JP4643292B2 - User information management system and user information management method - Google Patents

Description

  The present invention relates to a user information management system and method.

Conventionally, when users across companies share information, it is necessary to do as follows. One is to provide a common user information management server between companies and to release the mutual user information to the user information management server. The other is to convert presence information into data of the company system as disclosed in JP-A-2003-186775.
In addition, when users between companies collaborate, it is necessary to collaborate as a specific individual, not organization information such as job titles and projects, and there has been no effective means for realizing collaboration based on the company's organizational system.
JP 2003-186775 A

  Conventionally, in order for users across companies to cooperate with each other, it is necessary to provide a common user information management server between companies and to disclose the mutual user information to the user information management server. However, sharing user information between companies is not preferable from the viewpoint of security. From the viewpoint of security, it is better to manage user information of each company independently.

  Moreover, when the user between companies cooperates, the cooperation according to the organization system of an organization is common rather than a specific individual. In the case of management based on conventional user information of a specific individual, when a personnel change occurs in the user, the role as the organizational system of the organization is changed. Therefore, there has been a problem that it is necessary to reset the cooperation relationship between companies each time.

  The present invention provides a user information management system in which a first network system and a second network system are connected to a network, wherein the first network system stores a role indicating a role of a user, and the role storage unit. A first transmission unit that transmits the role stored by the second network system to the second network system, wherein the second network system stores a combination of user information and user role information of the second network system. The role information that matches the role received by the receiving unit from the combination, the receiving unit that receives the role transmitted by the first transmitting unit, and the combination stored by the combination storage unit, And a user specifying unit that specifies the user information for the roll.

  According to the present invention, since the user of the second network system is specified from the role transmitted from the first network system, the user information does not need to be provided to other network systems, and is managed on each network system side. Is possible.

  Hereinafter, the present invention will be described based on embodiments shown in the drawings.

Embodiment 1 FIG.
FIG. 1 shows a configuration diagram of the present embodiment. In FIG. 1, the user information management system in the present embodiment includes a network system 1-1 of company A and a network system 1-2 of company B. In the present embodiment, the network system of company A is the first network system, and the network system of company B is the second network system. The first network system 1-1 includes the following.

  The connection unit 1-11 includes a transmission unit 1-111, a reception unit 1-112, and a user identification unit 1-113. The transmission unit 1-111 transmits a user information acquisition request to the second network system 1-2. In the present embodiment, since the network system of company A is the first network system, the transmission unit 1-111 is an example of the first transmission unit. The receiving unit 1-112 receives a user information acquisition request from the second network system 1-2. Upon receiving the user information acquisition request from the second network system 1-2, the user specifying unit 1-113 sends the user information of the first network system 1-1 to the second network via the transmission unit 1-111. Provided as a response to the system 1-2. The request and response for acquiring user information are not limited to this, but it is conceivable to communicate using a standard protocol of a Web service.

  The role storage unit 1-12 stores logical role information (role information) that is disclosed outside the company. Here, the role information may be logical role information such as the company's job system or individual projects. In the present embodiment, the role storage unit 1-12 is assumed to be the same as the role information storage unit 1-32 described later.

  The permission information storage unit 1-13 stores permission information for disclosing information on the first network system in response to a user information acquisition request from the second network system 1-2. The user specifying unit 1-113 provides the user information of the first network system 1-1 to the second network system 1-2 within the range of permission information stored in the permission information storage unit 1-13.

  The user information management unit 1-14 manages users who are logged in to the connection unit 1-11.

  The organization storage unit 1-15 includes an organization information storage unit 1-151 and a user information storage unit 1-152. The organization information storage unit 1-151 manages organization information of companies. The user information storage unit 1-152 manages user information of the first network. The role information generation unit 1-16 refers to the organization information managed by the organization information storage unit 1-151 of the organization storage unit 1-15, and generates role information stored in the role storage unit 1-12.

  The input unit 1-17 includes a role information input unit 1-171 and a combination creation unit 1-172. The role information input unit 1-171 inputs role information stored in the role storage unit 1-12. The role information input unit 1-171 is not limited to this, but is assumed to be used when the role information generation unit 1-16 inputs local role information that cannot be generated from the organization information. The combination creating unit 1-172 creates directory information representing a combination of logical role information disclosed outside the company and physical user information in the company.

  The adapter unit 1-18 links the user information management unit 1-14 and the connection unit 1-11.

  The system administrator terminal 1-19 is used to use the input unit 1-17 described above.

  The combination storage unit 1-20 stores directory information representing a combination of logical role information disclosed outside the company and physical user information in the company. The combination storage unit 1-20 also stores the directory information created by the combination creation unit 1-172.

  Based on the role information stored in the role storage unit 1-12 and the user information stored in the user information storage unit 1-152 of the organization storage unit 1-15, the combination generation unit 1-21 is logically disclosed outside the company. Directory information representing a combination of linking general role information with in-house physical user information is generated. The combination storage unit 1-20 also stores the directory information generated by the combination generation unit 1-21.

The user terminal 1-22 is a terminal used by a normal user. The user inputs an information acquisition request from the user terminal 1-22.

  The second network system has the same configuration.

  The connection unit 1-31 includes a transmission unit 1-311, a reception unit 1-312, and a user specification unit 1-313. The transmission unit 1-311 transmits a user information acquisition request to the first network system 1-1. In the present embodiment, since the network system of company B is the second network system, the transmission unit 1-311 is an example of the second transmission unit. The receiving unit 1-312 receives a user information acquisition request from the first network system 1-1. Upon receiving the user information acquisition request from the first network system 1-1, the user specifying unit 1-313 sends the user information of the second network system 1-2 to the first network via the transmission unit 1-311. Provided as a response to the system 1-1. The request and response for acquiring user information are not limited to this, but it is conceivable to communicate using a standard protocol of a Web service.

  The role information storage unit 1-32 stores logical role information (role information) that is disclosed outside the company. Here, the role information may be logical role information such as the company's job system or individual projects. In the present embodiment, the role information storage unit 1-32 is assumed to be the same as the role storage unit 1-12 described above.

  The permission information storage unit 1-33 stores permission information for disclosing information on the second network system in response to a user information acquisition request from the first network system 1-1. The user specifying unit 1-313 provides the user information of the second network system 1-2 to the first network system 1-1 within the scope of permission information stored in the permission information storage unit 1-33.

  The user information management unit 1-34 manages users logged in to the connection unit 1-31.

  The organization storage unit 1-35 includes an organization information storage unit 1-351 and a user information storage unit 1-352. The organization information storage unit 1-351 manages company organization information. The user information storage unit 1-352 manages user information on the second network. The role information generation unit 1-36 refers to the organization information managed by the organization information storage unit 1-351 of the organization storage unit 1-35, and generates role information stored in the role information storage unit 1-32.

  The input unit 1-37 includes a role information input unit 1-371 and a combination creation unit 1-372. The role information input unit 1-371 inputs role information stored in the role information storage unit 1-32. The role information input unit 1-371 is not limited to this, but is assumed to be used when the role information generation unit 1-36 inputs local role information that cannot be generated from the organization information. The combination creating unit 1-372 creates directory information that represents a combination that links logical role information that is disclosed outside the company and physical user information inside the company.

  The adapter unit 1-38 links the user information management unit 1-34 and the connection unit 1-31.

  The system administrator terminal 1-39 is used for using the input unit 1-37 described above.

  The combination storage unit 1-40 stores directory information representing a combination of logical role information disclosed outside the company and physical user information in the company. The combination storage unit 1-40 also stores the directory information created by the combination creation unit 1-372.

  The combination generation unit 1-41 is disclosed to the outside based on the role information stored in the role information storage unit 1-32 and the user information stored in the user information storage unit 1-352 of the organization storage unit 1-35. Directory information representing a combination of logical role information and in-house physical user information is generated. The combination storage unit 1-40 also stores the directory information generated by the combination generation unit 1-41.

  The user terminal 1-42 is a terminal used by a normal user. The user inputs an information acquisition request from the user terminal 1-42.

  FIG. 2 is a diagram showing processing and data flow until the material section manager (user A) of company A confirms the presence information of the material section manager (user X) of company B. In FIG. 2, the user A who is the material manager of the company A accesses the connection unit 1-11 of the company A. The user X who is the material section manager of the company B accesses the connection unit 1-31 of the company B.

  FIG. 3 is a flowchart of processing in which the material section manager (user A) of the company A confirms the presence information of the material section manager (user X) of the company B. Below, based on FIG. 2, FIG. 3, the process which the material section manager of the company A (user A) confirms the presence information of the material section manager of the company B (user X) is demonstrated.

  In the request transmission step (transmission step) S101, the transmission unit 1-111 of the connection unit 1-11 of the company A confirms the presence information of the company B material section manager based on the instruction of the material section manager of the company A. A request message 2-51 is transmitted to the connection unit 1-31 of the company B. In the transmitted request message 2-51, role information that logically represents the role of the material section manager (user A) is described as request source user information. This request source user information is an example of a request source role. In the transmitted request message 2-51, role information indicating the material section manager (user X) of the company B is described as request destination user information as request destination user information. This request destination user information is an example of a request destination role. The connection unit 1-11 acquires the request source role and the request destination role from the role storage unit 1-12.

  In the request reception step (reception step) S102, the reception unit 1-312 of the connection unit 1-31 of the company B receives the request message 2-51 from the company A.

  In the permission determination step S103, the user specifying unit 1-313 of the connection unit 1-31 of the company B includes request source user information (request source role) and request destination user information (request destination role) in the request message 2-51. Refer to In addition, the user identification unit 1-313 refers to the permission information of the company B defined in the permission information storage unit 1-33. The user specifying unit 1-313 determines whether or not information provision of the request destination role for the request source role is permitted. The user specifying unit 1-313 prohibits or rejects the provision of information when the requesting role is not permitted to provide the requested role. Therefore, the user identification unit 1-313 returns a message that cannot be disclosed and ends the process. On the other hand, if the information disclosure of the request destination role for the request source role is permitted, the user specifying unit 1-313 proceeds to step S104.

  In the user specifying step S104, the user specifying unit 1-313 of the connection unit 1-31 of the company B specifies user information based on the requested role. When specifying the user information, the user specifying unit 1-313 obtains the user X that is the user ID of the company B from the combination storage unit 1-40. Then, the presence information of the user X is referred from the user information management unit 1-34.

  In response transmission step S105, the transmission unit 1-311 of the connection unit 1-31 of the company B sets the presence information of the referred user X in the response message 2-52. Then, the transmission unit 1-311 transmits a response message 2-52 to the connection unit of the company A.

  In response reception step S106, the reception unit 1-112 of the connection unit 1-11 of the company A receives a response message.

  In the output step S107, the user terminal of the material section manager (user A) of the company A displays the presence information of the material section manager (user X) of the company B set in the received response message on the user terminal.

  The user information management system according to the present embodiment is an information system in which specific users are linked across companies, and without using personal information as an index for linking users between companies, It is characterized in that users are linked with each other using logical role information (role information) corresponding to the role as an index.

  In addition, the user information management system according to the present embodiment provides a connection unit for each company in order to link users between companies using logical role information as an index. The role information is mapped to a specific physical individual in the company, and the user information is disclosed. Here, as an example of the connection unit, it is conceivable to install an external connection management server, which is a server that manages connection with an external company, in the system.

  In addition, the user information management system according to the present embodiment includes an organization storage unit, a combination storage unit, a role storage unit, and a role information storage unit, in which each company separately manages user information necessary for external connection. It is characterized by managing using.

Embodiment 2. FIG.
FIG. 4 shows an example of the data structure of the request message 2-51 and the response message 2-52. In the example of FIG. 4, Example 4-1 of the data structure of the request message requests disclosure of presence information of the material section manager of the counterpart company. Response message data structure example 4-2 is returned as a result of the request message shown in request message data structure example 4-1.

  An example 4-1 of the data structure of the request message is represented by a <UserInfoRequest> </ UserInfoRequest> tag. The <UserInfoRequest> </ UserInfoRequest> tag includes a <Request> </ Request> tag that describes the request contents, and a <RequestData> </ RequestData> tag that describes the form of response data.

  <Request> </ Request> tag is a <RequestDomain> </ RequestDomain> tag that represents domain information on the request side, and <Requester> </ Requester> tag that represents role information of a requester, and disclosure of information <TargetUser> </ TargetUser> tag that describes role information of the person who wants to search.

  The <RequestData> </ RequestData> tag sets the definition of information that requires information disclosure. In the case of a character string, it is represented by <String> name </ String>, and in the case of a numerical value, it is represented by <int> name </ int>.

  An example 4-2 of the data structure of the response message is represented by a <UserInfoResponse> </ UserInfoResponse> tag. The example 4-2 of the data structure of the response message includes a <Result> </ Result> tag that indicates whether the response is possible, a <Response> </ Response> tag that indicates the response contents, and an <AnswerValue> that indicates the response data. >> </ AnswerValue> tag.

  The <Result> </ Result> tag includes a <Status> Success | Failed </ Status> tag that describes information indicating success or failure of a request, and a <Message> </ Message> tag that indicates message information related to Status. .

  The <Response> </ Response> tag includes a <ResponseDomain> </ ResponderDomain> tag that represents domain information on the response side, and a <TargetUser> </ TargetUser> tag that represents role information of a person to whom information is disclosed. .

<AnswerValue></AnswerValue> tag sets disclosure information. In this embodiment, since the disclosure of the presence information of the material manager of the partner company is requested, the following data structure can be considered as an example.
<UserName></UserName> indicating the user name of the person who discloses the information, and <PresenceInfo></PresenceInfo> indicating the presence information of the person who discloses the information.

  FIG. 5 shows an example of the data structure of the request message 2-51 and the response message 2-52. In the example of FIG. 5, Example 5-1 of the data structure of the request message requests disclosure of the mail address of the material manager of the partner company. The example 5-2 of the data structure of the response message is returned as a result of the example 5-1 of the data structure of the request message.

  The basic structure is the same as Example 4-1 of the request message data structure and Example 4-2 of the response message data structure. The difference between the request message data structure example 4-1 and the response message data structure example 4-2 is as follows.

The difference between the request message data structure example 5-1 and the request message data structure example 4-1 is the definition of information for requesting information disclosure defined in the <RequestData></RequestData> tag. is there.
In the example 4-1 of the data structure of the request message described above, UserName and PresenceInfo are defined in the <RequestData></RequestData> tag. However, Example 5-1 of the data structure of the request message defines UserName and MailAddress to request a mail address.

The difference between the response message data structure example 5-2 and the response message data structure example 4-2 is the definition of the disclosure information set in the <AnswerValue></AnswerValue> tag.
In the example 4-2 of the response message data structure described above, UserName and PresenceInfo are defined in <AnswerValue></AnswerValue> tags. However, Example 5-2 of the data structure of the response message defines UserName and MailAddress in order to return a mail address.

In this case, the value returned as MailAddress is not limited to this depending on the policy of the company that discloses the information, but the following may be considered. One example of a value returned is an actual email address. For example, Taro. Yamada, the actual email address of Taro. Yamada @ b-company. co. It is possible to reply jp. Another example of the value returned is a mailing list assigned to role information. For example, since it is assigned to the material section manager, the list is sizaiK @ b-company. co. It is possible to reply jp.
In addition, it is conceivable to change the information to be returned using the definition of the disclosure level of information to the outside set in permission information described later. For example, a disclosure level can be set for each domain, and information to be returned can be changed depending on the requested domain.

  As described above, the user information management unit can be replaced with various systems depending on the content of information to be disclosed. The adapter unit 1-18 in FIG. 1 cooperates between the user information management unit 1-14 and the connection unit 1-11 in FIG.

Embodiment 3 FIG.
FIG. 6 shows an example of the data structure of the permission information stored in the permission information storage unit 1-33.

  The request source domain information 6-1 represents the domain information of the request source of the request message 2-51. When receiving the request message 2-51, the received connection unit 1-31 checks the request source domain information 6-1 and the domain information in the HTTP message to confirm the request source. The request source role information 6-2 represents role information of a request source user who requests information disclosure. Compared with the role information of the <Requester> </ Requester> tag included in the request message. The disclosure level 6-3 represents an index for indicating the disclosure range of information to be disclosed according to the request source domain information and the request source role information. As an example of the disclosure level 6-3, for each disclosure level 6-3, specifying the content of information permitted to be disclosed is included. For example, at disclosure level A, only enrollment information can be disclosed, and at disclosure level B, enrollment information and email addresses can be disclosed. As another example of the disclosure level 6-3, when the content of the information to be disclosed and the role of the object to be disclosed are the same, designation of a person to be disclosed is included. For example, if the disclosure level is A, all business units are to be disclosed, and if the disclosure level is B, the first business unit and the second business unit are to be disclosed. The disclosure target person 6-4 represents request destination role information that permits disclosure of information according to the request source domain and the request source role.

  Thus, by setting permission information, disclosure and non-disclosure of user information can be freely controlled.

  In other words, the user information management system according to the present embodiment provides permission information defining external connection rules in order to prevent unlimited disclosure of in-house user information, and follows the connection rules defined in the list. Have the function of disclosing information.

Embodiment 4 FIG.
FIG. 7 shows an example of the data structure of role information stored in the role information storage unit 1-32. The role information is an index representing a logical role in the company, and is basically represented by an in-house job system and a title. The user ID (identifier) is an index indicating a physical user associated with role information. The role information stored in the role information storage unit 1-32 is updated in accordance with the personnel change whenever there is a personnel change in the organization. That is, the role information stored in the role information storage unit 1-32 is updated with personnel changes.

  FIG. 8 shows a flowchart of processing for generating and updating role information stored in the role information storage unit 1-32 and combinations stored in the combination storage unit 1-40. Hereinafter, a process of generating and updating the role information stored in the role information storage unit 1-32 and the combination stored in the combination storage unit 1-40 will be described with reference to FIG.

  In role information generation step S201, the role information generation unit 1-36 refers to the organization information in the organization information storage unit 1-351 of the organization storage unit 1-35 and generates role information.

  In role information storage step S202, the role information storage unit 1-32 stores the role information generated by the role information generation unit 1-36.

  In the combination generation step S203, the combination generation unit 1-41 refers to the user information stored in the user information storage unit 1-352 of the organization storage unit 1-35 and the role information stored in the organization information storage unit 1-351. Then, a combination of user information and role information is generated.

  In the combination storage step S204, the combination storage unit 1-40 stores the combination generated by the combination generation unit 1-41.

  In role information disclosure step S205, the connection unit 1-31 discloses the role information stored in the role information storage unit 1-32 to the first network system.

  In the role storage step S206, the role storage unit 1-12 stores the role information disclosed by the connection unit 1-31 as a role.

  Moreover, about the update of the role information memorize | stored in the role information memory | storage part 1-32, and the combination memorize | stored in the combination memory | storage part 1-20, it produces | generates from the organization information etc. which were updated with personnel changes as mentioned above. There are also the following methods. The role information input unit 1-371 can cause the system administrator to add and edit local roles other than the organization information. The combination creating unit 1-372 inputs the user information stored in the user information storage unit 1-352 of the organization storage unit 1-35 and the role information stored in the organization information storage unit 1-351. Combinations with information can be added and edited by the system administrator.

  In other words, the user information management system in the present embodiment, the role information generation function and the combination generation function that automatically generates role information that is an index of external connection from the organization information and user information managed in the organization storage unit, It has a function capable of editing and defining local role information that does not depend on a company organization that cannot be automatically generated from organization information, using a role information input function having a graphical user interface and a combination input function.

  The present embodiment relates to inter-company user information management in a case where specific users across companies are linked with each other via an information system of each company. In the present embodiment, an index for linking an individual is linked using logical role information managed within each company, not personal information representing a specific individual, in particular, a user ID (identifier).

  In the present embodiment, personal information representing a specific individual and logical role information corresponding to the organizational system of the organization are managed. As an index for linking users between companies, role information corresponding to the organizational structure of the company organization is used, not personal information of a specific individual. In order to share user information between companies using role information, a connection unit 1-11 and a connection unit 1-31 are arranged in both companies. The connecting unit 1-11 and the connecting unit 1-31 are responsible for linking logical role information to specific personal information in the company and transmitting the user information to the partner company.

  The connection unit 1-11 and the connection unit 1-31 do not provide in-house user information to the outside without limitation. The connection unit 1-11 and the connection unit 1-31 provide information outside the connection rules defined in the permission information stored in the permission information storage unit 1-13 and the permission information storage unit 1-33 to the outside. Has the function of blocking. That is, in the user information management system according to the present embodiment, one connection server is arranged in each company, and users between companies are linked through this connection server. The connection server converts logical role information provided externally into specific physical personal information existing in the company and manages it. Therefore, it is possible to link users between companies using logical role information.

  The present embodiment has the following effects. First, it is possible to collaborate with the other party based on the logical role information such as the company's job system and individual projects, instead of the personal information for identifying the individual, particularly the user ID. Therefore, it is not necessary to disclose personal information outside the company. That is, user information can be managed independently by each company. Further, when the person in charge changes due to personnel changes, new role information can be generated without human intervention. Therefore, even after personnel changes, users can be linked using new role information without human intervention. When sharing user information between companies, disclosure and non-disclosure of user information can be freely controlled by setting permission information managed in-house. As a result of these effects, it is possible to perform safe and efficient maintenance and management of user information necessary for realizing cooperation between specific users across companies.

FIG. 9 is a diagram illustrating an example of the appearance of the first network system in the embodiment.
In FIG. 9, the first network system 100 includes a server 910, a CRT (Cathode Ray Tube) display device 901, a keyboard (K / B) 902, a mouse 903, a compact disk device (CDD) 905, a printer device 906, and a scanner device 907. , A database 908, and a system unit 909, which are connected by a cable.
Further, the first network system 100 is connected to the FAX machine 932 and the telephone 931 via a cable, and is connected to the Internet 940 via a local area network (LAN) 942 and a gateway 941.
In the embodiment described above, the “connection unit”, “user information management unit”, and the like are, for example, the server 910. Also, what is described as “˜storage unit” is, for example, the database 908. “System administrator terminal”, “user terminal”, and the like are, for example, the system unit 909.
For example, a plurality of users use the “user terminal” that is the system unit 909 to log in to the first network system 100 via the “user information management unit” that is the server 910. A user who logs in to the first network system 100 connects to the outside of the second network system or the like via the local area network 942, the gateway 941, the Internet 940, or the like via the “connection unit” that is the server 910. ing.

FIG. 10 is a diagram illustrating an example of a hardware configuration of the server 910, the database 908, the system unit 909, and the like of the first network system in the embodiment.
In FIG. 10, a server 910, a database 908, a system unit 909, and the like of the first network system 100 include a CPU (Central Processing Unit) 911 that executes a program. The CPU 911 includes a ROM 913, a RAM 914, a communication board 915, a CRT display device 901, a K / B 902, a mouse 903, an FDD (Flexible Disk Drive) 904, a magnetic disk device 920, a CDD 905, a printer device 906, and a scanner device 907 via a bus 912. Connected with.
The RAM 914 is an example of a volatile memory. The ROM 913, the FDD 904, the CDD 905, and the magnetic disk device 920 are examples of nonvolatile memories. These are examples of a storage device or a storage unit.
The communication board 915 is connected to a FAX machine 932, a telephone 931, a LAN 942, and the like.
For example, the communication board 915, the K / B 902, the scanner device 907, the FDD 904, and the like are examples of the input unit.
Further, for example, the communication board 915, the CRT display device 901, and the like are examples of the output unit.

Here, the communication board 915 is not limited to the LAN 942 but may be directly connected to the Internet 940 or a WAN (Wide Area Network) such as ISDN. When directly connected to a WAN such as the Internet 940 or ISDN, the first network system 100 is connected to a WAN such as the Internet 940 or ISDN, and the web server 941 is unnecessary.
The magnetic disk device 920 stores an operating system (OS) 921, a window system 922, a program group 923, and a file group 924. The program group 923 is executed by the CPU 911, the OS 921, and the window system 922.

The program group 923 stores a program for executing a function described as “˜unit” in the description of the above-described embodiment. The program is read and executed by the CPU 911.
In the file group 924, what is described as “˜information”, “˜roll”, “˜message”, and “˜judgment” in the description of the above embodiment is stored as “˜file”.
In addition, the arrows in the flowchart described in the description of the above-described embodiment mainly indicate data input / output, and for the data input / output, data includes a magnetic disk device 920, an FD (Flexible Disk), an optical disk, It is recorded on other recording media such as CD (compact disc), MD (mini disc), DVD (Digital Versatile Disk). Alternatively, it is transmitted through a signal line or other transmission medium.

  In addition, what is described as “unit” in the description of the above-described embodiment may be realized by firmware stored in the ROM 913. Alternatively, it may be implemented by software alone, hardware alone, a combination of software and hardware, or a combination of firmware.

  In addition, programs for implementing the above-described embodiment are also other disk drives such as a magnetic disk device 920, an FD (Flexible Disk), an optical disk, a CD (compact disk), an MD (mini disk), and a DVD (Digital Versatile Disk). You may memorize | store using the recording device by a recording medium.

  The second network system is also considered to have the same configuration as the first network system.

  By introducing it into a company system, it is possible to perform safe and efficient maintenance and management of user information necessary for realizing cooperation between specific users in cooperation between users between companies.

The block diagram of embodiment is shown. The process and data flow until confirming presence information are shown. The flowchart of the process which confirms presence information is shown. An example of the data structure of the request message 2-51 and the response message 2-52 is shown. An example of the data structure of the request message 2-51 and the response message 2-52 is shown. The example of the data structure of the permission information which the permission information storage part 1-33 memorize | stores is shown. The example of the data structure of the role information which the role information storage part 1-32 memorize | stores is shown. The flowchart of the process which produces | generates and updates the role information which the role information storage part 1-32 memorize | stores, and the combination which the combination memory | storage part 1-40 memorize | stores is shown. An example of the appearance of the 1st network system in an embodiment is shown. 2 illustrates an example of a hardware configuration of a server 910, a database 908, a system unit 909, and the like of the first network system in the embodiment.

Explanation of symbols

  1-1 1st network system, 1-2 2nd network system, 1-11 connecting unit, 1-111 transmitting unit, 1-112 receiving unit, 1-113 user specifying unit, 1-12 roll storage unit, 1- 13 permission information storage unit, 1-14 user information management unit, 1-15 organization storage unit, 1-151 organization information storage unit, 1-152 user information storage unit, 1-16 role information generation unit, 1-17 input unit 1-171 Role information input unit, 1-172 Combination creation unit, 1-18 Adapter unit, 1-19 System administrator terminal, 1-20 Combination storage unit, 1-21 Combination generation unit, 1-22 User terminal, 1-31 connection unit, 1-311 transmission unit, 1-312 reception unit, 1-313 user identification unit, 1-32 roll storage unit, 1-33 permission information storage unit, 1-34 user information Physical unit, 1-35 organization storage unit, 1-351 organization information storage unit, 1-352 user information storage unit, 1-36 role information generation unit, 1-37 input unit, 1-371 role information input unit, 1- 372 Combination creation unit, 1-38 adapter unit, 1-39 system administrator terminal, 1-40 combination storage unit, 1-41 combination generation unit, 1-42 user terminal, 2-51 request message, 2-52 response message 4-1 Example of data structure of request message, 4-2 Example of data structure of response message, 5-1 Example of data structure of request message, 5-2 Example of data structure of response message, 6-1 Requestor domain information, 6-2 Requestor role information, 6-3 Disclosure level, 6-4 Disclosure target, 7-1 Role information, 7-2 User User ID, 100 first network system, 901 CRT display device, 902 K / B, 903 mouse, 904 FDD, 905 CDD, 906 printer device, 907 scanner device, 908 database, 909 system unit, 910 server, 911 CPU, 912 bus, 913 ROM, 914 RAM, 915 communication board, 920 magnetic disk device, 921 OS, 922 window system, 923 program group, 924 file group, 931 telephone, 932 FAX machine, 940 Internet, 941 gateway, 942 LAN.

Claims (5)

In a user information management system in which a first network system and a second network system are network-connected,
The first network system is
A request source role indicating a role of a request source user requesting acquisition of user information and a request destination role indicating a role of a request destination user required to acquire the user information are transmitted to the second network system. With a transmitter,
The second network system is
A combination storage unit for storing a combination of user information of the second network system and role information indicating a role of the user;
A permission information storage unit that stores permission information indicating whether or not to permit transmission of the user information of the request destination user to the first network system for each role information;
A reception unit that receives the request source role and the request destination role transmitted by the first transmission unit;
From the combination stored in the combination storage unit, the role information indicating the same role as the request destination role received by the reception unit is searched, the user information for the request destination role is specified , and the permission information storage unit Whether the user information specified from the request destination role is permitted to be transmitted to the first network system with respect to role information indicating the same role as the request source role with reference to the permission information stored a user identifying unit determines,
When the user specifying unit determines that transmission of the user information specified from the request destination role is permitted to the first network system, the user information specified from the request destination role is set to the first network. A user information management system comprising: a second transmission unit configured to transmit to the system. The second transmission unit transmits the specified user information to the first network system when the user specification unit determines that transmission of the specified user information to the first network system is not permitted. user information management system of claim 1, wherein <br/> not to. The second network system further includes:
An organization storage unit for storing organization information of the second network system;
A role information generation unit that generates the role information based on the organization information stored in the organization storage unit;
A role information storage unit that stores the role information generated by the role information generation unit;
A user information storage unit for storing the user information of the second network system;
A combination generation unit that generates the combination of the user information and the role information of the second network system from the user information stored in the user information storage unit and the role information stored in the role information storage unit And
The user information management system according to claim 1, wherein the combination storage unit stores the combination generated by the combination generation unit. The second network system further includes:
A user information storage unit for storing the user information of the second network system;
A role information input unit for inputting the role information;
A role information storage unit for storing the role information input by the role information input unit;
A combination creating unit that inputs the user information stored in the user information storage unit and the role information stored in the role information storage unit and creates a combination of the user information and the role information;
The user information management system according to claim 1, wherein the combination storage unit stores the combination created by the combination creation unit. A user information management method of a user information management system in which a first network system and a second network system are network-connected,
The first network system includes a request source role indicating a role of a request source user who requests acquisition of user information, and a request destination role indicating a role of a request destination user requested to acquire the user information . A first transmission step of transmitting to a network system;
A reception step in which the second network system receives the request source role and the request destination role transmitted in the first transmission step;
The second network system searches for role information indicating the same role as the requested role received in the receiving step from a combination of user information of the second network system and role information indicating a user role , While specifying the user information for the request destination role, for each role information, refer to permission information indicating whether to permit transmission of the user information of the request destination user to the first network system. A user specifying step for determining whether or not transmission of the user information specified from the request destination role to the first network system is permitted for role information indicating the same role as the original role ;
When the second network system determines in the user specifying step that the user information specified from the request destination role is permitted to be transmitted to the first network system, the above specified information from the request destination role A user information management method comprising: a second transmission step of transmitting user information to the first network system .

Images