JPH11353277A - Security management system - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide a security management system which can easily construct a security system with high operability. SOLUTION: This system includes a lock system storage means 100 which stores a lock system consisting of one or more sets of lock architectures consisting of hierarchized locks where the numeric ranges 110b, 11b... and attributes 110a, 111a... are set to the locks 110, 111... corresponding to the nodes of a tree structure and the users are prescribed according to the numeric range set to every lock, a key storage means 200 which stores the user keys 211, 212... and a lock system access means 300 which receives the authentication information 10 on users as the input data, retrieves a lock where the numeric range including the user key is set among those locks and returns the attribute that is attached to the retrieved lock.

Description

DETAILED DESCRIPTION OF THE INVENTION

[0001]

The present invention relates to a security management system for managing security of a computer application system.

[0002]

2. Description of the Related Art Conventionally, for a processing function provided in an application system of a computer, it is possible to manage security of the application system by setting whether or not use of the processing function is permitted for each user. Widely used. In recent security management systems, using a GUI (graphic user interface) technology, a processing function that is permitted to be accessed is displayed on a menu screen in a form that is easy for the user to understand. For example, among the plurality of processing functions, processing functions that are permitted to the user and processing functions that are not permitted are displayed in different display colors,
Or, processing functions that are not allowed are displayed in halftone.

[0003]

In order to perform such security management, access rights for each user are set for a plurality of processing functions provided in an application system of the computer, and the setting result is obtained. Must be stored in the application system. Here, when a plurality of application systems are incorporated in the computer, it is necessary to set the access authority of each user for each processing function of each application system. In addition, the user needs to store, for example, a user ID or the like for allowing the computer to authenticate his or her own access right set in each of the application systems.

For example, if a conference room reservation system and a dispatch management system are incorporated in a certain computer system, it is necessary for a user of this computer system to use a user ID set for each of these two application systems. is there. Further, for example, when the conference room reservation system is started using the user ID of the conference room reservation system and the vehicle allocation management process is attempted to be performed at the same time as the conference room reservation process is being performed, the user ID of the vehicle allocation management system is used again. As the number of application systems increases, such as the need to log in, such security systems become extremely troublesome for users. Also, for the computer system, the task of constructing such a security system for each application system is extremely complicated, and it is necessary to maintain the security system in accordance with the upgrade of the application system and personnel changes of users. However, there is a problem that it requires a great deal of cost and time. The present invention has been made in view of the above circumstances, and has as its object to provide a general-purpose security management system that has good operability for a user and can easily construct a security system for a plurality of application systems.

[0005]

According to the security management system of the present invention for achieving the above object, a numerical range is set for each lock corresponding to each node of the tree structure, and each lock is specified for each lock. Attribute is added,
A plurality of hierarchical locks in which the user of each lock is defined by a numerical range set for each lock, and the attribute added to each lock characterizes the application system and the hierarchical structure of the application system. A lock system that is associated with an application system and that includes one or more lock systems in which a numerical range is set for each application system and an attribute is added to each lock. Locking system storage means,

[0006] Key storage means for storing a numerical key associated with each user, and authentication information for identifying each user are received as input data. Lock system access means for searching for a lock in which a numerical range including a key of a specified user is set, and returning an attribute attached to the lock obtained by the search. In this security management system, the user of the application system is abstracted and represented as an object called “key” (key), and the target business to be used is expressed as an object called “lock” (lock). A numerical range is set for each “lock”, and the “key” consisting of numerical values is compared with the numerical range of “lock”, and the “key” is set to “lock”.
It is determined whether or not to open the “lock”, that is, whether or not to permit the user to use the lock, based on whether or not the lock is included in the range.

Here, the security management system is configured such that, when there are a plurality of lock systems constituting the lock system, mutually different numerical ranges are assigned to the plurality of lock systems. Is preferred. In this security management system, the numerical range of one or more lower-level locks directly connected to one upper-level lock in one lock system is a numerical range of one upper-level lock. As described above, it is also a preferable embodiment that the lock is configured such that a numerical range is set. Further, the security management system includes a system construction means for assigning a numerical range and an attribute to each of a plurality of layered locks constituting the lock system and setting a key corresponding to a user. It is also preferred.

[0008]

Embodiments of the present invention will be described below. FIG. 1 is a system configuration diagram showing an embodiment of the security management system of the present invention. As shown in FIG. 1, the security management system 1 includes locks 110, 111, 11 corresponding to respective nodes in a tree structure.
Levels 110b, 111b, 112b, 120b, 1 each having a numerical range for 2, 120, 121, 122
21b and 122b are set, and each lock 11
0, 111, 112, 120, 121, and 122 have attributes 110a, 111a, and 112 that specify these locks.
a, 120a, 121a, and 122a are added, and the levels 110b and 11 each include a numerical range set for each lock.
1b, 112b, 120b, 121b, 122b define the user of each lock and attributes 110a, 111a, 112a, 120a,
A plurality of layered locks 110, 11 that characterize the application system and the hierarchical structure of the application system by 121a, 122a.
1, 112, 120, 121, 122, and the lock system 10 associated with the application system.
1,102.

The security management system 1 includes locks 110, 111, 112, 120, 121, 12
Second, the levels 110b, 111b, 112b, 120b, 121 consisting of numerical ranges for the application system
b and 122b are set and the attributes 111a and 11b are set.
A lock system storage means 100 for storing a lock system in which two lock systems 101 and 102 to which 1a, 112a, 120a, 121a and 122a are added, and a numerical value associated with each user. Key storage means 20 for storing keys 211, 212, 221
0 and authentication information 10 specifying each user are received as input data, and the lock system is searched for a lock in which a numerical range including the key of the user specified by the authentication information 10 is set, A lock system access unit 300 for returning an attribute attached to a lock obtained by the search, a numerical range and an attribute are given to each of a plurality of hierarchical locks constituting the lock systems 101 and 102, and a user is provided with the lock system access unit 300. A system construction unit 400 for setting the associated key is provided.

In the present embodiment, as described above, the two lock systems 101 and 10 constituting the lock system are used.
Although an example in which 2 is present is given, the number of lock systems may be one or an arbitrary plurality. However, when the number of lock systems is plural, it is preferable that different numerical ranges are assigned to the lock systems. As shown in FIG. 1, in the present embodiment, the level 1 of the lock system 101 is used.
Numerical ranges of 1 to 10 are assigned to 10b, 111b, and 112b, and the levels 120b,
Numerical ranges of 11 to 20 are assigned to 121b and 122b, and the numerical ranges of both do not overlap.

With such a configuration, for example,
When the system 1 is a bank online system and the system 2 is a ticket sales system, there is no interference between the two systems. Therefore, a plurality of lock systems are stored in one lock system storage unit 100. Is preferred. Further, in the present embodiment, one lock system directly connected to one upper-layer lock in one lock system.
The numerical range is set for each lock so that the numerical range obtained by integrating the numerical ranges of one or more lower locks becomes the numerical range of one upper lock. For example, as shown in FIG. 1, each level 111b, 11 of the lower locks 111, 112 directly connected to the upper lock 110.
Each lock 110, 111, 11 is set so that the numerical range obtained by integrating 2b is the level 110 b of the upper lock 110.
2, the levels 110b, 111b, and 112b are set. Between the levels of subsystems in the same hierarchy,
Numeric ranges may or may not overlap. For example, there is no overlap between levels 111b and 112b of subsystem 11 and subsystem 12 in FIG. In the case of this method, the user needs to have keys for the subsystem 11 and the subsystem 12 separately. This method has the disadvantage of increasing the number of keys, but also has the advantage that lock setting is easy. In this system, for example, when the system 1 is an online system of a bank, the subsystem 11 is set in a unit called an accounting system and the subsystem 12 is set in a unit called an information system.

On the other hand, in FIG. 1, the levels 121b,
122b has an overlap. This method is effective when it is desired to manage a plurality of subsystems with one key. For example, by setting the subsystem 21 for a general user and the subsystem 22 for a system administrator, both subsystems can be used by a system administrator having a key of 15 or more. it can.

Next, the operation of the security management system 1 will be described with reference to FIG. When a user ID and a password are input to the security management system 1 as authentication information 10 from the user, the lock system access unit 300 provided in the security management system 1 stores the authentication information 10 in the lock system storage unit 100. Keys 211 and 2 of the user specified by
Lock 110,1 consisting of a numerical range including 12,221
11, 112, 120, 121, 122, and the attribute 20 (attribute 11) attached to the lock obtained by the search.
0a, 111a, 112a, 120a, 121a, 12
2a) to the user.

For example, if a user A inputs authentication information 10 including his / her user ID and password into the security management system 1, the lock system access means 300 of the security management system 1 Locks 110 and 11 inside
1, 112, 120, 121, 122 are searched, and a lock 110, which is a numerical range including keys 211, 212 specified by the authentication information 10 of the user A, is searched from these.
111 and 112 are selected. Similarly, user B
Authentication information 1 consisting of own user ID and password
If 0 is input to the security management system 1,
The lock system access unit 300 of the security management system 1 stores the locks 110, 111, 112, 120, 121, 122 in the lock system storage unit 100.
And locks 120 and 121 having a numerical range including the key 221 specified by the authentication information 10 of the user B are selected from these. Here, the lock 122 is not selected because its level 122b is 15 to 20, and does not match the key 221 of the user B having the numerical value 14. The information thus obtained, that is, which systems and subsystems are permitted to be used by the user, and which systems and subsystems are not permitted to be used are determined by the user interface described later. Notified.

As described above, in the security management system according to the present embodiment, the objects to be handled are not infixed but are indirectly represented by the abstract concept of lock and key, and the key (numerical value) of the user is Since the lock numerical value range is determined by comparing numerical values, versatility for a plurality of application systems can be secured, and security of a plurality of application systems can be comprehensively managed by one security management system. Become. On the other hand, in the conventional security system, since the key of the user and the lock of the target business are set by character strings, the user and the business target used are limited to specific objects in the real world. For this reason, there is no choice but to be a security system dedicated to a specific system without versatility.

In the conventional security system,
For example, if the target business to be handled is a conference room reservation system, the hierarchical structure is fixedly expressed as building-floor-meeting room, and if the dispatching management system is a business office-vehicle number, etc. It is a security system. On the other hand, the security management system of the present embodiment expresses the target business in the tree structure by replacing it with the abstract concept of lock. It is a system that can do. Note that the above lock is an abstraction and is difficult for users to understand, so it is used only for processing within the security management system.
On the interface for the user, the attribute is converted into an attribute that is easy for the user to understand, for example, a target business name, and then output.

Next, computer hardware in which the security management system is stored will be described.
FIG. 2 is a schematic diagram of computer hardware in which the security management system of the present embodiment is stored. FIG.
As an example, a file server 510, a printer server 520, and three clients 530 and 54
0, 550 are connected to each other via a communication line 560. Each of these servers and clients is configured as a computer system, and includes main units 511 and 52 in which a CPU, a main storage device, an auxiliary storage device, and the like are built.
1,531,541,551, keyboards 512,522,5 for inputting various instructions to each computer system
32, 542, 552, and displays 513, 523, which display a screen and provide various information to an operator.
533, 543, and 553 are provided.

The main body 511 of the file server 510 includes a large-capacity auxiliary storage device 514, in which the lock system storage unit 100, the key storage unit 100, and the key unit of the security management system 1 (see FIG. A security management program having a storage unit 200, a lock system access unit 300, and a system construction unit 400 is stored. The system construction means 400
Is not an indispensable means for the security management system 1 of the present invention.
A configuration not including the system construction means 400, independent software having the same function as that of the system construction means 400 in this embodiment is separately prepared, and the above-described lock system is configured using the software. A numerical range and an attribute may be assigned to each of the plurality of locks, and a key associated with the user may be set. However, from the viewpoint of operability, it is preferable to adopt a configuration in which the system construction means 400 is incorporated in the security management system 1 as in the present embodiment.

The security management system is stored in a program storage medium 516. When setting up the security management system in the computer system 500, the security management system is provided via a storage medium reading device 515 provided in the main body 511 of the file server 510. Is read into the large-capacity auxiliary storage device 514. Printer server 520
Is connected to a high-speed printer 524, and plays a role as a printing device common to the computer system 500.

Next, a method of operating the security management system using the computer system 500 will be described. A certain user operates one of the clients 530 and 54 of the computer system 500 shown in FIG.
0,550 is launched, and the user ID is entered from the keyboard.
And authentication information such as a password, and when the authentication information is approved as valid authentication information by the system, the authentication information 10 is transferred to the security management system 1 (see FIG. 1) set up in the file server 510. ). The lock system access unit 300 of the security management system 1 receives the authentication information 10 as input data, and
00, a lock in which a numerical range including the user key specified by the user authentication information 10 is set is searched, and the attribute 20 attached to the lock obtained by the search is returned to the user. .

In this way, the attribute 2 of the system or the subsystem to which the user is permitted to use is given to the user.
0, for example, a business menu name is presented. As the user interface for presenting the attribute 20 to the user, a standard interface incorporated in the security management system 1 may be used, or a user interface customized by each user for each client computer May be used.

Next, a screen configuration used for constructing the security management system of the present embodiment will be described. FIG. 3 is a main screen of the security management system according to the present embodiment. FIG. 3 shows a window of the business menu list 621 displayed on the upper side of the main screen 600 and a window of the business menu use permission group 622 displayed on the lower side. In the window of the task menu list 621, a task system name is displayed at each node of the tree structure. The user group and the user assigned to the task menu selected in the tree of the task menu list 621 are displayed in the window of the task menu use permission group 622 on the lower side.
When not selected, the window of the business menu use permission group 622 is blank. A business setting-edit dialog (see FIG. 10) can be displayed by double clipping the business menu item in the tree.
Further, by double-clipping an item in the window of the lower work menu use permission group 622, a list (not shown) of users belonging to the user group can be displayed.

When "business menu 2" is selected from the business system names displayed in the business menu list 621, the access to the "business menu 2" is displayed in the window of the lower business menu use permission group 622 on the lower side. Are authorized user groups, such as "Application Development Department", "Network Management Department", "Multimedia Systems Department", "System Integration Department", "Sales Department", "General Affairs Department", etc. Is displayed. Using the main screen 600, a [File (F)] menu 611, an [Edit (E)] menu 612, and a [Display (V)] menu 61 on the menu bar 610 are displayed.
3. By selecting one of the [Help (H)] menus 614, the tree structure display, new registration, and deletion of the business menu can be performed. When an item in the business menu use permission group 622 is not selected, the [use disapproval] command in the [edit (E)] menu 612 cannot be selected.

FIG. 4 shows a [File] menu screen of the security management system of this embodiment. In FIG.
Four commands of the [File (F)] menu 611 from the menu bar 610 of the main screen 600, that is, a [New] command 611a and an [Open] command 6
11b shows a part of the screen when the "new" command 611a is selected from the "print" command 611c and the "end" command 611d. By selecting the [Create New] command 611a, [User],
[User Group] and [Business] can be newly registered. The screen for new registration will be described later. The security management system according to the present embodiment can handle not only individual users but also user groups such as, for example, sales departments and general affairs departments.

[File (F)] menu 611
By selecting the [Open] command 611b, an edit screen for the business or user group can be displayed. Also, by selecting the [Print] command 611c, the contents displayed on the screen can be output from the printer. By selecting the [End] command 611d, the [File (F)] menu 611 is displayed.
Can be terminated.

FIG. 5 shows an [Edit] menu screen of the security management system of the present embodiment. FIG. 5 shows four commands of the [Edit (E)] menu 612, that is, [Cut / Copy / Paste], [Search], [Delete], and [Unusable].

FIG. 6 shows a [Display] menu screen of the security management system of the present embodiment. FIG. 6 shows three commands of the [Display (V)] menu 613, that is, [User List], [User Group List], and [Update to Latest Information]. [Edit (E)] menu 612 and [Display (V)] shown in FIGS. 5 and 6
The description of the details of the commands in the menu 613 will be omitted because it becomes complicated. Next, users, user groups,
A screen for registering a new business will be described.
Menu bar 610 of menu screen 600 shown in FIG.
When the [New] command 611a of the [File (F)] menu 611 is selected from the list, the following screen is displayed.

FIG. 7 is a registration screen of a new user of the security management system of the present embodiment. As shown in FIG. 7, a new user can be registered using the main screen 600. On the main screen 600, a business menu list 631 is displayed on the upper side, and a business menu use permission group screen 632 is displayed on the lower side. When a “New” command 611 a of the “File (F)” menu 611 on the menu bar 610 is selected, a “User” command, a “User group” command, and a “Business” command are displayed. When the [User] command is selected, a new user registration window 640 as shown in the lower right of FIG.
00 is superimposed and displayed. In the text boxes 641, 642, 643 in that, the ID, name,
Enter each password, and then enter properties 64
As 4, the new user is registered by inputting the reading, affiliation, age, gender, telephone number, and date of birth and pressing a [register] button 645. [Close] button 646
Pressing terminates the registration of the new user.

FIG. 8 is a registration screen of a new user group of the security management system according to the present embodiment. As shown in FIG. 8, a new user group can be registered using the main screen 600. On the main screen 600, a business menu list 631 is displayed on the upper side, and a business menu use permission group screen 632 is displayed on the lower side. When a “New” command 611a of the “File (F)” menu 611 of the menu bar 610 is selected, a “User” command, a “User group” command, and a “Business”
The command is displayed. When the [user group] command is selected, a new user group creation window 650 as shown in the lower right of FIG. A new user group name is entered in a new user group name text box 651 and a [register] button 652 is pressed to register the new user group. By pressing the [Close] button 653, the registration of the new user and the new user group ends.

Next, a new business registration screen will be described. FIG. 9 is a registration screen of a new job of the security management system of the present embodiment. As shown in FIG. 9, a “New” command 611 of the “File (F)” menu 611 in the menu bar 610 of the main screen 600
Select "a" and execute the [Business] command. As shown in the lower right of FIG. 9, a new job registration window 660 is superimposed on the main screen 600, so that a new job name is entered in a text box 661 in the new job registration window 660, and a menu ID assigned to the new job name is assigned. Is selected in the combo box 662. The menu ID can be selected only from those displayed in the combo box 662, and new input cannot be performed. Next, by pressing a [register] button 663, the registration result is reflected in the tree structure of the business menu list 631. [Close] button 6
Pressing the button 64 completes the registration of the new business.

Next, the setting and editing of the usage permission for the business will be described. FIG. 10 is a setting edit screen of the use permission regarding the business of the security management system of the present embodiment. An item to be edited is selected in the [business menu use permitted group list] 632 on the main screen 600 shown in FIG. 8, and then, as shown in FIG.
Of the [File (F)] menu 611 from the menu bar 610 of FIG. A text box 671 in the job setting-edit window 670 displayed on the main screen 600 with the job menu to be updated and the menu ID assigned to the job menu to be updated
And a combo box 672, respectively. The menu ID can be selected only from those displayed in the combo box 672, but new input cannot be performed. Next, a user group that can use the business is assigned. A list of group names to which access is permitted is displayed in a use permission box 673a displayed in the business setting-edit window 670, and a list of group names to which access is not permitted is displayed in a use disapproval box 673b. Movement of permission and non-permission can be performed by the [←] and [→] commands displayed between the use permission box 673a and the use prohibition box 673b. By pressing the [register] button 674, the editing result is reflected in the tree structure of the business menu list 631. When the user presses a [Cancel] button 675, the setting and editing of the usage permission for the task ends.

As described above, the security management system 1 of this embodiment shown in FIG. 1 is constructed in the computer system 500 (see FIG. 2). Each user inputs authentication information including a user ID and a password into this security management system, and as to which application system is incorporated in the computer system 500, which system and which sub-system is permitted to be used. Can be instantly known.

[0033]

As described above, in the security management system of the present invention, the objects to be handled are indirectly expressed by the abstract concept of locks and keys without fixing the objects to be handled. It is possible to realize a general-purpose security management system that can comprehensively manage security of a plurality of application systems.

[Brief description of the drawings]

FIG. 1 is a system configuration diagram showing an embodiment of a security management system of the present invention.

FIG. 2 is a schematic diagram of computer hardware in which the security management system according to the embodiment is stored.

FIG. 3 is a main screen of the security management system according to the embodiment.

FIG. 4 is a [File] menu screen of the security management system of the embodiment.

FIG. 5 is an [Edit] menu screen of the security management system of the embodiment.

FIG. 6 is a [Display] menu screen of the security management system of the present embodiment.

FIG. 7 is a registration screen of a new user of the security management system according to the embodiment.

FIG. 8 is a registration screen of a new user group of the security management system according to the embodiment.

FIG. 9 is a registration screen of a new business of the security management system of the embodiment.

FIG. 10 is a setting edit screen of a usage permission related to a job of the security management system of the embodiment.

[Explanation of symbols]

DESCRIPTION OF SYMBOLS 1 Security management system 10 Authentication information 20 Attribute 100 Lock system storage means 101,102 Lock system 110,111,112,120,121,122
Locks 110a, 111a, 112a, 120a, 121a,
122a Attributes 110b, 111b, 112b, 120b, 121b,
122b Level 200 Key storage means 211, 212, 221 Key 300 Lock system access means 300 400 System construction means 500 Computer system 510 File server 511, 521, 531, 541, 551 Main body 512, 522, 532, 542, 552 Keyboard 513 , 523, 533, 543, 553 Display 514 Large-capacity auxiliary storage device 515 Storage medium reading device 516 Program storage medium 520 Printer server 524 Printer 530, 540, 550 Client 560 Communication line 600 Main screen 610 Menu bar 611 [File (F)] ] Menu 611a [New] command 611b [Open] command 611c [Print] command 611d [End] command 612 [Edit] (E)] menu 613 [Display (V)] menu 614 [Help (H)] menu 621 Business menu list 622 Business menu use permission group 631 Business menu list 632 Business menu use permission group screen 640 New user registration window 641 , 642, 643 Text box 644 Property 645 [Registration] button 646 [Close] button 650 New user group creation window 651 Text box 652 [Registration] button 653 [Close] button 660 New job registration window 661 Text box 662 Combo box 663 [Registration] button 664 [Close] button 670 Job setting-editing window 671 Text box 672 Combo box 673a Usage permission box 673 b Unauthorized use box 674 [Register] button 675 [Cancel] button

Claims (4)

[Claims] 1. A numerical range is set for each lock corresponding to each node of the tree structure, an attribute for specifying each lock is added to each lock, and each lock is set according to the numerical range set for each lock. A lock associated with an application system, comprising a plurality of layered locks, in which the user of the lock is defined and the application system and the hierarchical structure of the application system are characterized by attributes added to each lock. A lock system storage means for storing a lock system comprising a set of one or more lock systems, each set having a numerical range for an application system and an attribute added to each lock; Key storage means for storing a key composed of numerical values associated with Receiving the authentication information to be set as input data, searching the lock system for a lock in which a numerical range including the key of the user specified by the authentication information is set, and attaching the lock obtained by the search. And a lock system access unit for returning the set attribute. 2. The security management system according to claim 1, wherein when there are a plurality of lock systems constituting the lock system, mutually different numerical ranges are assigned to the plurality of lock systems. 3. In one lock system, a numerical range obtained by integrating each numerical range of one or more lower-layer locks directly connected to one upper-layer lock is the numerical range of the one upper-layer lock. 3. The security management system according to claim 1, wherein a numerical range is set for each lock. 4. A system construction means for assigning a numerical value range and an attribute to each of a plurality of hierarchically structured locks constituting the lock system, and for setting a key associated with a user. The security management system according to claim 1.