JPH07182289A - Method and device for security management - Google Patents

Abstract

PURPOSE:To improve the maintenance of an information system and the safety of secrecy even when increment in the number of users or the number of sections or personnel changes are generated in security management. CONSTITUTION:This security managing device is constituted of an input device 1 for inputting a log-in name or the like, a checking part 2 for identifying a valid user, a menu preparing part 3 for preparing a menu, a display device 4 for displaying the menu, a pass word data file 5 for storing user information, an organization data file 6 storing the hierarchical information, employees' codes, etc., of an organization, and a personal menu data file 7 storing the menu information of each user. In the case of preparing a personal menu for an optional user, information identifying the user is inputted from an input device 1, the user is checked by a checking part 2 and a menu preparing part 3 retrieves a section to which a person in charge of security management belongs and a supervisor from an organization data file 6, applies restriction based upon a personal menu file 7 for the supervisor and newly prepares a personal menu file 7.

Description

Detailed Description of the Invention

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a security management method and device in an information processing system.

[0002]

2. Description of the Related Art As a method for performing security management in an information processing system, identification of a user by a password and setting of an available menu and data range for each user are generally used as disclosed in Japanese Patent Publication No. 03-37224. Target. Further, in the case of focusing on the use in a company as an advanced method, the screen use information for each user / department is managed as data as in Japanese Patent Laid-Open No. 03-246742, and important menus and submenus are displayed. There is a method to increase confidentiality by hierarchizing and making it available only when the user name and password match. Even with the current security management, it is possible to make settings that match the organizational structure of the company, and the department that manages the information processing system should consider the user's status, department, section, etc. Setting the menu.

[0003]

However, in the prior art, there is no problem as long as the number of users is small, but if the above password and menu are set for each employee, or if the number of organizations increases, information processing is performed. The workload of the system management department will increase significantly. In addition, the information processing system management department does not know in detail what processing and data each department in the organization uses, so the permission range is narrowed more than necessary, and conversely there is information that should not be permitted. There is also the negative effect of being permitted. Organizations frequently change organizations and personnel changes, but when personnel changes occur, the permission range for each individual changes, so it is necessary to set menus and passwords again, and maintenance is also troublesome. There is such a problem. In addition, if the response is delayed or forgotten, the information of the original department, which should be prohibited, can be accessed, and the information of the new department cannot be accessed.

The present invention eliminates such inconsistency between the security management and the corporate organization, enables security management in a form suitable for the corporate organization, and facilitates setting and changing, thereby allowing the work of the information system department. The purpose is to reduce the load and increase confidentiality and security.

[0005]

A security management method according to the present invention has a menu creating function for creating a user-specific menu by selecting only a process or data required by a user from a prepared process or data selection menu. In the security management method having a user identification function for specifying the user of the information processing system and a management function of the organizational data to which the user belongs, in the security management method, the process or data of any user A is processed by the menu creation function. When creating a selection menu, search for the department or the superior of the organization to which the user A belongs based on the organizational data, and create from the range of the process and data selection menu used by the department or superior. Is characterized by.

Further, when the user A uses the process and data selection menu, the user A identified by the user identification function uses only the process and data selection menu created by a user other than the user A. Characterized by the inability to do it.

Further, when the user A uses the menu creation function to create a process or a data selection menu for the user A, a department or a superior of the organization to which the user A belongs is searched based on the organization data. However, it is characterized in that it is created from the process and the data selection menu defined by limiting the range of the process and the data selection menu used by the department or the superior.

Further, when the organizational affiliation of the user A is changed, in the process of changing the organizational data,
It is characterized in that the processing or the data selection menu of the user A already created is invalidated.

The security management device of the present invention includes a menu creating means for selecting only a process or data required by a user from a prepared process or data selection menu and creating a user's own menu, and an information processing system. In the security management device including the user identification means for specifying the user and the management means for the organizational data to which the user belongs, the user creating the arbitrary user A by the menu creating means.
When creating a process or a data selection menu of the above, based on the organization data, the department or the superior of the department to which the user A belongs is searched, and from the range of the process and the data selection menu used by the department or the superior. It is characterized by having a means for creating.

[0010]

[Operation] A menu creation function of selecting a menu required by the user from the menus prepared by the information system to create a user's own menu, and a user identification function for identifying the user, When the user has the management function of the organization data to which the user belongs, when the menu creation function is used to create a menu for a specific user, the organization data is searched to identify the superior of the organization, and the superior or department Improve security management by limiting the range of the menu being used.

[0011]

Embodiments of the present invention will be described with reference to the drawings. Figure 1
FIG. 3 is a block diagram of the present invention. An input device 1 for inputting a login name, password, employee code, etc., a check unit 2 for checking whether the user is a valid user from the input login name, password, employee code, etc., and for creating a display menu And a display device 4 such as a CRT for displaying the created menu, and the checking unit 2 stores information of a valid user or a valid user for checking. It is composed of a password data file 5, an organization data file 6 in which organization hierarchy information, employee codes, etc. are stored, and an individual menu data file 7 in which information on menus for each individual user is stored. 5, 6, and 7 are respectively stored in the auxiliary storage device.

FIG. 10 is a view showing the concept of this embodiment as an actual menu example. All the menus of the functions of the information system are 101, and the management level is a menu that can be used by the top manager of the entire company. The menu which created only the menu of financial accounting part from all menu 101 is 102
The management level is the department, the managing department is the finance department, and the menu is used by the department manager of the finance department. Further, a menu 103 having a management level of a department is created through a menu of a management level of a department and a menu of a management level of a section. In these processes, the subordinate menu is created by referring to the organizational structure of the company included in the organizational data file 6.

FIG. 2 shows an example of the password data file 5, and information for identifying all users is stored in 21. Stores a login name to identify the user, a password that only the user knows to identify the user, the employee code of the user uniquely assigned to the employee within the company, and menu information for each user It is composed of the file name of the created personal menu file 7.

FIG. 3 shows an example of the personal menu file 7, and there is a file in which information 31 is stored for each user. A menu code for identifying each menu item, a display flag indicating whether to display the menu on the display device 4, and a display name of the menu used when the display data is created by the menu creating unit 3. When the user starts the process using the information system, the start program name is used to link the menu item and the process program.

FIG. 4 shows an example of the organization data file 6.
The file 41 stores the organizational structure of the company. Employees are composed of a department code and department name uniquely assigned to each department in the company according to the hierarchy of the department, an employee code of the manager of the department (for example, section manager), and an employee code of multiple employees of the department. You can search the department you belong to from the code. The department code is also configured so that the higher department name can be identified.

Next, this embodiment will be described with reference to the flowchart of FIG. FIG. 5 is a processing flowchart when a person other than the person in charge who uses the personal menu creates the personal menu file. When the employee code of the person in charge created by the input device 1 is input (ST1), the checking unit 2 checks whether the employee code is valid. If it is valid, the menu creation unit 3 reads the organization data file 6 from the auxiliary storage device (ST2). Since the organization data file 6 stores the relationship between the employee and the department as information, the department and the manager of the department are searched based on the employee code (ST.
3). Since the manager's employee code is known from the search result, the manager's personal menu file name is searched from the password data file 5 and the personal menu file 7 is read (ST4). The menu creating section 3 creates display data from the administrator's personal menu file and displays the menu on the display device 4 (ST5).

Steps ST6, ST7, and ST8 are processes for inputting whether or not to permit display to the person in charge from the administrator's personal menu, and input approval or disapproval from the input device 1 (ST6). Delete the menu item to
7N, ST8), the menu item to be approved is left as it is (ST7Y). When the setting items are completed (ST9Y), the personal menu file of the person in charge is written. This makes it possible to create a personal menu file for the person in charge who is composed of only the menu items to be authorized from the personal menu file of the administrator.

FIG. 6 shows an example in which a menu for a person in charge is created in accordance with the process of the flowchart of FIG. The menu 61 permitted by the manager of the first accounting department is a personal menu of this manager and consists of seven menu items. The menu created from this menu and authorized by the person in charge is 62, which is three menu items. As described above, according to this embodiment, the menu of the person in charge can be created by limiting the menu of the person in charge of the organization, and thus the menu of the person in charge can be created with less operations than in the case of making from the menu of the whole person. Further, since the permission range of Accounting Section 1 is limited by the section manager's own menu, even if a person who is not familiar with the work of Accounting Section 1 sets it, the personal menu file can be created without error in the permission range.

Next, an embodiment in which the person in charge creates his own menu will be described with reference to the flowchart of FIG. When the person in charge inputs his / her own login name and password from the input device 1 (ST21), the checking section 2 searches the password data file 5 to check whether it is registered by the user (ST22). If it is a legitimate user, the menu creation section 3 checks whether or not the personal menu file of this person has been created (ST2).
3) If already created, go to ST23Y. If not created, it goes to ST23N and reads the organization data file 6 (ST24). Organization data file 6 based on employee code
Search the department and the manager of the department from (ST2
5). Since the manager's employee code is known from the search result, the manager's personal menu file name is acquired from the password data file 5, and this manager's personal menu file is copied to the person in charge's personal menu file (ST26). Display data is created based on this information and a menu is displayed on the display device 4 (ST27). ST2
In 8, ST29 and ST30, the person in charge inputs the option to display the menu items that he or she thinks are necessary. When displaying, turn on the display flag of the personal menu file 31.
(ST31), if not displayed, it is turned off (ST30). The personal menu file is written when the setting of the menu items is completed (ST32Y). As a result, a personal menu file for this person in charge is created.

The person in charge can create his own menu in the following two cases. One is when a person in charge (for example, section manager) has a personal menu file created according to the flowchart in Fig. 5, but the person in charge wants to improve the operability. If the level is almost the same (for example, the group manager in charge and the person in charge), the person in charge may make a personal menu from an uncreated state.

FIG. 8 shows an example of an operation screen for improving the operability by editing each menu item based on the created personal menu. A window 81 displays the created personal menu, and a base menu window 83 displays the created personal menu window 81 in a hierarchical structure. Reference numeral 82 is an edit window for performing operations such as display, non-display input, and order change of menu items based on this. To change the personal menu, the setting button in the basic menu window 83 is clicked with a pointing device such as a mouse, and the same contents as the basic window 83 are displayed.
Is displayed in. In this edit window 82, for example, click a menu item for daily work to set it to hide,
Click the management analysis menu item and move to the top of the menu. The result is the edit window 82.
As shown in, the menu is for business analysis, management analysis information setting, and book making at the top. If you finish this editing operation,
The menu window 81 becomes a menu according to the edit window 83.

FIG. 9 is a flowchart for invalidating the personal menu when the department to which the person in charge belongs is changed due to a personnel change. The employee code of the transfer person is input from the input device 1 (ST50). After checking the validity of the employee code, the personal menu file name is obtained from the password data file 5 based on the employee code, and this file is deleted (ST51). Next, the organization data file is read (ST52), and the employee code of the transfer person is deleted from the former department (ST53). Next, the department code of the transferred department is input from the input device 1 (ST54), and the employee code of the transferred person is added to the transferred department (ST55). The organization data file is written to the auxiliary storage device (ST56), and the process ends. As a result, the menu of the person in charge who was transferred just by changing the organizational data is deleted, and the password remains, so after this, when the person tries to use the information system, the person can log in, but the former department Menu is not displayed. Since a new menu is created from the menu of the higher-level administrator in the new department, security management associated with personnel changes can be facilitated without the effort of the system management department.

Further, in the present embodiment, an example in which the subordinate personal menu file 7 is created based on the personal menu file of the administrator has been shown, but the administrator himself may change personnel due to organizational change. In this case, the inconvenience of temporarily losing the personal menu file at the administrator level also occurs. To prevent this, a virtual administrator should be set and a virtual administrator password and personal menu file should be created and set instead of the administrator's personal menu file. Furthermore, if the login name of the virtual administrator matches the department code, that is, a menu for each department can be created. If the department code is set as the login name in the password data file, a menu for each department can be created according to the flowchart of FIG. If the personal menu of the person in charge is created from the personal menu of the virtual administrator (department), the personal menu of the administrator and the organizational menu can be separated.

In the present embodiment, the login name and the employee code have been explained as different, but since both are unique in the information system, if the employee code is used for the login name, the capacity of the password data file 5 will be small. Becomes
The work load of the information system management department is also reduced.

Further, although the present embodiment has been described by taking the organization within the company as an example, the invention can be applied to the organization including affiliated companies. For example, if there is a head office and a plurality of affiliated companies, if the affiliated companies are positioned in one department and incorporated into the organization data file, the person in charge of the affiliated companies can also use the menu of the security-controlled information system.

As described above, according to the present embodiment, the information processing system management section needs to manage the password of the user, but it is not necessary to be concerned with the permission range of each person. If the permission range of each person is decided by the upper manager of the organization and the intermediate managers below it, the range of the lower persons is inevitably decided, and therefore the error of the permission range is reduced. As described above, according to the present invention, it becomes possible to easily set the security management in accordance with the organization chart of a company, and it becomes impossible for a subordinate to use the data beyond the scope of the organization chart. Confidentiality and security are improved.

[0027]

According to the present invention, it is possible to reduce the work load of the information system management department and set the security suitable for the department by creating the personal menu of the subordinate from the menu of the superordinate. As a result, confidentiality and security are enhanced. Further, since the lower-ranking person accesses the information system only from the menu which is restricted based on the menu held by the higher-ranking person, the security of confidentiality is enhanced. In addition, since the person in charge can create and edit his or her own menu within the permitted range based on the menu of the superior, the operability and visibility when operating the information system are improved. In addition, even if the person in charge moves to another department due to a personnel change, the permission range of the person can be changed simply by updating the organizational data, so the workload of the information system management department can be reduced, and the personnel change and the permission range can be changed. The time difference between changes can be eliminated. Also, by means of a security management device equipped with means for creating a personal menu for a subordinate from a menu for a superordinate,
The work load of the information system management department can be reduced.

[Brief description of drawings]

FIG. 1 is a functional block diagram showing an embodiment of a security management method according to the present invention.

FIG. 2 is a configuration diagram showing an example of a password data file.

FIG. 3 is a configuration diagram showing an example of a personal menu file.

FIG. 4 is a configuration diagram showing an example of an organization data file.

FIG. 5 is a flowchart showing an embodiment of a security management method according to the present invention.

FIG. 6 is a screen showing an embodiment of a personal menu created according to the present invention.

FIG. 7 shows a security management method according to the present invention,
It is a flowchart which shows one Example in case a person in charge creates his own menu.

FIG. 8 is a security management method according to the present invention,
It is a flow chart which shows an example when a person in charge changes to another department by personnel change.

FIG. 9 is a screen showing an example of an operation of creating a personal menu.

FIG. 10 is a screen showing an example of a menu corresponding to an organizational hierarchy.

[Explanation of symbols]

 1 Input device 2 Check part 3 Menu creation part 4 Display device 5 Password data file 6 Organization data file 7 Personal menu file

Claims (5)

[Claims] 1. A menu creating function for creating a user-specific menu by selecting only a process or data required by a user from a prepared process or data selection menu,
In the security management method having the user identification function for identifying the user of the information processing system and the management function of the organizational data to which the user belongs, the processing of the arbitrary user A or the data selection menu by the menu creation function. When creating, a search is made for a superior of a department or an organization to which the user A belongs based on the organizational data, and the process and data selection menu range used by the department or superior is created. And security management method. 2. The security management method according to claim 1, wherein when the user A uses a processing and data selection menu, the user A identified by the user identification function is the user. A security management method characterized in that only processes and data selection menus created by persons other than person A can be used. 3. The security management method according to claim 1, wherein when the user A creates a process or a data selection menu of the user A by a menu creation function, the usage is based on the organizational data. A person who searches for a superior of the department or organization to which the person A belongs and is created from the process and data selection menu defined by limiting the range of the process and data selection menu used by the department or superior. Security management method. 4. The security management method according to claim 1, wherein when the organizational affiliation of the user A is changed, the previously created in the process of changing the organizational data. A security management method characterized by invalidating the processing of the user A or the data selection menu. 5. A menu creating means for creating a user-specific menu by selecting only a process or data required by the user from a prepared process or data selection menu,
In a security management device provided with a user identification means for specifying a user of an information processing system and a management means for managing organizational data to which the user belongs, a menu creation means is used to process a user A or select a data selection menu. When creating the, a means for searching the department to which the user A belongs or the superior of the organization based on the organizational data and creating from the range of the process and data selection menu used by the department or the superior A security management device.