3" next to the "chain order" of the VPN operation lock information cooperation data in the "chain order" of the virtual desktop terminal operation lock information cooperation data.

After combining the VPN operation lock information, the operation lock cooperation server 101 stores the operation lock information cooperation data in the operation lock cooperation database 102 . At this time, the operation lock information linking server 101 stores the operation lock information linking data combined with the VPN operation lock information by updating the already stored operation lock information linking data. The operation lock cooperation server 101 transmits operation lock information cooperation data to each of the information terminal 200 , the operation lock cooperation agent device 300 , and the virtual desktop terminal 400 .

The operation lock cooperation agent 403 of the virtual desktop terminal 400 receives the operation lock information cooperation data from the operation lock cooperation server 101 . When the operation lock information cooperation data is received, the operation lock cooperation agent 403 searches the local storage 406 to find the operation lock information (that cooperation data ). If operation lock information with the same issue ID is stored in the local storage 406, the operation lock cooperation agent 403 overwrites the data in the local storage 406 with the received data.

The operation lock cooperation agent 203 of the information terminal 200 and the operation lock cooperation agent 301 of the operation lock cooperation agent device 300 similarly search the local storages 207 and 304, respectively. If there is operation lock information linkage data with the same issue ID, the operation lock information linkage agent 203 overwrites the operation lock information linkage data on the local storage 207 with the operation lock information linkage data newly received from the operation lock linkage server 101. . If there is operation lock information linkage data with the same issue ID, the operation lock information linkage agent 301 replaces the operation lock information linkage data on the local storage 304 with the operation lock information linkage data newly received from the operation lock linkage server 101. Overwrite.

The operation lock cooperation server 101 receives business system operation lock information (see FIG. 7) from the operation lock cooperation agent 502 of the business system 500 . The operation lock cooperation server 101 searches the operation lock cooperation database 102 to check whether there is operation lock information cooperation data including an address matching the IP address included in the virtual desktop terminal operation lock information. As a result of the search, the operation lock cooperation server 101 determines that the address in the operation lock information cooperation data matches the address in the business system operation lock information. In this case, the operation lock linkage server 101 further combines the business system operation lock information with the operation lock information linkage data in which the information terminal operation lock information, the VPN operation lock information, and the virtual desktop terminal operation lock information are combined.

FIG. 11 shows the combination of business system operation lock information. The operation lock cooperation server 101 compares the "local IP address" in the virtual desktop terminal operation lock information with the "connection source IP address" in the business system operation lock information. If the addresses match, the operation lock linking server 101 further links the business system operation lock information to the operation lock information linking data. Further, the operation lock cooperation server 101 stores the value "4" next to the "chain order" of the virtual desktop terminal operation lock information in the "chain order" of the business system operation lock information.

The operation lock cooperation server 101 stores the operation lock information cooperation data in the operation lock cooperation database 102 . At this time, the operation lock information linking server 101 stores the operation lock information linking data combined with the business system operation lock information by updating the already stored operation lock information linking data. The operation lock cooperation server 101 transmits operation lock information cooperation data to each of the information terminal 200, the operation lock cooperation agent device 300, the virtual desktop terminal 400, and the business system 500. FIG.

The operation lock cooperation agent 502 of the business system 500 receives the operation lock information cooperation data from the operation lock cooperation server 101 . When the operation lock information cooperation data is received, the operation lock information cooperation agent 502 searches the local storage 505 to find operation lock information (or its cooperation data). When the operation lock information cooperation data with the same issue ID is stored in the local storage 505, the operation lock cooperation agent 502 overwrites the data in the local storage 505 with the received data.

The operation lock cooperation agent 203 of the information terminal 200, the operation lock cooperation agent 301 of the operation lock cooperation agent device 300, and the operation lock cooperation agent 403 of the virtual desktop terminal 400 similarly search the local storages 207, 304, and 406, respectively. do. If there is operation lock information cooperation data with the same issue ID, the operation lock cooperation agents 203 , 301 , and 403 copy the operation lock information cooperation data on the local storages 207 , 304 , and 406 from the operation lock cooperation server 101 . Overwrite with the received operation lock information linkage data. Through the above operations, the operation lock information linkage shown in FIG. data is stored.

Next, the operating procedure of the operation lock cooperation agent will be described. FIG. 12 shows the operation procedure of the operation lock cooperation agent. Here, the operating procedure of the operation lock cooperation agent 403 will be described. However, the operation procedures of the operation lock cooperation agents 203, 301, and 502 may be the same as the operation procedure of the operation lock cooperation agent 403, except that the acquired information is partially changed. The operation lock cooperation agent 403 waits for an event to occur (step A1). The operation lock cooperation agent 403 waits for detection of authentication execution by the operation lock detection unit 405 or for cooperation data transmitted from the operation lock cooperation server 101 .

The operation lock cooperation agent 403 determines whether or not the operation lock detection unit 405 has detected execution of authentication (step A2). When the operation lock cooperation agent 403 determines that the execution of authentication has been detected, it acquires address information related to the virtual desktop terminal 400 (step A3). The operation lock cooperation agent 403 acquires the connection source IP address and the local IP address from the IP address acquisition unit 404 in step A3. If it is determined in step A2 that execution of authentication has not been detected, the operation lock cooperation agent 403 returns to step A1 and waits for the occurrence of the next event.

The operation lock cooperation agent 403 generates operation lock information and transmits the generated operation lock information to the operation lock cooperation server 101 (step A4). In step A4, the operation lock cooperation agent 403 stores the connection source IP address acquired from the IP address acquisition unit 404 in the "connection source IP address" of the operation lock information (see FIG. 6). Further, the operation lock cooperation agent 403 stores the local IP address acquired from the IP address acquiring unit 404 in the "local IP address". The operation lock cooperation agent 403 stores the ID of the user who has logged in to the virtual desktop terminal 400 in the "login user ID".

The operation lock cooperation agent 403 stores the authentication result (login result) of the login authentication unit 501 in "authentication result". When the user is able to log in to the virtual desktop terminal 400, the operation lock cooperation agent 403 stores a value indicating "success" in the "authentication result". If the login fails, the operation lock cooperation agent 403 stores a value indicating "failure" in "authentication result".

The operation lock cooperation agent 403 stores a value indicating whether or not the virtual desktop terminal 400 is in the operation lock state in the “operation lock state”. If the virtual desktop terminal 400 is not in the operation lock state, the operation lock cooperation agent 403 stores a value indicating this in the "operation lock state". When the operation lock detection unit 405 detects that the virtual desktop terminal 400 has entered the operation lock state, the operation lock cooperation agent 403 stores a value indicating the operation lock state in the “operation lock state”.

The operation lock cooperation agent 403 stores the time when the operation lock information was generated or updated in the "update time". The operation lock cooperation agent 403 issues an ID for the operation lock information and stores the ID in "issued ID". The operation lock cooperation agent 403 sets "chain order" to a null value. The operation lock cooperation agent 403 transmits the generated operation lock information to the operation lock cooperation server 101 . After generating the operation lock information, the operation lock cooperation agent 403 stores the operation lock information in the local storage 406 (step A5). After that, the process returns to step A1, and the operation lock cooperation agent 403 waits for the occurrence of the next event.

The operation lock cooperation agent 403 determines whether or not the operation lock information cooperation data has been received from the operation lock cooperation server 101 (step A6). The operation lock cooperation agent 403 receives the operation lock information cooperation data shown in FIG. 10 or 11, for example, in step A6. When the operation lock cooperation agent 403 determines that it has received the operation lock information cooperation data, it stores the received operation lock cooperation data in the local storage 406 (step A7). If the operation lock cooperation agent 403 determines in step A6 that the operation lock information cooperation data has not been received, it returns to step A1 and waits for the occurrence of the next event.

The operation lock cooperation agent 403 confirms whether operation lock information having the same ID as the issue ID existing in the received operation lock information cooperation data exists in the local storage 406 (step A8). The operation lock cooperation agent 403 determines whether operation lock information having the same ID exists (step A9). When the operation lock cooperation agent 403 determines that the operation lock information having the same ID exists, it compares the operation lock information with the received operation lock information cooperation data (step A10). If the operation lock cooperation agent 403 determines in step A9 that there is no operation lock information with the same ID, the operation lock cooperation agent 403 returns to step A1 and waits for the occurrence of the next event.

The operation lock cooperation agent 403 checks whether or not a connection timeout has occurred in the business system 500 having a chain order immediately behind the virtual desktop terminal 400 to be monitored (step A11). At step A11, the operation lock cooperation agent 403 determines, for example, whether the "timeout state" in the business system operation lock information has changed to a value indicating connection timeout. If the operation lock cooperation agent 403 determines in step A11 that a connection timeout has not occurred in the business system 500, it returns to step A1 and waits for the occurrence of the next event.

When the operation lock cooperation agent 403 determines in step A11 that a connection timeout has occurred in the business system 500, it determines whether or not face authentication has been newly performed and authenticated (step A12). In step A11, the operation lock cooperation agent 403 refers to the operation lock information with the youngest chain order, that is, the information terminal operation lock information in the operation lock information cooperation data. The operation lock cooperation agent 403 determines whether or not the “update time” of the information terminal operation lock information is new and the “authentication result” is a value indicating “success”. If the “update time” of the information terminal operation lock information is later than the “update time” of the business system operation lock information, face authentication is performed after connection timeout occurs in the business system 500 . When the update time is new and the authentication result is "success", the operation lock cooperation agent 403 causes the single sign-on mechanism of the virtual desktop terminal 400, which is the monitoring target device, to perform authentication of the business system 500, which is the subsequent device. Prompt (step A13). If the update time is before the connection timeout of the business system 500 or if the authentication result is not a value indicating "success", the operation lock cooperation agent 403 returns to step A1 and waits for the occurrence of the next event. .

Next, an operation procedure in the operation lock cooperation server will be explained. FIG. 13 shows the operation procedure of the operation lock cooperation server 101. As shown in FIG. The operation lock cooperation server 101 waits for a notification from the operation lock cooperation agent 203, 301, 403, or 502 (step B1). The operation lock cooperation server 101 determines whether or not there is a notification from the operation lock cooperation agent (step B2). If there is no notification from the operation lock cooperation agent, the operation lock cooperation server 101 returns to step B1 and waits for the notification.

The operation lock cooperation server 101 receives the operation lock information from the operation lock cooperation agent (step B3). The operation lock cooperation server 101 searches the operation lock cooperation database 102 for operation lock cooperation information having the same address information as the address information contained in the received operation lock information (step B4). The operation lock cooperation server 101 determines whether or not there is corresponding operation lock information as a result of the search (step B5). When the operation lock cooperation server 101 determines that the corresponding information does not exist, it stores the received operation lock information in the operation lock cooperation database 102 as new operation lock information cooperation data (step B6). At this time, the operation lock cooperation server 101 stores "1" in "chain order" of the operation lock information.

When the operation lock cooperation server 101 determines that the corresponding information exists in step B4, it combines the operation lock information received in step B3 with the stored operation lock information cooperation data (step B7). At this time, the operation lock cooperation server 101 adds the maximum value of the "chain order" of the operation lock information included in the stored operation lock information cooperation data to the "chain order" of the operation lock information received in step B3. store the value. The operation lock cooperation server 101 stores the operation lock information linked data obtained by combining the operation lock information received in step B3 in the operation lock cooperation database 102 (step B8).

The operation lock cooperation server 101 transmits the operation lock information cooperation data stored in the operation lock cooperation database 102 to the operation lock cooperation agent that sent the operation lock information (step B9). In step B9, the operation lock cooperation server 101 identifies the operation lock cooperation agent that has transmitted the operation lock information included in the operation lock information cooperation data. For example, consider a case where the operation lock information linkage data is data obtained by combining information terminal operation lock information, VPN operation lock information, and virtual desktop terminal operation lock information. In this case, the operation lock cooperation server 101 identifies the operation lock cooperation agents 203, 301, and 403 as the operation lock cooperation agents that have sent the operation lock information. The operation lock cooperation server 101 transmits the operation lock information cooperation data to the specified operation lock cooperation agent.

FIG. 14 shows a schematic operation of updating operation lock information linkage data in each device or system. The operation lock cooperation server 101 waits for updating of the operation lock cooperation database 102 (step S11). In other words, the operation lock cooperation server 101 waits for transmission of operation lock information from the operation lock cooperation agent. Upon receiving the operation lock information, the operation lock cooperation server 101 stores the operation lock information cooperation data in the operation lock cooperation database 102 and updates the database (step S12). After updating the operation lock cooperation database 102, the operation lock cooperation server 101 transmits the operation lock cooperation data to the operation lock cooperation agent related to the operation lock information cooperation data (step S13).

The operation lock cooperation agent 203 of the information terminal 200 waits for a notification from the operation lock cooperation server 101 (step S21). The operation lock cooperation agent 203 receives the notification including the operation lock information cooperation data from the operation lock cooperation server 101 (step S22). The operation lock cooperation agent 203 stores the received operation lock information cooperation data in the local storage 207, and updates the information in the information terminal 200 (step S23).

The operation lock cooperation agent 301 of the operation lock cooperation agent device 300 waits for a notification from the operation lock cooperation server 101 (step S31). The operation lock cooperation agent 301 receives the notification including the operation lock information cooperation data from the operation lock cooperation server 101 (step S32). The operation lock cooperation agent 301 stores the received operation lock information cooperation data in the local storage 304, and updates the information in the operation lock cooperation agent device 300 (step S33).

The operation lock cooperation agent 403 of the virtual desktop terminal 400 waits for a notification from the operation lock cooperation server 101 (step S41). The operation lock cooperation agent 403 receives the notification including the operation lock information cooperation data from the operation lock cooperation server 101 (step S42). The operation lock cooperation agent 403 stores the received operation lock information cooperation data in the local storage 406, and updates the information in the virtual desktop terminal 400 (step S43).

The operation lock cooperation agent 502 of the business system 500 waits for a notification from the operation lock cooperation server 101 (step S51). The operation lock cooperation agent 502 receives the notification including the operation lock information cooperation data from the operation lock cooperation server 101 (step S52). The operation lock cooperation agent 502 stores the received operation lock information cooperation data in the local storage 505, and updates the information in the business system 500 (step S53).

Next, as an example, the operation when a connection timeout occurs in the business system 500 will be described. FIG. 15 shows a schematic operation when connection timeout occurs in the business system 500 . Assume that connection timeout occurs in the business system 500 connected from the virtual desktop terminal 400, and re-authentication is required to continue business. The timeout detection unit 504 of the business system 500 detects a connection timeout in using the business system from the virtual desktop terminal 400 (step S55). The timeout detection unit 504 notifies the operation lock cooperation agent 502 of timeout detection.

The operation lock cooperation agent 502 updates the operation lock cooperation information stored in the local storage 505 (step S56). The operation lock cooperation agent 502 reads the operation lock information cooperation data (see FIG. 11) from the local storage 505 in step S56, for example. The operation lock cooperation agent 502 stores a value indicating timeout in the “timeout state” of the business system operation lock information portion in the read operation lock information cooperation data. Also, the operation lock cooperation agent 502 changes the “update time” to the current time. The operation lock cooperation agent 502 stores the updated operation lock cooperation data in the local storage 505 . The operation lock cooperation agent 502 transmits the operation lock information cooperation data (operation lock information) updated in step S56 to the operation lock cooperation server 101 (step S57).

The operation lock cooperation server 101 waits for updating of the operation lock cooperation database 102 (step S11). Upon receiving the operation lock information, the operation lock cooperation server 101 stores the operation lock information cooperation data in the operation lock cooperation database 102 and updates the database (step S12). After updating the operation lock cooperation database 102, the operation lock cooperation server 101 transmits the operation lock cooperation data to the operation lock cooperation agent related to the operation lock information cooperation data (step S13).

The operation lock cooperation agent 203 of the information terminal 200 waits for a notification from the operation lock cooperation server 101 (step S21). The operation lock cooperation agent 203 receives the notification including the operation lock information cooperation data from the operation lock cooperation server 101 (step S22). The operation lock cooperation agent 203 stores the received operation lock information cooperation data in the local storage 207, and updates the information in the information terminal 200 (step S23).

The operation lock cooperation agent 301 of the operation lock cooperation agent device 300 waits for a notification from the operation lock cooperation server 101 (step S31). The operation lock cooperation agent 301 receives the notification including the operation lock information cooperation data from the operation lock cooperation server 101 (step S32). The operation lock cooperation agent 301 stores the received operation lock information cooperation data in the local storage 304, and updates the information in the operation lock cooperation agent device 300 (step S33).

The operation lock cooperation agent 403 of the virtual desktop terminal 400 waits for a notification from the operation lock cooperation server 101 (step S41). The operation lock cooperation agent 403 receives the notification including the operation lock information cooperation data from the operation lock cooperation server 101 (step S42). The operation lock cooperation agent 403 stores the received operation lock information cooperation data in the local storage 406, and updates the information in the virtual desktop terminal 400 (step S43). Although not shown in FIG. 15 , the operation lock cooperation agent 502 of the business system 500 also receives the operation lock information cooperation data from the operation lock cooperation server 101 and stores it in the local storage 505 .

Each of the operation lock cooperation agents 203, 301, 403, and 502 refers to the operation lock information cooperation data and recognizes that a connection timeout has occurred where the chain order is "4". In other words, each of the operation lock cooperation agents 203, 301, 403, and 502 is re-authenticated in the business system 500 because the "timeout state" in the business system operation lock information has changed to a value indicating timeout. Recognize that it is necessary.

Each of the operation lock cooperation agents 203, 301, 403, and 502 checks whether or not the "chain order" of the operation lock information issued by itself is smaller than the chain order at the point where the timeout occurred. Since the chain order of the information terminal operation lock information is the smallest value "1", the operation lock cooperation agent 203 prompts the face authentication system 201, which is the authentication mechanism of the information terminal 200, to perform face authentication (step S24). The face authentication system 201 displays a face authentication screen and prompts the user to perform face authentication.

FIG. 16 shows a schematic operation when the information terminal 200 performs face authentication. The operation lock cooperation agent 203 of the information terminal 200 waits for face authentication (step S25). The operation lock detection unit 206 detects success of the face authentication and notifies the operation lock cooperation agent 203 of it. When the face authentication is performed, the operation lock cooperation agent 203 updates the information terminal operation lock information part in the operation lock information cooperation data (step S26). The operation lock cooperation agent 203 reads the operation lock information cooperation data from the local storage 207 in step S26. The operation lock cooperation agent 203 stores the face authentication result in the "authentication result" of the information terminal operation lock information portion of the read operation lock information cooperation data, and stores the current time in the "update time". When the user's face is successfully authenticated, the operation lock cooperation agent 203 stores a value indicating "success" in "authentication result". The operation lock cooperation agent 203 stores (overwrites) the updated operation lock information cooperation data in the local storage 207 . Further, the operation lock cooperation agent 203 transmits the updated operation lock information cooperation data to the operation lock cooperation server 101 (step S27).

The operation lock cooperation server 101 waits for updating of the operation lock cooperation database 102 (step S11). The operation lock cooperation server 101 receives the operation lock information cooperation data transmitted in step S27 from the operation lock cooperation agent 203. FIG. The operation lock cooperation server 101 stores the received operation lock information cooperation data in the operation lock cooperation database 102, and updates the database (step S12). Further, the operation lock cooperation server 101 transmits the operation lock cooperation data to the operation lock cooperation agent related to the operation lock information cooperation data (step S13). The operation lock cooperation server 101 transmits the operation lock information cooperation data to the operation lock cooperation agents 203, 301, 403, and 502 in step S13.

The operation lock cooperation agent 301 of the operation lock cooperation agent device 300 waits for a notification from the operation lock cooperation server 101 (step S31). The operation lock cooperation agent 301 receives the notification including the operation lock information cooperation data from the operation lock cooperation server 101 (step S32). The operation lock cooperation agent 301 stores the received operation lock information cooperation data in the local storage 304, and updates the information in the operation lock cooperation agent device 300 (step S33).

The operation lock cooperation agent 403 of the virtual desktop terminal 400 waits for a notification from the operation lock cooperation server 101 (step S41). The operation lock cooperation agent 403 receives the notification including the operation lock information cooperation data from the operation lock cooperation server 101 (step S42). The operation lock cooperation agent 403 stores the received operation lock information cooperation data in the local storage 406, and updates the information in the virtual desktop terminal 400 (step S43). Although not shown in FIG. 16 , the operation lock cooperation agent 203 of the information terminal 200 also receives the operation lock information cooperation data from the operation lock cooperation server 101 and stores it in the local storage 207 . The operation lock cooperation agent 502 of the business system 500 also receives the operation lock information cooperation data from the operation lock cooperation server 101 and stores it in the local storage 505 .

The operation lock cooperation agents 301, 403, and 502 refer to the operation lock information cooperation data stored in the local storages 304, 406, and 505, respectively. is a value indicating successful authentication. Further, each of the operation lock cooperation agents 301, 403, and 502 recognizes that the "update time" of the operation lock information with the chain order of "1" is later than the update time of the stored operation lock information cooperation data. .

Further, each of the operation lock cooperation agents 203, 301, 403, and 502 has a value of "chain order" in the operation lock information generated by itself that is one more than the value of "chain order" in the business system operation lock information. Check whether it is a young value. Here, the operation lock cooperation agent 403 recognizes that the value of the chain order in the operation lock information issued by itself is one value smaller than the chain order "4" in the business system operation lock information. The operation lock cooperation agent 403 encourages the business system client 402 of the virtual desktop terminal 400 to connect to the business system 500 and perform authentication again. The business system client 402 performs connection and authentication to the business system 500 . As a result, the timeout state of the business system 500 is resolved.

The timeout detection unit 504 of the business system 500 detects login to the business system 500 from the virtual desktop terminal 400 and notifies the operation lock cooperation agent 502 (step S61). The operation lock cooperation agent 502 updates the business system operation lock information part in the operation lock information cooperation data (step S62). The operation lock cooperation agent 502 transmits the operation lock information cooperation data to the operation lock cooperation server 101 . After that, the operation lock information linkage data is stored in the information terminal 200, the operation lock linkage agent device 300, the virtual desktop terminal 400, and the business system 500 through the operation described with reference to FIG.

In this embodiment, an operation lock cooperation agent is used that monitors each device or system that requires authentication for use. In this embodiment, the MAC address acquisition unit 204 , IP address acquisition unit 205 , and operation lock detection unit 206 of the information terminal 200 are used to assist the operation of the operation lock cooperation agent 203 . Also, in the operation lock cooperation agent device 300 , the IP address acquisition unit 302 and timeout detection unit 303 are used to assist the operation of the operation lock cooperation agent 301 . In the virtual desktop terminal 400 , the IP address acquisition unit 404 and the operation lock detection unit 405 are used to assist the operation of the operation lock cooperation agent 403 . In the business system 500 , the IP address acquisition unit 503 and timeout detection unit 504 are used to assist the operation of the operation lock cooperation agent 502 .

The operation lock cooperation agents 203, 301, 403, and 502 record the address information and the like obtained when each device requiring authentication passes authentication in the operation lock information. Further, the operation lock cooperation agents 203, 301, 403, and 502 add an issue ID and an update date and time to the operation lock information when generating the operation lock information.

The operation lock cooperation agents 203 , 301 , 403 , and 502 transmit the generated operation lock information (the cooperation data thereof) to the operation lock cooperation server 101 . The operation lock cooperation server 101 searches the operation lock cooperation database 102 for related operation lock information cooperation data based on the received operation lock information. The operation lock cooperation server 101 combines the operation lock information whose relationship is recognized based on the IP address or MAC address, for example, in a chain structure, and generates chained operation lock information cooperation data. The operation lock cooperation server 101 transmits the operation lock information cooperation data to the operation lock cooperation agents 203 , 301 , 403 and 502 . The operation lock cooperation agents 203, 301, 403, and 502 hold operation lock information cooperation data. When the operation lock information cooperation agents 203, 301, 403, and 502 receive from the operation lock cooperation server 101 the operation lock information cooperation data having the same issue ID as the issue ID of the operation lock information cooperation data held by themselves, the old update Delete the operation lock information linkage data with date and time.

In this embodiment, the operation lock detection units 206 and 405 and the timeout detection units 303 and 504 detect the operation lock state or timeout state of the device and notify the operation lock cooperation agents 203, 301, 403, and 502 of it. The operation lock cooperation agent 203 of the information terminal 200 recognizes that an operation lock or timeout has occurred in any device based on the operation lock information cooperation data. In that case, the operation lock cooperation agent 203 cooperates with the face authentication system 201 and prompts the user to perform face authentication. When the user performs face recognition, the operation lock cooperation agent of each device cooperates, and the operation of the device where the operation lock has occurred is performed using the single sign-on technology of the device in the previous stage of the device where the operation lock has occurred. An unlocking operation is performed.

In this embodiment, the operation lock detection unit or timeout detection unit of each device detects the operation lock or timeout of the device and notifies the operation lock cooperation agent. The operation lock cooperation agent notifies the operation lock cooperation server of the occurrence of operation lock or timeout. In this embodiment, as shown in FIG. 11, the authentication path from the information terminal 200 to the business system 500 is clarified by the operation lock information linkage data structure. Therefore, the operation lock cooperation server 101 can notify the information terminal 200 serving as the base point of single sign-on that an operation lock or timeout has occurred. The operation lock cooperation agent 203 of the information terminal 200 that has received the notification requests to activate the face authentication system 201 . When the user performs face authentication, the operation lock cooperation agent 203 notifies the operation lock cooperation server 101 of the face authentication. Upon receiving the notification, the operation lock cooperation server 101 notifies the operation lock cooperation agent in the device preceding the device in which the operation lock or timeout has occurred. Upon receiving this notification, the operation lock cooperation agent requests the device in which the operation lock or timeout has occurred to perform an authentication action. By doing so, it becomes possible to release the operation lock or release the timeout (reconnection) using the authentication result in the information terminal 200 .

In this embodiment, the operation lock or timeout of the VPN device 600, the virtual desktop terminal 400, and the business system 500 behind the information terminal 200 can be released based on face authentication at the information terminal 200. FIG. By doing so, the operation lock or timeout of each device can be released without notifying the user of the user ID and password for releasing the operation lock or timeout of each device. In this embodiment, face authentication is used as the base point of single sign-on, and only the person himself/herself can safely release the operation lock or time-out using face information. In this embodiment, the user does not need to memorize an ID, a password, etc., which are necessary for later authentication. Therefore, convenience for the user can be improved while maintaining security.

Note that, in the above embodiment, an example in which face authentication is performed in the information terminal 200 has been described, but the present disclosure is not limited to this. Authentication that is the base of single sign-on is not limited to face authentication. Various authentications such as other biometrics authentication, possession-based authentication, or memory-based authentication can be used for the authentication that is the base of single sign-on. Examples of biometric authentication include fingerprint authentication, palm print authentication, vein authentication, iris authentication, ear acoustic authentication, and the like. Examples of authentication based on possession include IC (Integrated Circuit) card authentication, mobile terminal authentication, and the like. Examples of memory-based authentication include, for example, pattern authentication.

In the embodiment described above, an example in which operation lock information is linked in a chain structure in the operation lock information linkage data has been described, but the present disclosure is not limited to this. In the above embodiment, the data structure of the operation lock information linkage data is not particularly limited. For example, the operation lock information linkage data may have a data structure in which the operation lock information is combined in the relation of the primary key and the foreign key in the relational database. In the above embodiment, all of the information terminal 200, the VPN device 600, the virtual desktop terminal 400, and the business system 500 can employ a network configuration in which direct IP communication is possible. In that case, it is also possible to make each operation lock cooperation agent hold all the operation lock information cooperation data, and eliminate the need for the operation lock cooperation server 101 and the operation lock cooperation database 102 .

In the above embodiments, the information terminal 200, operation lock cooperation agent device 300, virtual desktop terminal 400, and business system 500 typically include a processor and memory. Functions within the information terminal 200, the operation lock cooperation agent device 300, the virtual desktop terminal 400, and the business system 500 may be implemented by the processor reading and executing programs stored in the memory. Operation lock cooperation server 101 also typically includes a processor and a memory. The functions of the operation lock cooperation server 101 may be implemented by the processor reading and executing a program stored in the memory.

The program can be stored and supplied to the computer using various types of non-transitory computer-readable media. Non-transitory computer-readable media include various types of tangible storage media. Examples of non-transitory computer-readable media include magnetic recording media such as flexible disks, magnetic tapes, or hard disks, magneto-optical recording media such as magneto-optical discs, compact discs (CDs), or digital versatile disks (DVDs). and semiconductor memory such as mask ROM (read only memory), PROM (programmable ROM), EPROM (erasable PROM), flash ROM, or RAM (random access memory). The program may also be delivered to the computer using various types of transitory computer readable media. Examples of transitory computer-readable media include electrical signals, optical signals, and electromagnetic waves. Transitory computer-readable media can deliver the program to the computer via wired channels, such as wires and optical fibers, or wireless channels.

Although the embodiments of the present disclosure have been described in detail above, the present disclosure is not limited to the above-described embodiments, and changes and modifications can be made to the above-described embodiments without departing from the scope of the present disclosure. are also included in the present disclosure.

For example, some or all of the above-described embodiments may be described in the following supplementary remarks, but are not limited to the following.

[Appendix 1]
A first-stage authentication target device authenticated using an authentication means, a plurality of authentication target devices including one or more subsequent authentication target devices authenticated by single sign-on using the authentication result of the authentication means;
detection means arranged corresponding to each of the plurality of authentication target devices and detecting whether or not each authentication target device is in an authentication required state, which is a state requiring authentication;
authentication required state information indicating whether or not each authentication target device is in the authentication required state, and operation lock information including an authentication result in each authentication target device, which are arranged corresponding to each of the plurality of authentication target devices; an operation lock cooperation agent to be generated;
receiving the operation lock information from the operation lock cooperation agent; generating cooperation data by combining the operation lock information received from the operation lock cooperation agents corresponding to each of the plurality of authentication target devices; an operation lock cooperation server that transmits to the operation lock cooperation agent;
When the authentication target device is authenticated in the single sign-on, the operation lock cooperation agent transmits operation lock information including an authentication result indicating successful authentication to the operation lock cooperation server,
The operation lock cooperation agent transmits, to the operation lock cooperation server, operation lock information including authentication required state information indicating that the authentication target device is in the authentication required state when the detecting means detects the authentication required state. ,
The operation lock cooperation server generates cooperation data including operation lock information indicating that the authentication is required, and transmits the cooperation data to the operation lock cooperation agent;
The operation lock cooperation agent corresponding to the first-stage authentication target device prompts the authentication means to perform authentication,
A system operation unlocking system in which, when the authentication by the authentication means is performed normally, authentication of the authentication target device in which the authentication required state is detected is performed using the single sign-on mechanism.

[Appendix 2]
The operation lock cooperation agent acquires address information related to the authentication target device at the time of initial authentication of the authentication target device, generates operation lock information further including the acquired address information, and transmits the operation lock cooperation server to the operation lock cooperation server. The system operation unlocking system of claim 1 to transmit.

[Appendix 3]
The system according to appendix 2, wherein the operation lock cooperation server combines operation lock information received from operation lock cooperation agents corresponding to each of the plurality of authentication target devices based on address information included in the operation lock information. Operation unlocking system.

[Appendix 4]
4. The system operation according to any one of Appendices 1 to 3, wherein the operation lock cooperation server gives a chain order to the operation lock information transmitted from each operation lock cooperation agent in the order in which authentication is performed by the single sign-on. unlock system.

[Appendix 5]
The operation lock cooperation agent issues an ID for identifying the operation lock information when the authentication target device is authenticated for the first time, generates operation lock information further including the issued ID, and sends the operation lock cooperation server to the operation lock cooperation server. send and
When the operation lock cooperation agent receives the cooperation data from the operation lock cooperation server and the received cooperation data includes the issued ID, the operation lock cooperation agent stores the received cooperation data. A system-operated unlocking system according to any one of the preceding claims.

[Appendix 6]
If the authentication required state information included in the operation lock information transmitted from the operation lock cooperation agent corresponding to one of the authentication target devices indicates the authentication required state, the operation lock cooperation agent corresponding to the first-stage authentication target device: 6. The system operation unlocking system according to any one of Appendices 1 to 5, which prompts the authentication means to authenticate.

[Appendix 7]
the operation lock information further includes an update time of the operation lock information;
In the cooperation data, the authentication result included in the operation lock information transmitted from the operation lock cooperation agent corresponding to the first-stage authentication target device indicates authentication success, and the update time indicates that the authentication required state is detected. Supplementary notes 1 to 6 that authentication of the authentication target device for which the authentication required state is detected is performed when the time is later than the update time included in the operation lock information transmitted from the operation lock cooperation agent of the authentication target device. A system-operated unlocking system according to any one of the preceding claims.

[Appendix 8]
8. The system operation unlocking system according to any one of Appendices 1 to 7, wherein the authentication means performs authentication using biometric information of the user.

[Appendix 9]
9. The system operation lock according to any one of appendices 1 to 8, wherein the detecting means detects the authentication-required state when a non-operating state continues for a predetermined time or longer or when a connection times out in each device to be authenticated. release system.

[Appendix 10]
A monitoring target among a plurality of authentication target devices including an initial authentication target device authenticated using an authentication means and one or more subsequent authentication target devices authenticated by single sign-on using the authentication result of the authentication means authentication-required state information indicating whether or not the monitored authentication-targeted device is in an authentication-required state, which is a state requiring authentication, and the authentication result of the monitored authentication-targeted device operation lock information generating means for generating operation lock information;
operation lock information transmitting means for transmitting the operation lock information to an operation lock cooperation server that receives the operation lock information for the plurality of authentication target devices and generates cooperation data combining the received operation lock information; ,
cooperation data receiving means for receiving the cooperation data from the operation lock cooperation server;
When the operation lock information including the authentication required state information indicating that the authentication required state is included in the cooperation data, and when the authentication target device to be monitored is the first-stage authentication target device, the authentication authentication requesting means for prompting the means to perform authentication;
The operation lock information generating means generates operation lock information including a result of the authentication when the authentication target device to be monitored is authenticated,
The operation lock information generating means, when the authentication-required state is detected in the authentication-required device to be monitored, performs an operation including authentication-required state information indicating that the authentication-required device to be monitored is in the authentication-required state. generate lock information,
After receiving the cooperation data containing the operation lock information including the authentication required state information indicating the authentication required state, if the authentication is normally performed by the authentication means, the single sign-on mechanism is used. , an operation lock cooperation agent that performs authentication of the authentication target device for which the authentication required state is detected.

[Appendix 11]
11. The operation lock cooperation according to appendix 10, wherein the operation lock information generating means acquires address information of the authentication target device when the authentication target device is authenticated for the first time, and generates operation lock information further including the acquired address information. Agent.

[Appendix 12]
The operation lock information generating means issues an ID for identifying the operation lock information when the authentication target device is first authenticated, and generates operation lock information further including the issued ID,
When the cooperation data received from the operation lock cooperation server includes the operation lock information including the ID issued by the operation lock information generating means, the cooperation data receiving means stores the received cooperation data. Described operation lock cooperation agent.

[Appendix 13]
The authentication request means, when the authentication required state information included in the operation lock cooperation agent transmitted from the operation lock cooperation agent whose authentication target device in the latter stage is the authentication target device to be monitored indicates an authentication required state, 13. The operation lock cooperation agent according to any one of appendices 10 to 12 that prompts authentication.

[Appendix 14]
the operation lock information further includes an update time of the operation lock information;
In the cooperation data, the authentication result included in the operation lock information transmitted from the operation lock cooperation agent whose first-stage authentication target device is the authentication target device to be monitored indicates authentication success, and the update time corresponds to the request. If the time is later than the update time included in the operation lock information transmitted from the operation lock cooperation agent that designates the authentication target device whose authentication state is detected as the authentication target device to be monitored, the authentication required state is detected. 14. The operation lock cooperation agent according to any one of appendices 10 to 13, wherein the authentication target device is authenticated.

[Appendix 15]
Corresponding to each of a plurality of devices to be authenticated, including a first-stage device to be authenticated using authentication means and one or more devices to be authenticated at a later stage that are authenticated by single sign-on using the authentication result of the authentication means An operation lock that generates authentication required status information indicating whether or not each authentication target device is in an authentication required state, which is a state that requires authentication, and operation lock information that includes the authentication result of each authentication target device. operation lock information receiving means for receiving the operation lock information from the cooperation agent;
cooperation data generating means for generating cooperation data by combining the operation lock information received from the operation lock cooperation agents corresponding to each of the plurality of authentication target devices;
cooperation data transmission means for transmitting the cooperation data to the operation lock cooperation agent;
The operation lock information receiving means receives operation lock information including an authentication result indicating authentication success from the operation lock cooperation agent when the authentication target device is authenticated in the single sign-on,
The operation lock information receiving means, when the authentication required state is detected in each authentication target device, transmits the operation lock information including the authentication required state information indicating that the authentication target device is in the authentication required state to the operation lock cooperation. received from the agent,
The cooperation data transmission means transmits cooperation data including operation lock information indicating that the authentication is required to the operation lock cooperation agent,
The authentication means is prompted to perform authentication by an operation lock cooperation agent corresponding to the first-stage authentication target device,
An operation lock cooperation server that authenticates the authentication target device for which the authentication required state is detected using the single sign-on mechanism when authentication by the authentication means is performed normally.

[Appendix 16]
16. The operation lock cooperation server according to appendix 15, wherein the operation lock information receiving means receives operation lock information further including address information of the authentication target device from an operation lock cooperation agent when the authentication target device is authenticated for the first time.

[Appendix 17]
17. The operation according to appendix 16, wherein the cooperation data generating means combines the operation lock information received from the operation lock cooperation agents corresponding to each of the plurality of authentication target devices based on the address information included in the operation lock information. Lock cooperation server.

[Appendix 18]
18. The operation lock according to any one of appendices 15 to 17, wherein the cooperation data generating means gives a chain order to the operation lock information transmitted from each operation lock cooperation agent in the order in which authentication is performed by the single sign-on. Collaborative server.

[Appendix 19]
Corresponding to each of a plurality of devices to be authenticated, including a first-stage device to be authenticated using authentication means and one or more devices to be authenticated at a later stage that are authenticated by single sign-on using the authentication result of the authentication means Authentication required state information indicating whether or not each authentication target device is in an authentication required state, which is a state requiring authentication, and an operation lock including the authentication result for each authentication target device, from the operation lock cooperation agent arranged as Send the information to the operation lock cooperation server,
The operation lock cooperation server generates cooperation data by combining the operation lock information received from the operation lock cooperation agents corresponding to each of the plurality of authentication target devices, and transmits the cooperation data to the operation lock cooperation agent. have the
when the authentication target device is authenticated in the single sign-on, operation lock information including an authentication result indicating successful authentication is transmitted from the operation lock cooperation agent to the operation lock cooperation server;
When the authentication required state is detected in the authentication target device, operation lock information including authentication required state information indicating that the authentication target device is in the authentication required state is sent from the operation lock cooperation agent to the operation lock cooperation server. sent,
cooperation data including operation lock information indicating that the authentication is required is transmitted from the operation lock cooperation server to the operation lock cooperation agent;
prompting the authentication means to perform authentication in the first-stage authentication target device;
An operation lock cooperation method in which, when authentication by the authentication means is performed normally, authentication of the authentication target device in which the authentication required state is detected is performed using the single sign-on mechanism.

[Appendix 20]
A monitoring target among a plurality of authentication target devices including an initial authentication target device authenticated using an authentication means and one or more subsequent authentication target devices authenticated by single sign-on using the authentication result of the authentication means authentication-required state information indicating whether or not the monitored authentication-targeted device is in an authentication-required state, which is a state requiring authentication, and the authentication result of the monitored authentication-targeted device generate operation lock information,
transmitting the operation lock information to an operation lock cooperation server that receives the operation lock information for the plurality of authentication target devices and generates cooperation data that combines the received operation lock information;
receiving the cooperation data from the operation lock cooperation server;
When the operation lock information including the authentication required state information indicating that the authentication required state is included in the cooperation data, and when the authentication target device to be monitored is the first-stage authentication target device, the authentication having prompting the means to carry out authentication;
when authentication is performed in the authentication target device to be monitored, operation lock information including the result of the authentication is generated;
when the authentication required state is detected in the authentication target device to be monitored, operation lock information including authentication required state information indicating that the authentication target device to be monitored is in the authentication required state is generated;
After the cooperation data containing the operation lock information including the authentication required state information indicating the authentication required state is received, when the authentication is normally performed by the authentication means, the single sign-on mechanism is activated. An operation lock cooperation method for performing authentication of an authentication target device in which the authentication required state is detected, using an operation lock cooperation method.

[Appendix 21]
Corresponding to each of a plurality of devices to be authenticated, including a first-stage device to be authenticated using authentication means and one or more devices to be authenticated at a later stage that are authenticated by single sign-on using the authentication result of the authentication means An operation lock that generates authentication required status information indicating whether or not each authentication target device is in an authentication required state, which is a state that requires authentication, and operation lock information that includes the authentication result of each authentication target device. receiving the operation lock information from the cooperation agent;
combining the operation lock information received from the operation lock cooperation agent corresponding to each of the plurality of authentication target devices to generate cooperation data;
transmitting the cooperation data to the operation lock cooperation agent;
receiving operation lock information including an authentication result indicating successful authentication from the operation lock cooperation agent when the authentication target device is authenticated in the single sign-on;
when the authentication required state is detected in each authentication target device, operation lock information including authentication required state information indicating that the authentication target device is in the authentication required state is received from the operation lock cooperation agent;
cooperation data including operation lock information indicating that the authentication is required is transmitted to the operation lock cooperation agent;
The operation lock cooperation agent corresponding to the first-stage authentication target device prompts the authentication means to perform authentication,
An operation lock cooperation method in which, when authentication by the authentication means is performed normally, authentication of the authentication target device in which the authentication required state is detected is performed using the single sign-on mechanism.

[Appendix 22]
A monitoring target among a plurality of authentication target devices including an initial authentication target device authenticated using an authentication means and one or more subsequent authentication target devices authenticated by single sign-on using the authentication result of the authentication means authentication-required state information indicating whether or not the monitored authentication-targeted device is in an authentication-required state, which is a state requiring authentication, and the authentication result of the monitored authentication-targeted device generate operation lock information,
transmitting the operation lock information to an operation lock cooperation server that receives the operation lock information for the plurality of authentication target devices and generates cooperation data that combines the received operation lock information;
receiving the cooperation data from the operation lock cooperation server;
When the operation lock information including the authentication required state information indicating that the authentication required state is included in the cooperation data, and when the authentication target device to be monitored is the first-stage authentication target device, the authentication A program for causing a computer to execute a process of prompting the means to perform authentication,
when authentication is performed in the authentication target device to be monitored, operation lock information including the result of the authentication is generated;
when the authentication required state is detected in the authentication target device to be monitored, operation lock information including authentication required state information indicating that the authentication target device to be monitored is in the authentication required state is generated;
After the cooperation data containing the operation lock information including the authentication required state information indicating the authentication required state is received, when the authentication is normally performed by the authentication means, the single sign-on mechanism is activated. A program for performing authentication of an authentication target device in which the authentication required state is detected, using a program.

[Appendix 23]
Corresponding to each of a plurality of devices to be authenticated, including a first-stage device to be authenticated using authentication means and one or more devices to be authenticated at a later stage that are authenticated by single sign-on using the authentication result of the authentication means An operation lock that generates authentication required status information indicating whether or not each authentication target device is in an authentication required state, which is a state that requires authentication, and operation lock information that includes the authentication result of each authentication target device. receiving the operation lock information from the cooperation agent;
combining the operation lock information received from the operation lock cooperation agent corresponding to each of the plurality of authentication target devices to generate cooperation data;
A program for causing a computer to execute a process of transmitting the cooperation data to the operation lock cooperation agent,
receiving operation lock information including an authentication result indicating successful authentication from the operation lock cooperation agent when the authentication target device is authenticated in the single sign-on;
when the authentication required state is detected in each authentication target device, operation lock information including authentication required state information indicating that the authentication target device is in the authentication required state is received from the operation lock cooperation agent;
cooperation data including operation lock information indicating that the authentication is required is transmitted to the operation lock cooperation agent;
The operation lock cooperation agent corresponding to the first-stage authentication target device prompts the authentication means to perform authentication,
A program for performing authentication of an authentication target device in which the authentication required state is detected using the single sign-on mechanism when the authentication by the authentication means is performed normally.

10: System operation lock release system 20: Authentication target device 21: Authentication means 30: Detection means 40: Operation lock cooperation agent 50: Operation lock cooperation server 100: System operation lock release system 101: Operation lock cooperation server 102: Operation lock cooperation Database 111: Operation lock information reception means 112: Cooperation data generation means 113: Cooperation data transmission means 150: Operation lock cooperation agent 151: Operation lock information generation means 152: Operation lock information transmission means 153: Cooperation data reception means 154: Authentication request Means 200: Information terminal 201: Face authentication system 202: VPN client 203: Operation lock cooperation agent 204: MAC address acquisition unit 205: IP address acquisition unit 206: Operation lock detection unit 207: Local storage 208: Camera 300: Operation lock cooperation Agent device 301: Operation lock cooperation agent 302: IP address acquisition unit 303: Timeout detection unit 304: Local storage 400: Virtual desktop terminal 401: Login authentication unit 402: Business system client 403: Operation lock cooperation agent 404: IP address acquisition unit 405: Operation lock detection unit 406: Local storage 500: Business system 501: Login authentication unit 502: Operation lock cooperation agent 503: IP address acquisition unit 504: Timeout detection unit 505: Local storage 600: VPN device 601: VPN authentication unit

Claims (10)

A first-stage authentication target device authenticated using an authentication means, a plurality of authentication target devices including one or more subsequent authentication target devices authenticated by single sign-on using the authentication result of the authentication means;
detection means arranged corresponding to each of the plurality of authentication target devices and detecting whether or not each authentication target device is in an authentication required state, which is a state requiring authentication;
authentication required state information indicating whether or not each authentication target device is in the authentication required state, and operation lock information including an authentication result in each authentication target device, which are arranged corresponding to each of the plurality of authentication target devices; an operation lock cooperation agent to be generated;
receiving the operation lock information from the operation lock cooperation agent; generating cooperation data by combining the operation lock information received from the operation lock cooperation agents corresponding to each of the plurality of authentication target devices; an operation lock cooperation server that transmits to the operation lock cooperation agent;
When the authentication target device is authenticated in the single sign-on, the operation lock cooperation agent transmits operation lock information including an authentication result indicating successful authentication to the operation lock cooperation server,
The operation lock cooperation agent transmits, to the operation lock cooperation server, operation lock information including authentication required state information indicating that the authentication target device is in the authentication required state when the detecting means detects the authentication required state. ,
The operation lock cooperation server generates cooperation data including operation lock information indicating that the authentication is required, and transmits the cooperation data to the operation lock cooperation agent;
The operation lock cooperation agent corresponding to the first-stage authentication target device prompts the authentication means to perform authentication,
A system operation unlocking system in which, when authentication by the authentication means is performed normally, authentication of the authentication target device in which the authentication required state is detected is performed using the single sign-on mechanism. The operation lock cooperation agent acquires address information related to the authentication target device at the time of initial authentication of the authentication target device, generates operation lock information further including the acquired address information, and transmits the operation lock cooperation server to the operation lock cooperation server. 2. The system operation unlocking system of claim 1, transmitting. 3. The operation lock cooperation server according to claim 2, wherein the operation lock cooperation server combines the operation lock information received from the operation lock cooperation agents corresponding to each of the plurality of authentication target devices based on the address information included in the operation lock information. System operation unlocking system. 4. The system according to any one of claims 1 to 3, wherein the operation lock cooperation server gives a chain order to the operation lock information transmitted from each operation lock cooperation agent in the order in which authentication is performed by the single sign-on. Operation unlocking system. If the authentication required state information included in the operation lock information transmitted from the operation lock cooperation agent corresponding to one of the authentication target devices indicates the authentication required state, the operation lock cooperation agent corresponding to the first-stage authentication target device: 5. The system operation unlocking system according to any one of claims 1 to 4, wherein the authentication means prompts authentication. 6. The system operation according to any one of claims 1 to 5, wherein the detecting means detects the authentication required state when a non-operating state continues for a predetermined time or longer or when a connection times out in each authentication target device. unlock system. A monitoring target among a plurality of authentication target devices including an initial authentication target device authenticated using an authentication means and one or more subsequent authentication target devices authenticated by single sign-on using the authentication result of the authentication means authentication-required state information indicating whether or not the monitored authentication-targeted device is in an authentication-required state, which is a state requiring authentication, and the authentication result of the monitored authentication-targeted device operation lock information generating means for generating operation lock information;
operation lock information transmitting means for transmitting the operation lock information to an operation lock cooperation server that receives the operation lock information for the plurality of authentication target devices and generates cooperation data combining the received operation lock information; ,
cooperation data receiving means for receiving the cooperation data from the operation lock cooperation server;
When the operation lock information including the authentication required state information indicating that the authentication required state is included in the cooperation data, and when the authentication target device to be monitored is the first-stage authentication target device, the authentication authentication requesting means for prompting the means to perform authentication;
The operation lock information generating means generates operation lock information including a result of the authentication when the authentication target device to be monitored is authenticated,
The operation lock information generating means, when the authentication-required state is detected in the authentication-required device to be monitored, performs an operation including authentication-required state information indicating that the authentication-required device to be monitored is in the authentication-required state. generate lock information,
After receiving the cooperation data containing the operation lock information including the authentication required state information indicating the authentication required state, if the authentication is normally performed by the authentication means, the single sign-on mechanism is used. , an operation lock cooperation agent that performs authentication of the authentication target device for which the authentication required state is detected. Corresponding to each of a plurality of devices to be authenticated, including a first-stage device to be authenticated using authentication means and one or more devices to be authenticated at a later stage that are authenticated by single sign-on using the authentication result of the authentication means An operation lock that generates authentication required status information indicating whether or not each authentication target device is in an authentication required state, which is a state that requires authentication, and operation lock information that includes the authentication result of each authentication target device. operation lock information receiving means for receiving the operation lock information from the cooperation agent;
cooperation data generating means for generating cooperation data by combining the operation lock information received from the operation lock cooperation agents corresponding to each of the plurality of authentication target devices;
cooperation data transmission means for transmitting the cooperation data to the operation lock cooperation agent;
The operation lock information receiving means receives operation lock information including an authentication result indicating authentication success from the operation lock cooperation agent when the authentication target device is authenticated in the single sign-on,
The operation lock information receiving means, when the authentication required state is detected in each authentication target device, transmits the operation lock information including the authentication required state information indicating that the authentication target device is in the authentication required state to the operation lock cooperation. received from the agent,
The cooperation data transmission means transmits cooperation data including operation lock information indicating that the authentication is required to the operation lock cooperation agent,
The authentication means is prompted to perform authentication by an operation lock cooperation agent corresponding to the first-stage authentication target device,
An operation lock cooperation server that authenticates the authentication target device for which the authentication required state is detected using the single sign-on mechanism when authentication by the authentication means is performed normally. A monitoring target among a plurality of authentication target devices including an initial authentication target device authenticated using an authentication means and one or more subsequent authentication target devices authenticated by single sign-on using the authentication result of the authentication means authentication-required state information indicating whether or not the monitored authentication-targeted device is in an authentication-required state, which is a state requiring authentication, and the authentication result of the monitored authentication-targeted device generate operation lock information,
transmitting the operation lock information to an operation lock cooperation server that receives the operation lock information for the plurality of devices to be authenticated and generates cooperation data that combines the received operation lock information;
receiving the cooperation data from the operation lock cooperation server;
When the cooperation data includes operation lock information including authentication required state information indicating the authentication required state, and when the authentication target device to be monitored is the first authentication target device, the authentication having prompting the means to carry out authentication;
when authentication is performed in the authentication target device to be monitored, operation lock information including the result of the authentication is generated;
when the authentication required state is detected in the authentication target device to be monitored, operation lock information including authentication required state information indicating that the authentication target device to be monitored is in the authentication required state is generated;
After receiving the cooperation data containing the operation lock information including the authentication required state information indicating the authentication required state, if the authentication is normally performed by the authentication means, the single sign-on mechanism is activated. An operation lock cooperation method for performing authentication of an authentication target device in which the authentication required state is detected, using the method. A monitoring target among a plurality of authentication target devices including an initial authentication target device authenticated using an authentication means and one or more subsequent authentication target devices authenticated by single sign-on using the authentication result of the authentication means authentication-required state information indicating whether or not the monitored authentication-targeted device is in an authentication-required state, which is a state requiring authentication, and the authentication result of the monitored authentication-targeted device generate operation lock information,
transmitting the operation lock information to an operation lock cooperation server that receives the operation lock information for the plurality of authentication target devices and generates cooperation data that combines the received operation lock information;
receiving the cooperation data from the operation lock cooperation server;
When the operation lock information including the authentication required state information indicating that the authentication required state is included in the cooperation data, and when the authentication target device to be monitored is the first-stage authentication target device, the authentication A program for causing a computer to execute a process of prompting the means to perform authentication,
when authentication is performed in the authentication target device to be monitored, operation lock information including the result of the authentication is generated;
when the authentication required state is detected in the authentication target device to be monitored, operation lock information including authentication required state information indicating that the authentication target device to be monitored is in the authentication required state is generated;
After the cooperation data containing the operation lock information including the authentication required state information indicating the authentication required state is received, when the authentication is normally performed by the authentication means, the single sign-on mechanism is activated. A program for performing authentication of an authentication target device in which the authentication required state is detected, using a program.

Images