WO2023148952A1

WO2023148952A1 - Authority management system

Info

Publication number: WO2023148952A1
Application number: PCT/JP2022/004598
Authority: WO
Inventors: 智子富田; 拓也新村; 常大細田; 善宏堂岸; 敢江間; 守真横田
Original assignee: 三菱電機ビルソリューションズ株式会社
Priority date: 2022-02-07
Filing date: 2022-02-07
Publication date: 2023-08-10

Abstract

The present invention enables authorization information to be easily managed for each user in each business system when users at a plurality of branch offices use a plurality of business systems. In a corporation system including a business system (2) provided to each business engaged in by a corporation, and a branch office server provided to each branch office of the corporation, an authorization management system (3) has a user authorization information provision unit (33) that, in response to an inquiry from the business system (2) regarding user authorization information that was used to log in, replies with personal authorization information serving as access authorization to be set for the user if unique personal authorization information is set for said user, and if personal personal authorization information is not set for said user, replies with default information set for the branch office to which said user belongs from among default information regarding access authorization preset for each branch office, said default information serving as access authorization to be set for said user.

Description

Rights management system

The present invention relates to an authority management system, and in particular to collective management of user authority in multiple systems.

In large-scale companies, for example, a business system may be formed for each task such as report creation, equipment information, and work management, and a corporate system may be constructed so that multiple branch offices can use the desired business system.

An employee, etc. belonging to one of the branch offices (hereinafter referred to as "user") logs into the business system used for business from a terminal such as a PC installed at the branch office, and the business system is used within the scope of authority granted Use the functions provided.

In this way, when operating the system by setting the access authority for users, that is, the usage authority for each function provided by the business system for each user, at the time of system introduction, each function is assigned to all users for each business system. You need to set access permissions for

JP 2020-052759 A JP 2014-182708 A Japanese Unexamined Patent Application Publication No. 2010-170208 JP 2015-087930 A JP 2019-087019 A Japanese Patent Application Laid-Open No. 2021-022201

However, the larger the scale of the entire system, for example, the greater the number of business systems and users, the greater the load required to set access rights. In addition, a large workload is required to change the setting of access authority after system introduction.

An object of the present invention is to facilitate the management of authority information for each user in each business system when multiple business systems are used by users of multiple branch offices.

An authority management system according to the present invention responds to an inquiry about authority setting for a user from a business system shared by a plurality of users belonging to one of the branch offices, and assigns personal authority unique to the user to the business system. If the information is set, the personal authority information is answered as the access authority to be set for the user, and if the personal authority information is not set for the user, the access authority preset for each branch office The present invention is characterized by having an authority information providing means for responding with default information regarding access authority to be set for the user.

In addition, the personal authority information is characterized in that information on authority setting is stored and managed separately for the branch office to which the user belongs and other branch offices.

According to the present invention, when multiple business systems are used by users of multiple branch offices, it is possible to easily manage the authority information of each user in each business system.

1 is a schematic overall configuration diagram of a company system in this embodiment; FIG. 1 is a block configuration diagram showing an authority management system in this embodiment; FIG. 4 is a diagram showing a data configuration example of default information in the embodiment; FIG. 4 is a diagram showing a data configuration example of personal authority information in the embodiment; FIG. 4 is a flow chart showing user authority setting processing according to the present embodiment.

Preferred embodiments of the present invention will be described below based on the drawings.

FIG. 1 is a schematic overall configuration diagram of a company system according to this embodiment. FIG. 1 shows a plurality of branch servers 1, a plurality of business systems 2, and an authority management system 3. FIG. The branch server 1 and business system 2, and the business system 2 and authority management system 3 can communicate with each other via a network (not shown).

The branch office server 1 is a server computer provided for each branch office of a company. In FIG. 1, "Branch office server 1", "Branch office server 2", and "Branch office server 3" are abstractly illustrated. provided in A company has branch offices at a plurality of bases and a head office. In each branch office, an in-house system including the branch server 1 is constructed, and in addition to the branch office server 1, each in-house system includes information processing devices such as PCs and network devices used by users of the branch office. However, in FIG. 1, only the branch office server 1 is illustrated.

The business system 2 is a computer system provided for each business performed in the company. In FIG. 1, "business system A", "business system B", and "business system C" are abstracted for illustration. provided in

A user who belongs to one of the branch offices logs into the applicable business system 2 and uses the functions provided by the logged-in business system 2 when performing work. In the case of this embodiment, the user cannot use all the functions provided by the business system 2 without any restrictions. Limited. In this embodiment, "access permitted" or "access permitted" to a function means that the function can be used. "Not available" is synonymous with not being able to use the function.

The authority management system 3 is a system that collectively manages the access authority of each user to each business system 2 . The hardware configuration of the authority management system 3 in this embodiment can be realized by a general-purpose server computer. That is, the authority management system 3 is configured by connecting a CPU, a ROM, a RAM, a hard disk drive as storage means, and a network interface provided as communication means to an internal bus. Further, in the case of this embodiment, a user interface including input means such as a mouse and a keyboard and display means such as a display is provided for setting access authority.

FIG. 2 is a block configuration diagram showing the authority management system 3 according to this embodiment. The authority management system 3 in this embodiment has an authority information setting section 31 , an information management section 32 , a user authority information providing section 33 and a storage section 34 . Components that are not used in the description of this embodiment are omitted from the drawing.

The authority information setting unit 31 sets default information and personal authority information stored in the storage unit 34 according to the setting operation by the administrator. The information management unit 32 manages information such as addition, update, and deletion of various types of information stored in the storage unit 34 according to setting operations by the administrator. The user authority information providing unit 33 responds to an inquiry about authority setting for a user from any business system 2, and if the personal authority information of the user is set, the personal authority information of the user is sent to the personal authority of the user. If the authority information is not set, the default information is returned, thereby providing the business system 2 of the inquiry source with the access authority to be set for the user.

The storage unit 34 stores default information, personal authority information, business system management information, and user master information.

FIG. 3 is a diagram showing a data configuration example of default information in this embodiment. In the default information, authority information as an initial value is classified for each business system 2 and set. Since the business system 2 in this embodiment provides one or a plurality of functions to the user, "authority information" means that the user can access the business system 2 or each function provided by the business system 2. This is setting information regarding whether or not it is possible. In this embodiment, authority information is set for each function. The authority information is set in the default information for each branch office to which the user belongs. That is, by specifying the branch office to which each user belongs, the access authority to be set for the user is specified. In FIG. 3, whether or not access is permitted is indicated by symbols “○” and “×”.

By the way, the access authority to be set for the user is specified by the personal authority information or the authority information set in the default information. Therefore, in this embodiment, "access authority" and "authority information" are used as similar terms.

In this embodiment, as shown in FIG. 3, one of the functions is "activate TOP screen". It is a function to start the top screen provided first to the logged-in user. Other functions are set to be activated by selecting a predetermined button or the like displayed on the top screen. Therefore, if access to the "TOP screen activation" function is disabled, access to other functions in the business system 2 is also disabled. In this way, functions that cannot be accessed because the "activate TOP screen" function cannot be accessed are indicated by "-" in FIG.

For example, suppose there is a business system 2 called a report creation system. The report creation system provides an information registration function for maintenance, an information registration function for repair, a report download function, etc., in addition to the "top screen activation" function. For each such function, default information is set as to whether the branch office user can access the function (“○”) or not (“x” or “-”).

FIG. 4 is a diagram showing a data configuration example of personal authority information in this embodiment. Default information is information shared by all users, and there is only one in the entire enterprise system. On the other hand, the personal authority information is set for users who are not granted access authority as set in the default information. The individual authority information is configured by associating authority information set for the individual with the man number. FIG. 4 exemplifies the personal authority information of the user A specified by the man number "ABC1234". ) is set for each individual as necessary by the administrator of

As is clear from a comparison with the data structure of the default information, in the personal authority information, as in the default information, authority information indicating whether or not access is permitted for the user is set for each function of each business system and each branch office. . Ordinarily, for a given user, the access authority set in the default information for the own branch office is set. In addition, it is not possible to access information related to branch offices other than one's own branch office using this function. However, there are cases where you want to allow access to information other than your own branch using this function. In addition, it is possible to assume a case where it is desired not to allow access even if the branch office is one's own. FIG. 4 exemplifies the personal authority information of user A who belongs to branch office B as described above. On the other hand, when using the functions provided by the business system C, the personal authority information is set so that the information on the branch office D can also be accessed.

By the way, personal authority information is information related to authority settings set for an individual user, but as shown in FIG. The user authority information includes personal authority information set for each user described above, except for information corresponding to the user's own branch office authority information. On the other hand, as the user's own branch office authority information, information related to the own branch office (for user A, authority information corresponding to branch office B) is selected and set from among the personal authority information.

Assume that user A is transferred to branch office C. In this case, for user A, his own branch office is branch office C, and branch office B is no longer his own branch office. Normally, the personal authority information is set when the user belongs to the branch office B, so it is not necessarily preferable to take over the setting as it is, and it is preferable to invalidate it by transferring. However, unlike the settings for the branch office other than the own branch office, there are cases where it is desired to take over the settings related to the own branch office as they are. Therefore, in the present embodiment, assuming such a case, among the personal authority information, information relating to one's own branch is stored and managed separately from information of other branches. That is, the setting for branch B, which was the own branch, is applied to branch C, which is the new own branch.

For example, when personal authority information is set again for user A after transfer of user A, the authority information setting unit 31, in accordance with an instruction from the administrator, Only by reflecting the setting contents of the information in the branch office C, there is no need to set the own branch office again. Since branch B is a branch other than its own branch, it will be set to be inaccessible in the same way as branch offices other than its own (branch A, etc.) unless otherwise set by the administrator.

The business system management information is information for managing the business system 2 included in the enterprise system in this embodiment. The business system management information is generated by associating the identification information of each business system 2 with information related to the functions provided by the business system 2 .

User master information includes information about users of the corporate system. User master information is generated by associating man numbers as identification information that individually identifies each user with authentication information including user IDs and passwords, and information such as affiliation and duties indicating the user's position in the company. be. Depending on the company, personnel information may be separately managed by a personnel information management server or the like. bottom. User master information needs to be updated to the latest information each time personnel information is updated. However, it is also possible to refer to the latest personnel information in the personnel information management server each time it is necessary without having the user master information internally.

Each component 31 to 33 in the authority management system 3 is realized by cooperative operation between a computer forming the authority management system 3 and a program running on a CPU installed in the computer. Also, the storage unit 34 is realized by an HDD installed in the authority management system 3 . Alternatively, RAM or external storage means may be used via a network.

In addition, the program used in this embodiment can be provided not only by communication means, but also by being stored in a computer-readable recording medium such as a CD-ROM or USB memory. A program provided from a communication means or a recording medium is installed in a computer, and various processes are realized by the CPU of the computer sequentially executing the program.

Next, the operation in this embodiment will be described.

As described above, before starting the operation of the enterprise system, it is necessary for the administrator to set default information and personal authority information for necessary users in the authority management system 3. Here, the explanation is continued assuming that the settings have already been made. In this embodiment, the authority management system 3 collectively manages the access authority of each user, and the business system 2 cannot independently specify the access authority of each user. Therefore, when a user starts using the business system 2, the business system 2 to be used asks the authority management system 3 what kind of access authority is set for the user. will be acquired, and the function will be used within the acquired range. Hereinafter, setting of access authority for a user in the present embodiment will be described with reference to the flowchart shown in FIG.

The user specifies authentication information and logs into the business system 2 corresponding to the business to be performed, for example, from a PC in the branch office. Here, it is assumed that authentication is performed by an existing method and the user has been successfully authenticated. The business system 2 designates the login ID (same as the "user ID") included in the authentication information, and makes an inquiry regarding the authority setting for the user to the authority management system 3.

The user authority information provision unit 33 in the authority management system 3 receives an inquiry from the business system 2 (step 110). Subsequently, the user authority information providing unit 33 acquires the man number and the user's position (affiliated branch office and duties) by searching the user master information based on the user ID specified in the inquiry (step 120). Then, since the man number is associated with the personal authority information, the user authority information providing unit 33 confirms whether or not the personal authority information associated with the obtained man number is set.

Here, if personal authority information associated with the user has been set (Y in step 130), the user authority information providing unit 33 acquires the personal authority information (step 140), and sets it to the user. Reply as access authority (step 150).

On the other hand, if the personal authority information associated with the user is not set (Y in step 130), the user authority information providing unit 33 acquires the authority information of the branch office to which the user belongs, which is set in the default information. (Step 160), and reply as the access authority to be set for the user (Step 150).

The information returned to the business system 2 may be limited to authority information corresponding to the business system 2 that made the inquiry.

The business system 2 controls access for logged-in users according to the authority information returned from the authority management system 3. That is, the business system 2 determines the functions available to the user according to the authority information.

According to the present embodiment, as described above, each business system 2 acquires the access authority for the logged-in user by inquiring of the user authority information providing unit 33 . In this embodiment, the authority management system 3 is provided to collectively manage the authority information of each user to be managed by each business system 2. Therefore, the authority information of each user in each business system 2 can be easily managed. be able to. In addition, it is possible to respond quickly and flexibly to changes in authority information settings that accompany user transfers. Furthermore, even when the business system 2 is added to the enterprise system, the enterprise system can be put into operation at an early stage simply by adding information about the business system 2 to the default information described above.

In the present embodiment, the access authority for the user is set as default information according to the branch office to which the user belongs. Authority information may be set for each position described above.

Also, in the present embodiment, access to the functions provided by the business system 2 is set for each branch office. Further, branch offices may be grouped according to predetermined rules for access control.

For example, each branch office is divided into multiple branch office areas (Hokkaido same area, Tohoku area, Yokohama area, etc.) according to the location of the base, The authority information may be set as default information so that the customer information managed by can be accessed. In this case, information indicating the correspondence relationship between the branch office and the branch office area is required.

1 branch server, 2 business system, 3 authority management system, 31 authority information setting section, 32 information management section, 33 user authority information providing section, 34 storage section.

Claims

In response to an inquiry about authority setting for a user from a business system shared by multiple users belonging to one of the branch offices, if personal authority information unique to the user is set for the business system, Personal authority information is returned as the access authority to be set for the user, and if the personal authority information is not set for the user, default information regarding the access authority preset for each branch office is set for the user. 1. An authority management system characterized by having authority information providing means for replying as an access authority to be granted.
2. The authority management system according to claim 1, wherein the personal authority information is stored and managed separately for the branch office to which the user belongs and for other branch offices.