JPH10289209A - Access control method in information processing system including communication line - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide an access control method in an information processing system including a communication line which automatically changes a password that is used for access between a manager and an agent through a communication line to prevent illegal access and improves the operability and safety of the information processing system. SOLUTION: When an agent receives a message from a manager (S101) and its password is authenticated (S102 and S103), the agent automatically assigns a new password (S105) and automatically performs the updating of the password by notifying the result of request processing and the new password to the manager (S106) after executing the request processing from the manager (S104).

Description

DETAILED DESCRIPTION OF THE INVENTION

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to an information processing apparatus system in which an apparatus having an information processing manager function and an apparatus having an agent function are connected via a communication line. The present invention relates to an access control method between devices having the same.

[0002]

2. Description of the Related Art In recent years, a software module (agen) which can judge what to process and execute it by itself.
(t, agent) to build an information processing system. For example, using an agent to implement a passenger aircraft reservation system, if a user specifies "I want to arrive in New York in the morning of Wednesday" without specifying the airline and time, If the first hope is full, book the next best flight,
The agent can proceed with such a series of processing while judging by himself.

[0003] Therefore, a travel agency (generally called a manager) transmits the information "want to arrive in New York in the morning of Wednesday" obtained from a customer to an agent via a communication line, and returns a passenger aircraft reservation returned from the agent. An information processing system for selling boarding passes based on information can be constructed. The agent has the same functions as the object-oriented objects such as data and procedures for handling data, as well as a knowledge base that makes it possible to use the data and procedures appropriately according to the situation.

[0006] Between the device having the information processing manager function and the device having the agent function as described above, transmission and reception of commands for requesting required information processing and transmission of a processing result of executing the request are performed. Done. The device having the manager function and the device having the agent function may be directly connected in one-to-one or one-to-N (a plurality of N), or may be connected via a network. In a direct connection or a connection through a local network, unauthorized access from an external device can be prevented, but in a connection through a public network, there is a possibility of unauthorized access.

[0005] As a method for preventing unauthorized access, a method using a password for authentication at the time of access is a general and simple method. However, the password may be stolen, and a method of periodically changing the password is effective for ensuring security. Conventionally, the change of the password is generally performed by an operation of a maintenance person on an access side, that is, a manager side.

[0006]

As described above, a password authentication function in access control between a device having a manager function and a device having an agent function in a conventional information processing system including a communication line requires security assurance. From this point, it is necessary to periodically change the password. However, the password change operation and the management of the set password have to be performed by the operation of the manager on the manager side. Therefore, there is a problem that the management and operation of the password become complicated, and the operability and the security of the information processing system are reduced when the password is not regularly changed.

[0007]

According to the present invention, there is provided an access control method in an information processing system including a communication line, wherein an apparatus having an information processing manager function and an apparatus having an agent function are connected via the communication line. In the access control method between the device having the manager function and the device having the agent function in the information processing system, the device having the manager function accesses the device having the agent function using a current password in order to request required information processing. At this time, the device having the agent function automatically assigns a new password, and notifies the requested device having the manager function of updating the password automatically. As a result, the possibility of unauthorized access is reduced, the operability of the information processing system is improved, and safety is maintained.

[0008]

FIG. 2 is a diagram showing an example of a functional configuration of an information processing system including a communication line according to the present invention. The system shown in FIG. 2 includes a device having a manager function (hereinafter simply referred to as a manager) and an agent. A device having a function (hereinafter simply referred to as an agent) is connected by a communication line. In FIG. 2, the manager 11 includes a manager business function unit 101, a manager-side password management function unit 102, an OS / communication function unit 103, and a terminal device 13. The agent 12 includes an agent business function unit 104 and an agent-side password management function unit 10
5 and an OS / communication function unit 106. In addition,
The system in FIG. 2 is a system commonly used in the first and second embodiments of the present invention.

The manager job function unit 101 shown in FIG. 2 is a job application for executing an information processing job, and has an operation for a process job and a screen control function of the terminal device 13. The manager-side password management function unit 102 manages a password required to access an agent, and has a function of managing a different password for each of a plurality of agents. OS / communication function unit 103
Has a function of communicating messages with the agent and the terminal device 13 and a basic function of operating the information processing system.

Embodiment 1 FIG. 3 is a configuration diagram of a manager-side password management function unit according to Embodiment 1 of the present invention. The password management function unit 201 of FIG. 3 manages password information to be added to a message when accessing a plurality of agents, for each agent. Password management data section 202-1 to
202-n is a data table for managing different password information for each agent. The password data exists by the number of agents to be managed, that is, from 1 to n.

FIG. 4 is a configuration diagram of the agent-side password management function unit according to the first embodiment of the present invention. The password authentication function unit 301 in FIG. 4 checks password collation when accessed by the manager. The password assignment function unit 302 is a function for generating a new password for a normally accessed manager and responding to the manager. The password data part 303 is
This function is to store the currently used password data for authentication.

FIG. 1 is a flowchart showing a password management process on the agent side according to the first embodiment of the present invention. Numerical values following S in FIG. 1 indicate step numbers. When an access request from the manager is received by the agent-side password management function unit (see FIGS. 2 and 4), the processing in FIG. 1 is started. After receiving the message from the manager (S101), the agent-side password management function unit
Read password information from the received message (S
102), comparison and collation (S103) with the password data managed by the password data unit 303 are performed, and it is determined whether or not both data match. If the result of this collation / determination is a mismatch, an access rejection response is sent to the manager (S107), and the process ends. If the result of the comparison with the password data matches, a request process from the manager is executed (S104). afterwards,
The password assignment function unit 302 assigns a new password (S105), and notifies the assigned new password information to the requesting manager as response information together with the result of the request processing (S106).

As described above, according to the first embodiment, in the access control of the information processing system including the communication line, when the manager accesses the agent by the business application, the agent automatically assigns a new password. By notifying the manager of this, the access password to the agent from the manager is automatically updated, so that forgetting to change the password can be prevented, and the security and operability of the information processing system can be improved. Can be done.

In the example of the first embodiment, the password information managed by the agent is one. However, when there are a plurality of managers accessed by the business application, a plurality of password information is provided so that a different password is provided for each manager. Can also be managed.

According to the first embodiment, when the manager accesses the agent when a business application is needed, the password is automatically updated to the new password. Otherwise, the update to the new password will not be performed automatically.
If the password is not changed for such a long period of time, the possibility of unauthorized access increases, so in the present invention, in addition to the first embodiment, a second embodiment to be described later
Function was added.

Embodiment 2 FIG. 6 is a configuration diagram of a manager-side password management function unit according to Embodiment 2 of the present invention. The password management function unit 401 in FIG. 6 manages password information to be added to a message when accessing a plurality of agents for each agent. Password management data section 405-1-
A data table 405-n manages password information that differs for each agent. The password data exists by the number of agents to be managed, that is, from 1 to n. The timing generation function unit 402 generates an access timing for the agent. The timing monitoring function unit 403 includes the timing generation function unit 40
It is started at regular intervals from Step 2 and polls each agent for a password change. The access state management unit 404 manages whether or not each agent has been accessed during the certain period.

FIG. 5 is a flowchart of a password change polling process on the manager side according to the second embodiment of the present invention. Numerical values following S in FIG. 5 indicate step numbers.
The flowchart of FIG. 5 will be described. In FIG. 5, first, the monitoring of the access timing to the agent (S201) is started at regular intervals. That is, the access state management unit 404 of FIG. 6 determines whether an access request has been made to each agent during the certain period (S20).
2) If already accessed, the value of the access state (in this case, the number of accesses) is initialized (S20).
3) (that is, the number of accesses is returned to zero). If the result of determination in S202 is that there has been no access within the fixed period, a polling message for password change is transmitted to the agent (S20).
4). Then, upon receiving the notification of the new password from the agent, the password data on the manager side is changed to the new data. These series of operations are sequentially performed on the agents to be managed.

As described above, according to the second embodiment, in the access control of the information processing system including the communication line, the function of monitoring the presence or absence of access to the agent at regular intervals on the manager side is provided. Even if there is no access to the agent by the business application within a certain period, a new password acquisition request is accessed at a certain period, and the agent changes the password according to this request periodically and automatically. By using the first and second embodiments together, the safety and operability of the information processing apparatus system can be further improved.

In the example of the second embodiment, the password change timing is monitored for a plurality of agents at the same timing. However, by managing different timing values for each agent, the monitoring timing is changed for each agent. You can change it.

[0020]

As described above, according to the present invention, an apparatus having the manager function in an information processing system in which an apparatus having a manager function and an apparatus having an agent function of an information processing apparatus are connected via a communication line. And an access control method between the function having the agent function and the function having the agent function, when the device having the manager function accesses the device having the agent function for the required information processing using the existing password, the device having the agent function is Automatically assign a new password,
The password is automatically updated by notifying the request to the device having the manager function, so that the possibility of unauthorized access is reduced, the operability of the information processing system is improved, and the security is improved. Nature is maintained.

[Brief description of the drawings]

FIG. 1 is a flowchart showing a password management process on an agent side according to a first embodiment of the present invention.

FIG. 2 is a diagram showing a functional configuration example of an information processing system including a communication line according to the present invention.

FIG. 3 is a configuration diagram of a manager-side password management function unit according to the first embodiment of the present invention.

FIG. 4 is a configuration diagram of an agent-side password management function unit according to the first embodiment of the present invention.

FIG. 5 is a flowchart of a polling process for a manager-side password change according to the second embodiment of the present invention.

FIG. 6 is a configuration diagram of a manager-side password management function according to a second embodiment of the present invention.

[Explanation of symbols]

DESCRIPTION OF SYMBOLS 11 Manager 12 Agent 13 Terminal device 101 Manager business function part 102,201,401 Manager side password management function part 103 OS / communication function part 104 Agent business function part 105,301 Agent side password management function part 106 OS / communication function part

Claims (2)

[Claims] 1. An access control method between an apparatus having a manager function and an apparatus having an agent function in an information processing system in which an apparatus having an information processing manager function and an apparatus having an agent function are connected via a communication line. In, when the device having the manager function accesses the device having the agent function using a current password to request the required information processing, the device having the agent function automatically assigns a new password, and An access control method in an information processing system including a communication line, wherein a password is automatically updated by notifying a device having a manager function that has made a request. 2. An access control method between an apparatus having a manager function and an apparatus having an agent function in an information processing system in which an apparatus having an information processing manager function and an apparatus having an agent function are connected via a communication line. In the device having the manager function, when the device having the agent function is accessed using the existing password to request the required information processing, the device having the agent function is automatically assigned a new password and In the case where the access for the request for the required information processing is not performed within a certain time, the access for the request for obtaining the new password is performed to the device having the agent function, and the device having the agent function periodically transmits the new password. Pass by receiving assignment Access control method in an information processing system including a communication line, characterized in that updating the over de automatically and periodically.