JP3628876B2 - Security management system - Google Patents

Description

[0001]
BACKGROUND OF THE INVENTION
The present invention relates to a security management system for managing security of an application system of a computer.
[0002]
[Prior art]
2. Description of the Related Art Conventionally, with regard to processing functions provided in a computer application system, it has been widely performed to manage the security of the application system by setting whether to allow the use of the processing function for each user. . In recent security management systems, a GUI (Graphic User Interface) technique is used to display processing functions that are allowed to be accessed on a menu screen in a form that is easy for the user to understand. For example, among the processing functions, the processing functions allowed for the user and the processing functions not allowed are displayed in different display colors, or the processing functions not allowed are displayed in halftone. It has been broken.
[0003]
[Problems to be solved by the invention]
In order to perform such security management, it is necessary to set the access authority for each user and store the setting result in the application system for a plurality of processing functions provided in the application system of the computer. There is. Here, when a plurality of application systems are incorporated in the computer, it is necessary to set the access authority of each user for each processing function of each application system.
In addition, the user needs to store, for example, a user ID for authenticating his / her access authority set in each application system to the computer.
[0004]
For example, if a conference room reservation system and a vehicle allocation management system are incorporated in a certain computer system, a user of this computer system needs to use a user ID set for each of these two application systems. Also, for example, when the conference room reservation system is started up using the user ID of the conference room reservation system and the conference room reservation process is executed, if the vehicle allocation management process is performed at the same time, the user ID of the vehicle allocation management system again uses the user ID of the vehicle allocation management system. Such a security system becomes very troublesome for the user as the number of application systems increases, such as the need to log in.
In addition, the construction of such a security system for each application system is also extremely complicated for the computer system side, and in order to maintain the security system in accordance with the version upgrade of the application system or the change of user personnel. However, there is a problem that a great deal of cost and time are required.
In view of the circumstances described above, an object of the present invention is to provide a general-purpose security management system that is easy to operate for a user and that can easily construct a security system for a plurality of application systems.
[0005]
[Means for Solving the Problems]
The security management system of the present invention that achieves the above-described object is as follows.
A numerical range is set for each lock corresponding to each node of the tree structure, and an attribute specifying each lock is added to each lock, and the user of each lock is defined by the numerical range set for each lock. And a lock system associated with the application system, which is composed of a plurality of layered locks, characterized by the attribute added to each lock, and the hierarchical structure of the application system. A lock system storage means for storing a lock system in which a numerical system is set for an application system and an attribute is added to the lock system.
[0006]
Key storage means for storing a numerical key associated with each user;
Authentication information that identifies each user is received as input data, and a lock in which a numerical range including the user's key specified by the authentication information is set is searched from the lock system. And a lock system access means for returning the attribute attached to the lock.
In this security management system, an application system user is abstracted and expressed as an object “key” (key), and a target business to be used is expressed as an object “lock” (lock). Each “Lock” has a numerical value range. Compare the “Key” consisting of numerical values with the “Lock” numerical value range, and check whether the “Key” is included in the “Lock” range. Thus, it is determined whether or not the “lock” is opened, that is, whether or not the user is allowed to use.
[0007]
Here, it is preferable that the security management system is configured such that when there are a plurality of lock systems constituting the lock system, different numerical ranges are assigned to the plurality of lock systems.
In addition, in this security management system, a numerical range obtained by combining the numerical ranges of one or more lower-layer locks directly connected to one upper-layer lock in one lock system is a single upper-layer lock numerical range. As described above, it is also a preferable aspect that a numerical value range is set for each lock.
Further, the security management system includes a system construction means for assigning a numerical range and an attribute to each of a plurality of hierarchized locks constituting the lock system and setting a key associated with the user. It is also preferable that there is.
[0008]
DETAILED DESCRIPTION OF THE INVENTION
Hereinafter, embodiments of the present invention will be described.
FIG. 1 is a system configuration diagram showing an embodiment of a security management system of the present invention.
As shown in FIG. 1, the security management system 1 includes levels 110b, 111b, 112b, 120b, each having a numerical range for each lock 110, 111, 112, 120, 121, 122 corresponding to each node of the tree structure. 121b and 122b are set, and attributes 110a, 111a, 112a, 120a, 121a, and 122a for specifying these locks are added to the locks 110, 111, 112, 120, 121, and 122, and the locks are set for the locks. The users of each lock are defined by the levels 110b, 111b, 112b, 120b, 121b, and 122b, and the attributes 110a, 111a, 112a, 120a, 121a, and 122a are added to the locks. System and Hierarchy of the application system is characterized, a plurality of lock 110,111,112,120,121,122 stratified, is constructed as a locking system 101, 102 associated with the application system.
[0009]
In this security management system 1, levels 110b, 111b, 112b, 120b, 121b, 122b, which are numerical ranges for application systems, are set in the locks 110, 111, 112, 120, 121, 122 and attributes 111a, 111a, 112a, 120a, 121a, 122a, and a lock system storage means 100 for storing a lock system formed by a collection of two lock systems 101, 102, and numerical values associated with each user. The key storage means 200 for storing the keys 211, 212, and 221 and the authentication information 10 for specifying each user are received as input data, and the user's key specified by the authentication information 10 is selected from the lock system. Search for locks with a numeric range that includes The lock system access means 300 for returning the attribute attached to the lock obtained by the above search, and a numerical range and an attribute are attached to each of the plurality of hierarchized locks constituting the lock systems 101 and 102, and to the user A system construction means 400 for setting the associated key is provided.
[0010]
In the present embodiment, as described above, an example in which the two lock systems 101 and 102 constituting the lock system exist is given, but the number of lock systems may be one or any plural number. However, when there are a plurality of lock systems, it is preferable that different numerical ranges are assigned to the lock systems. As shown in FIG. 1, in the present embodiment, a numerical range of 1 to 10 is assigned to the levels 110b, 111b, and 112b of the lock system 101, and 11 to 11 are assigned to the levels 120b, 121b, and 122b of the lock system 102. A numerical range of 20 is assigned, and the numerical ranges of both do not overlap.
[0011]
With this configuration, for example, when the system 1 is a bank online system and the system 2 is a ticket sales system, there is no interference between the two systems. It is preferable that a plurality of lock systems can be accommodated in the.
Further, in the present embodiment, in one lock system, a numerical range in which the numerical ranges of one or more lower-layer locks directly connected to one upper-layer lock are combined becomes a single upper-layer lock numerical range. In addition, a numerical value range is set for each lock. For example, as shown in FIG. 1, each lock 110, so that the total numerical range of the levels 111 b and 112 b of the lower locks 111 and 112 directly connected to the upper lock 110 becomes the level 110 b of the upper lock 110. Levels 110b, 111b, and 112b are set for 111 and 112, respectively.
There may or may not be overlapping numerical ranges between levels of subsystems in the same hierarchy. For example, there is no overlap between the levels 111b and 112b of the subsystem 11 and the subsystem 12 in FIG. In the case of this method, the user needs to have keys for the subsystem 11 and the subsystem 12 separately. This method has an adverse effect of increasing the number of keys, but also has an advantage of easy lock setting. In this method, for example, when the system 1 is a bank online system, the subsystem 11 is set in units of accounts and the subsystem 12 is set as information.
[0012]
On the other hand, in FIG. 1, there is an overlap in the levels 121b and 122b of the subsystem 21 and the subsystem 22 of the system 2. This method is effective when it is desired to manage a plurality of subsystems with one key. For example, by setting the subsystem 21 for a general user and the subsystem 22 for a system administrator, both subsystems can be made available to a system administrator having a key of 15 or more. it can.
[0013]
Next, the operation of the security management system 1 will be described with reference to FIG.
When the user ID and password are input to the security management system 1 as the authentication information 10 from the user, the lock system access means 300 provided in the security management system 1 reads the authentication information 10 from the lock system storage means 100. The locks 110, 111, 112, 120, 121, 122 having a numerical range including the user's keys 211, 212, 221 specified by the above are searched, and the attribute 20 (attribute 110 a) attached to the lock obtained by the search is searched. , 111a, 112a, 120a, 121a, 122a) is returned to the user.
[0014]
For example, when the user A inputs the authentication information 10 including his / her user ID and password to the security management system 1, the lock system access unit 300 of the security management system 1 stores the lock information in the lock system storage unit 100. The locks 110, 111, 112, 120, 121, and 122 are searched, and the locks 110, 111, and 112 having a numerical range including the keys 211 and 212 specified by the authentication information 10 of the user A are selected from these. Similarly, if the user B inputs the authentication information 10 including his / her user ID and password to the security management system 1, the lock system access unit 300 of the security management system 1 stores the lock system storage unit 100. The locks 110, 111, 112, 120, 121, and 122 are searched, and the lock 120 and the lock 121 having a numerical value range including the key 221 specified by the authentication information 10 of the user B are selected from these. Here, the lock 122 is not selected because its level 122b is 15 to 20 and does not match the key 221 consisting of the numerical value 14 of the user B.
Information obtained in this way, that is, the user is allowed to use which system and subsystem, and which system and subsystem are not allowed to be used. Be notified.
[0015]
As described above, in the security management system according to the present embodiment, the objects to be handled are not fixed, but indirectly expressed by an abstract concept of lock and key, and the user's key (numerical value) and lock numerical value are also expressed. Since the range is performed by comparing numerical values, versatility for a plurality of application systems can be ensured, and the security of a plurality of application systems can be comprehensively managed by one security management system.
On the other hand, in the conventional security system, the user's key and the target business lock are set as character strings, so the business target used by the user is limited to specific objects in the real world. For this reason, there is no general purpose and the security system must be dedicated to a specific system.
[0016]
In addition, in the conventional security system, the hierarchical structure is fixedly expressed as, for example, a building-floor-conference room if the target business is a conference room reservation system, or an office-vehicle number if it is a vehicle allocation management system. It is a security system dedicated to each system. On the other hand, the security management system of the present embodiment expresses the target business in the tree structure by replacing it with the abstract concept of lock, so that the target business in the real world having a hierarchical structure can be handled universally. It is a system that can.
Note that the above lock is an abstraction that is difficult for the user to understand, so it is used only for processing within the security management system, and is easy for the user to understand on the user interface, for example, the target business Output after being converted to a name.
[0017]
Next, computer hardware in which this security management system is stored will be described.
FIG. 2 is a schematic diagram of computer hardware in which the security management system of this embodiment is stored.
As an example, FIG. 2 shows a computer system 500 in which a file server 510, a printer server 520, and three clients 530, 540, and 550 are connected to each other via a communication line 560. Each of these servers and clients is configured as a computer system, and main units 511, 521, 531, 541, 551 incorporating a CPU, a main storage device, an auxiliary storage device, etc., and various instructions to each computer system. Keyboards 512, 522, 532, 542, and 552, and displays 513, 523, 533, 543, 553, and the like that display a screen and provide various information to the operator.
[0018]
The main body 511 of the file server 510 has a built-in large-capacity auxiliary storage device 514, which includes the lock system storage unit 100 and the key storage unit 200 of the security management system 1 (see FIG. 1) of the present embodiment. A security management program having a lock system access unit 300 and a system construction unit 400 is stored.
The system construction unit 400 is not essential to the security management system 1 of the present invention. The security management system 1 does not include the system construction unit 400 and is the same as the system construction unit 400 in this embodiment. Independent software with the above functions is prepared separately, and using that software, a numerical range and an attribute are attached to each of the plurality of layered locks constituting the above-mentioned lock system, and associated with the user. It is also possible to set the designated key. However, from the viewpoint of operability, it is preferable that the system construction unit 400 is incorporated in the security management system 1 as in the present embodiment.
[0019]
The security management system is stored in the program storage medium 516. When the security management system is set up in the computer system 500, the security management system has a large capacity via the storage medium reader 515 provided in the main body 511 of the file server 510. It is read into the auxiliary storage device 514.
A high-speed printer 524 is connected to the printer server 520 and plays a role as a printing apparatus common to the computer system 500.
[0020]
Next, a method for operating the security management system using the computer system 500 will be described.
A user starts one of the clients 530, 540, and 550 of the computer system 500 shown in FIG. 2, and inputs authentication information such as a user ID and a password from the keyboard. If the authentication information 10 is approved as valid authentication information, the authentication information 10 is input to the security management system 1 (see FIG. 1) set up in the file server 510.
The lock system access means 300 of the security management system 1 receives the authentication information 10 as input data, and a numerical range including the user key specified by the user authentication information 10 is set from the lock system storage means 100. The obtained lock is searched, and the attribute 20 attached to the lock obtained by the search is returned to the user.
[0021]
In this way, the user is presented with the attributes 20 of the system or subsystem that the user is permitted to use, such as the business menu name. As a user interface for presenting the attribute 20 to a user, a standard interface incorporated in the security management system 1 may be used, or a user interface customized for each client computer May be used.
[0022]
Next, the screen configuration used when constructing the security management system of this embodiment will be described.
FIG. 3 is a main screen of the security management system of this embodiment.
FIG. 3 shows a window of a business menu list 621 displayed on the upper side of the main screen 600 and a window of a business menu use permission group 622 displayed on the lower side. In the business menu list 621 window, business system names are displayed at each node of the tree structure. The user group and user assigned to the business menu selected in the business menu list 621 tree are displayed in the lower business menu use permission group 622 window. When not selected, the window of the work menu use permission group 622 is blank. A business setting-edit dialog (see FIG. 10) can be displayed by double-clipting the business menu item in the tree. In addition, a list (not shown) of users belonging to the user group can be displayed by double-clipping items in the window of the lower business menu use permission group 622.
[0023]
If “business menu 2” is selected from the business system names displayed in the business menu list 621, access to “business menu 2” is permitted in the window of the business menu use permission group 622 on the lower side. Group names such as “Application Development Department”, “Network Management Department”, “Multimedia System Department”, “System Integration Department”, “Sales Department”, “General Affairs Department”, etc. .
Using the main screen 600, the [File (F)] menu 611, [Edit (E)] menu 612, [Display (V)] menu 613, and [Help (H)] menu 614 of the menu bar 610 are used. By selecting any one menu, the tree structure can be displayed, newly registered, or deleted with respect to the business menu. When an item in the work menu use permission group 622 is not selected, the [use not permitted] command in the [edit (E)] menu 612 cannot be selected.
[0024]
FIG. 4 is a [File] menu screen of the security management system of this embodiment.
In FIG. 4, four commands of the [File (F)] menu 611 from the menu bar 610 of the main screen 600, that is, a [New] command 611a, an [Open] command 611b, a [Print] command 611c, and [Exit]. ] Shows a part of the screen when the [New] command 611a is selected from the command 611d. By selecting the [New] command 611a, [User], [User Group], and [Business] can be newly registered. The screen for new registration will be described later.
In the security management system of the present embodiment, not only individual users but also user groups such as sales departments and general affairs departments can be handled.
[0025]
Also, by selecting the [Open] command 611b in the [File (F)] menu 611, an edit screen for business or user group can be displayed. Also, by selecting the [Print] command 611c, the content displayed on the screen can be output from the printer. Further, the [File (F)] menu 611 can be terminated by selecting the [Exit] command 611d.
[0026]
FIG. 5 shows the [Edit] menu screen of the security management system of this embodiment.
FIG. 5 shows four commands of the [Edit (E)] menu 612, that is, [Cut / Copy / Paste], [Search], [Delete], and [Unauthorized].
[0027]
FIG. 6 is a [Display] menu screen of the security management system of this embodiment.
FIG. 6 shows three commands of the [Display (V)] menu 613, that is, [User List], [User Group List], and [Update to Latest Information].
The detailed description of the commands in the [Edit (E)] menu 612 and the [Display (V)] menu 613 shown in FIGS.
Next, a screen for newly registering a user, a user group, and a job will be described. When the [New] command 611a of the [File (F)] menu 611 is selected from the menu bar 610 of the menu screen 600 shown in FIG. 4, the following screen is displayed.
[0028]
FIG. 7 is a new user registration screen of the security management system of this embodiment.
As shown in FIG. 7, a new user can be registered using the main screen 600.
On the main screen 600, a business menu list 631 is displayed on the upper side, and a business menu use permission group screen 632 is displayed on the lower side. When the [Create New] command 611a in the [File (F)] menu 611 on the menu bar 610 is selected, a [User] command, [User Group] command, and [Business] command are displayed.
When the [User] command is selected, a new user registration window 640 as shown in the lower right of FIG. Enter the new user's ID, name, and password in the text boxes 641, 642, and 643, and enter the reading, affiliation, age, gender, phone number, and date of birth as the property 644. A new user is registered by pressing the [Register] button 645. By pressing the “Close” button 646, the registration of a new user is completed.
[0029]
FIG. 8 is a registration screen for a new user group in the security management system of this embodiment.
As shown in FIG. 8, a new user group can be registered using the main screen 600.
On the main screen 600, a business menu list 631 is displayed on the upper side, and a business menu use permission group screen 632 is displayed on the lower side. When the [Create New] command 611a in the [File (F)] menu 611 on the menu bar 610 is selected, a [User] command, [User Group] command, and [Business] command are displayed.
When the [User Group] command is selected, a new user group creation window 650 as shown in the lower right of FIG. 8 is displayed over the main screen 600. A new user group name is registered in the text box 651 of the new user group name in the new user group name, and a [Register] button 652 is pressed. By pressing the [Close] button 653, registration of a new user and a new user group is completed.
[0030]
Next, a new business registration screen will be described.
FIG. 9 is a new job registration screen of the security management system of this embodiment.
As shown in FIG. 9, the [New] command 611a of the [File (F)] menu 611 in the menu bar 610 of the main screen 600 is selected, and the [Business] command is executed. As shown in the lower right of FIG. 9, since a new business registration window 660 is displayed on the main screen 600, a new business name is entered in a text box 661 in the new business registration window 660, and a menu ID assigned to it is entered. Is selected in the combo box 662. The menu ID can be selected only from those displayed in the combo box 662, and new input cannot be performed. Next, a registration result is reflected in the tree structure of the business menu list 631 by pressing a [Register] button 663. The registration of a new business is completed by pressing a “Close” button 664.
[0031]
Next, usage permission setting editing related to work will be described.
FIG. 10 is a setting edit screen for permission to use related to the business of the security management system of this embodiment.
8, an item to be edited is selected in the “business menu use permission group list” 632 of the main screen 600 shown in FIG. 8, and then, as shown in FIG. ] [Open] command 611b of menu 611 is executed. The business menu to be updated and the menu ID assigned thereto are input to the text box 671 and the combo box 672 in the business setting-editing window 670 displayed superimposed on the main screen 600, respectively. The menu ID can be selected only from those displayed in the combo box 672, but new input cannot be performed. Next, a user group that can use the business is assigned.
A list of group names permitted to access is displayed in a use permission box 673a displayed in the job setting-edit window 670, and a list of group names not permitted to access is displayed in a use disapproval box 673b. Permitted / unpermitted movement can be performed by [←] and [→] commands displayed between the use permission box 673a and the use disapproval box 673b. By pressing the [Register] button 674, the editing result is reflected in the tree structure of the business menu list 631. By pressing a [Cancel] button 675, the use permission setting editing for the work is completed.
[0032]
As described above, the security management system 1 of this embodiment shown in FIG. 1 is constructed in the computer system 500 (see FIG. 2).
Each user inputs authentication information including a user ID and a password to this security management system, and which system and which sub-system are permitted to be used for a plurality of application systems incorporated in the computer system 500. Can know immediately.
[0033]
【The invention's effect】
As described above, the security management system of the present invention indirectly expresses the object to be handled by the abstract concept of lock and key without fixing, so that the operability is good for the user and a plurality of A general-purpose security management system capable of comprehensively managing the security of the application system can be realized.
[Brief description of the drawings]
FIG. 1 is a system configuration diagram showing an embodiment of a security management system of the present invention.
FIG. 2 is a schematic diagram of computer hardware storing a security management system according to the present embodiment.
FIG. 3 is a main screen of the security management system of the present embodiment.
FIG. 4 is a [File] menu screen of the security management system of the present embodiment.
FIG. 5 is an [Edit] menu screen of the security management system of the present embodiment.
FIG. 6 is a [Display] menu screen of the security management system of the present embodiment.
FIG. 7 is a registration screen for a new user in the security management system of the present embodiment.
FIG. 8 is a registration screen for a new user group in the security management system of the present embodiment.
FIG. 9 is a new job registration screen of the security management system according to the present embodiment;
FIG. 10 is a setting edit screen for permission to use related to the business of the security management system according to the present embodiment;
[Explanation of symbols]
1 Security management system
10 Authentication information
20 attributes
100 Lock system storage means
101,102 Lock system
110, 111, 112, 120, 121, 122 lock
110a, 111a, 112a, 120a, 121a, 122a attributes
110b, 111b, 112b, 120b, 121b, 122b levels
200 key storage means
211, 212, 221 keys
300 Lock system access means 300
400 System construction means
500 computer system
510 File Server
511, 521, 531, 541, 551 Body
512,522,532,542,552 keyboard
513, 523, 533, 543, 553 display
514 Large capacity auxiliary storage
515 Storage medium reader
516 program storage medium
520 Printer server
524 Printer
530, 540, 550 clients
560 communication line
600 Main screen
610 Menu bar
611 [File (F)] menu
611a [New] command
611b [Open] command
611c [Print] command
611d [END] command
612 [Edit (E)] menu
613 [Display (V)] menu
614 [Help (H)] menu
621 Business Menu List
622 Business Menu Use Permitted Group
631 Business Menu List
632 Business Menu Use Permitted Group Screen
640 New user registration window
641, 642, 643 text box
644 properties
645 [Register] button
646 [Close] button
650 New user group creation window
651 text box
652 [Register] button
653 [Close] button
660 New business registration window
661 text box
662 combo box
663 [Register] button
664 [Close] button
670 Business Settings-Edit window
671 text box
672 Combo box
673a Use permission box
673b Unauthorized use box
674 [Register] button
675 [Cancel] button

Claims (2)

A numerical range is set for each lock corresponding to each node of the tree structure, and an attribute for specifying each lock is added to each lock, and the user of each lock is determined by the numerical range set for each lock. A lock system associated with an application system, comprising a plurality of layered locks, characterized and characterized by an attribute added to each lock and the hierarchical structure of the application system and the application system, When the lock system is a set of one or more lock systems in which a numerical range is set for each lock and an attribute is added to each lock , and there are multiple lock systems that constitute the lock system Are assigned different numerical ranges to these multiple locking systems. A locking system storage means locking system is stored comprising,
Key storage means for storing a numerical key associated with each user;
Authentication information specifying each user is received as input data, and a lock in which a numerical range including a user key specified by the authentication information is set is searched from the lock system, and obtained by the search. A security management system comprising: a lock system access means for returning an attribute attached to the lock. Within a single lock system, each lock has a numerical value such that the total numerical range of the numerical values of one or more lower layer locks directly connected to one upper layer lock is the numerical range of the single upper layer lock. The security management system according to claim 1, wherein a range is set.

Images