JPH11353276A - Access controller - Google Patents

Abstract

PROBLEM TO BE SOLVED: To perform access control which is improved in secrecy and convenience by providing an address information setting means which sets address information for sending a specific log, a specific log transmitting means which transmits the specific log according to the address information, etc. SOLUTION: A log storage means 11 stores a log L relating to an access request Aq sent through a network 20. A specific log extracting means 12 extracts the specific log La from stored logs L. A log processing means 13 processes the extracted specific log La. An address information setting means 14 sets the address information for transmitting the specific log La to an administrator and the user himself. The address information includes, an electronic mail address, a telephone number, an IP address, etc. Then a specific log transmitting means 15 sends the specific log La to the administrator or the user himself according to the set address information.

Description

DETAILED DESCRIPTION OF THE INVENTION

[0001]

[0001] 1. Field of the Invention [0002] The present invention relates to an access control device, and more particularly to an access control device for managing and controlling a user's access request to a computer system.

[0002]

2. Description of the Related Art Conventionally, a communication device such as a remote access server having a user authentication function has a log acquisition function for recording a time transition when a service is used. In addition, all of the acquired logs are sent to the specified destination (mainly administrator)
Sent to

[0003] By having such a function, even when an illegal act such as repeatedly trying a password is performed, an authentication error for the account is recorded in a log, so that it can be easily detected.

[0004]

However, in the above-described conventional log management technology, when a password is leaked to a third party and an unauthorized intrusion is performed with the password, an administrator can view the log. However, there is a problem that the intrusion is overlooked because it cannot be distinguished from normal access.

[0005] Conventionally, the accumulated logs include a large amount of information including unnecessary information, and there has been a problem that necessary information cannot be easily extracted. For example, with regard to access information used for original data such as billing and telecommuting, once the logs accumulated for a certain period of time are extracted, information about a certain account is extracted, the total is calculated, and then the user is This procedure was very inconvenient because it had to be sent separately to the person.

[0006] The present invention has been made in view of such a point, and an object of the present invention is to provide an access control device which improves confidentiality and convenience.

[0007]

According to the present invention, there is provided an access control apparatus for managing and controlling a user's access request to a computer system.
A log storage unit for storing a log related to the access request; a designated log extraction unit for extracting a designated log from the accumulated logs; and destination information for transmitting the designated log. Address information setting means for performing
A designated log transmitting unit for transmitting the designated log based on the destination information.

Here, the log accumulation means accumulates a log related to the access request. The designated log extracting means extracts a designated designated log from the accumulated logs. The destination information setting means sets destination information for transmitting the designated log. The designated log transmitting means transmits the designated log based on the destination information.

[0009]

Embodiments of the present invention will be described below with reference to the drawings. FIG. 1 is a principle diagram of an access control device of the present invention. The access control device 10 manages and controls a user's access request to the computer system.

Specifically, the log (L) of the access request Aq
OG), the access request Aq of the user and the access right are verified, and unauthorized access is restricted, and a warning is issued. In addition, it not only prevents unauthorized use of the system, but also recovers failures and provides communication information to users.

The log storage means 11 stores a log L related to the access request Aq sent through the network 20. The designated log extracting unit 12 extracts a designated designated log La from the accumulated logs L. That is, log information required by an administrator or a user is extracted.

The log processing means 13 extracts the designated log L
Process a. For example, by adding information such as the access time and date to the designated log La, information processing is performed so that an administrator or a user can easily understand the information.

[0013] The destination information setting means 14 transmits the designated log La.
Set destination information for sending to the administrator or the user himself / herself. Email address,
There are a telephone number, an IP address, and the like.

The destination information setting means 14 sets destination information for each account registered in the system in order to use computers and network resources. In this case, one piece of destination information may be set for one account, or a plurality of pieces of destination information may be set for one account.

The designated log transmitting means 15 transmits the designated log La to the administrator or the user himself or herself based on the set destination information. Next, the operation will be described. FIG. 2 is a flowchart showing an operation procedure of the access control device 10. [S1] The log accumulation means 11 accumulates a log L related to the access request Aq. [S2] The designated log extracting means 12 extracts the designated designated log La from the accumulated logs L. The log processing means 13 processes information as needed. [S3] The destination information setting means 14 sets destination information for transmitting the designated log La. [S4] The designated log transmitting unit 15 transmits the designated log La based on the destination information.

Next, a case where the access control device 10 is applied to a communication device having a user authentication function will be described. FIG. 3 is a diagram illustrating a configuration of a communication device to which the access control device 10 is applied.

The communication device 100 includes an access control device 10
And controls access management and information communication for restricting access from unauthorized persons. The input I / F 101a is
It controls the input interface for communication requests and communication information from the source.

The user registration means 102 registers a user account and a password in advance. The user authentication unit 103 performs authentication control using the registered account and password.

The output I / F 101b is connected to the user authentication means 1
If the user is authenticated in 03, the communication information output interface from the transmission source is controlled and transmitted to the communication target.

That is, only information from a source having a registered account can reach a communication target through the output I / F 101b. Then, every time such an access is made, the log storage unit 11 in the access control device 10 stores the log L related to the access request.

From the stored logs, designated log extracting means 12 extracts log information meeting specified conditions (access time, total access time, etc.). Further, the log processing means 13 performs information processing of the designated log as needed.

The destination information setting means 14 sets one or more pieces of destination information of the log information providing destination for one account. The designated log transmitting means 15 sends an e-mail, a FA to a log information providing destination in accordance with one-to-one or one-to-many destination information for a user-registered account.
Send by X, telephone or other means.

As described above, the access control apparatus 10 of the present invention extracts the designated log La from the accumulated log L related to the access request Aq, and transmits the designated log La based on the destination information. did.

Thus, the access log, which has been sent only to the administrator in the past, can be sent to the accessing user only for the user's access.
Therefore, an access by a third party who illegally obtains the password, which is difficult to detect by monitoring by the administrator, is notified to the user of the account, so that the intrusion can be easily detected.

Therefore, it is possible to improve the security level in a range that cannot be covered by the conventional security protection (for example, detection of an illegal access in which an access method leaks for some reason).

Further, for a user having an account,
Since access information can be set to be sent to the administrator of the user, it is possible to easily manage time and attendance at home and work at home.

In the above description, the log related to the access request is extracted and transmitted. However, logs related to other communication information and the like are accumulated and extracted in the same configuration.
May be sent.

[0028]

As described above, the access control apparatus of the present invention extracts a designated log from the accumulated logs related to the access request and transmits the designated log based on the destination information. As a result, it is possible to easily monitor unauthorized access by the user himself, and manage the access status by an administrator different for each user, thereby improving confidentiality and convenience.

[Brief description of the drawings]

FIG. 1 is a principle diagram of an access control device of the present invention.

FIG. 2 is a flowchart illustrating an operation procedure of the access control device.

FIG. 3 is a diagram illustrating a configuration of a communication device to which an access control device is applied.

[Explanation of symbols]

10 access control device, 11 log storage means, 1
2 ... designated log extracting means, 13 ... log processing means, 14
... destination information setting means, 15 ... designated log transmission means,
20: Network, Aq: Access request, L:
Log, La ... Designated log.

Claims (3)

[Claims] 1. An access control device for managing and controlling a user's access request to a computer system, comprising: a log storage unit for storing a log related to the access request; and a designated log specified from the stored logs A designated log extracting means for extracting the specified log, a destination information setting means for setting destination information, and a designated log transmitting means for transmitting the designated log based on the destination information, An access control device comprising: 2. The access control device according to claim 1, wherein the destination information setting means sets the destination information for each account. 3. The access control device according to claim 1, further comprising a log processing unit that processes the extracted designated log.