JP4698481B2 - Worker management method, information processing apparatus, worker terminal, and program used therefor - Google Patents

Description

  The present invention relates to a worker management method, and more particularly, to a method for managing so as to restrict workers who log in to a work target device.

  When performing maintenance and inspection of a terminal device used by a user, maintenance personnel log in with an account dedicated to the maintenance personnel and perform work. At this time, the maintenance staff logs in by inputting a user ID and password dedicated to the maintenance staff to the terminal device and switching from the account used by the user to the account dedicated to the maintenance staff. However, maintenance personnel IDs and passwords for maintenance personnel have different settings for each terminal device, so if you do not know maintenance personnel IDs and passwords for maintenance personnel, contact the call center or the person in charge of the device for confirmation. There was a problem that had to be done.

  In addition, there is a method of entering the maintenance personnel ID and password for maintenance personnel in documents such as work manuals, but if the described documents are lost or stolen, unauthorized login of the terminal device by a third party, etc. This may cause a problem of leakage of personal information and confidential information recorded in the terminal device.

  As described above, since the maintenance personnel authentication for the device that is the work target in the conventional example is based on the maintenance personnel ID and password, another person who has acquired such data can perform unauthorized login, and security is improved. There was a problem that it was extremely low.

  On the other hand, techniques for further enhancing security for maintenance are disclosed in Patent Documents 1 to 3 below. First, Patent Document 1 discloses a system in which a script is downloaded to a user's terminal and the ASP is logged in using the script. Patent Document 2 discloses a system in which a person-in-charge ID is transmitted from a mobile terminal to a management server, a two-dimensional code for authentication is acquired, and the two-dimensional code is used to log in to a maintenance target device. Has been. Patent Document 3 discloses a system in which an operator accesses an authentication server from a mobile terminal, acquires key data after authenticating using an ID, and performs maintenance of the service terminal device using the key data. It is disclosed. As described above, after authentication is performed using the ID unique to the maintenance worker, data for authentication is further generated, and this is used to log in to the maintenance target device. It is necessary and is aimed at improving security.

JP 2002-328904 A JP 2005-332093 A JP 2006-53808 A

  However, in the system according to the above-described conventional example, as described above, as long as the worker ID can be acquired, subsequent authentication data can be acquired. There was a problem of high risk and low security.

  For this reason, the present invention improves the inconveniences of the above-described conventional example, and in particular, can manage workers who can work on a work target apparatus that performs maintenance, etc., and can improve security. The purpose is to provide a worker management method.

Then, the worker management method which is one form of this invention is:
A worker terminal operated by a worker who works on the work target device transmits identification information unique to the worker and identification information unique to the worker terminal to the information processing apparatus connected via the network. Access process;
The information processing apparatus performs authentication based on the information transmitted from the worker terminal and the worker authentication information stored in advance, and logs in to the worker target device stored in advance according to the authentication result An application transmission step of transmitting an application for executing processing to the worker terminal;
It is characterized by having.

In particular,
The worker terminal operated by the worker who performs work on the work target device, the identification information unique to the worker, and the identification information unique to the worker terminal are associated with each other and stored as worker authentication information and the work target device An information processing apparatus that stores an application for executing a login process, and a worker management method for managing a worker of a work target apparatus,
An access step in which the worker terminal transmits identification information unique to the worker and identification information unique to the worker terminal to the information processing device;
An information processing apparatus accepts information transmitted from a worker terminal and performs authentication based on worker authentication information; and
An information transmission device transmits an application to a worker terminal that has been successfully authenticated;
An application holding step in which the worker terminal stores and holds the application received from the information processing apparatus;
A login process in which the worker terminal executes a stored application and performs a login process on the work target device;
It is characterized by having.

  According to the above invention, first, worker-specific identification information and worker terminal-specific identification information are transmitted from the worker terminal to the information processing apparatus, and the worker who has accessed the worker at the information processing terminal Authenticate the terminal. Subsequently, an application that can log in to the work target device is transmitted to the worker terminal that has been successfully authenticated. Then, by executing the application from the worker terminal, information such as an account switching command is transmitted to the work target device using infrared communication or the like, whereby the account is switched and a login process is performed. As described above, the login application is provided to the worker terminal only when both the worker and the worker terminal are successfully authenticated, and the login is realized when the application is transmitted to the work target device. The security for the target device can be improved.

The login step counts the number of times the application has been executed on the work target device, and after the login step, the worker terminal deletes the application from the worker terminal according to the number of times the application is executed. Having
It is characterized by that.

In addition, before the application transmission step, the worker terminal has an execution number designation step of designating and transmitting the application execution number to the information processing device,
In the application transmission step, the information processing apparatus transmits the execution frequency information designated together with the application to the worker terminal,
The application holding process stores and holds execution frequency information together with the application,
The application deletion process deletes an application when the number of executions of the application reaches the number of times of execution information.
It is characterized by that.

  Furthermore, after an access process, an operator terminal has the operator information deletion process which deletes the information input at the access process from the inside of an operator terminal, It is characterized by the above-mentioned.

  As a result, even if the worker terminal is lost or stolen, the application and the input identification information unique to the worker are deleted from the worker terminal, so that information leakage can be prevented. Can prevent unauthorized login. In particular, it is possible to improve convenience and security by specifying the number of execution times until the application is deleted.

In addition, before the application transmission process,
A worker terminal is a work target device specifying step of transmitting identification information unique to the worker to the information processing device together with information for specifying the work target device;
An information processing device is configured to identify a work target device identified based on information associated with a pre-stored work target device and worker-specific identification information and information transmitted from the worker terminal. And a second authentication step for authenticating whether the worker is permitted to work,
The application transmission step transmits an application according to the authentication result in the second authentication step.
It is characterized by that.

  Further, after the work target device specifying step, the worker terminal has a second worker information deleting step of deleting information input in the work target device specifying step from the worker terminal. .

  Thereby, since it is also authenticated whether the worker is permitted to work on a specific work target device, authentication for the worker is performed twice, and security can be further improved. Similarly to the above, by deleting the information input to the worker terminal, it is possible to prevent information leakage when the terminal is lost.

An information processing apparatus according to another aspect of the present invention
An information processing apparatus connected via a network to a worker terminal operated by a worker who performs work on a work target device,
Storage means for storing worker authentication information in which identification information unique to a worker and identification information unique to a worker terminal are associated, and an application for executing a login process on a work target device;
An access receiving means for receiving the worker-specific identification information and the worker terminal-specific identification information transmitted from the worker terminal;
Authentication means for performing authentication based on the information received from the worker terminal by the access receiving means and the information for worker authentication;
Application transmitting means for transmitting the application to the worker terminal successfully authenticated by the authenticating means;
It is characterized by having.

  The application transmission means is configured to transmit the application by setting the application terminal to be deleted when the application is executed a predetermined number of times at the worker terminal.

In addition, from the worker terminal that has been successfully authenticated by the authentication means, comprising an execution number reception means for receiving designation of the execution number of the application,
The application transmission means sets the number of times specified as the number of executions that the application is deleted at the worker terminal and transmits the application.
It is characterized by that.

Furthermore, from the worker terminal that has been successfully authenticated by the authentication means, together with information for identifying the work target device, work target device specifying means for receiving identification information unique to the worker,
Work target device information storage means in which work target devices and worker identification information are stored in association with each other;
Second authentication for authenticating whether or not work is permitted for the work target device specified by the worker, based on the information received by the work target device specifying means and the work target device information storage means. Means, and
The application transmission unit transmits the application according to the authentication result in the second authentication unit.
It is characterized by that.

  Then, by configuring the information processing apparatus with at least two units, authentication of the worker and the worker terminal and authentication as to whether or not work on the work target device is permitted can be executed by different computers. In addition, the security can be improved and the processing load can be distributed.

Moreover, the program which is the other form of this invention is:
Information for worker authentication that is connected via a network to a worker terminal operated by a worker who performs work on the work target device, and is associated with identification information unique to the worker and identification information unique to the worker terminal. And an information processing apparatus provided with a storage means for storing a login process for the work target device,
An access receiving means for receiving the worker-specific identification information and the worker terminal-specific identification information transmitted from the worker terminal;
Authentication means for performing authentication based on the information received from the worker terminal by the access receiving means and the information for worker authentication;
Application transmitting means for transmitting an application to a worker terminal successfully authenticated by the authenticating means;
It is characterized by realizing.

In addition, the worker terminal according to another aspect of the present invention is
A worker terminal operated by a worker who performs work on the work target device,
Access means for transmitting worker-specific identification information and worker terminal-specific identification information to an information processing apparatus connected via a network;
In an information processing apparatus that stores worker authentication information in which identification information unique to a worker and identification information unique to a worker terminal are associated, and an application that executes a login process on the work target device, the access means Application receiving means for receiving and storing an application transmitted according to an authentication result based on the information transmitted and the information for worker authentication;
Login means for executing an application and performing login processing on the work target device;
It is characterized by having.

  The log-in means is characterized by comprising application deletion means for counting the number of times the application has been executed and deleting the application from the worker terminal in accordance with the number of times the application has been executed. In addition, the information processing apparatus is characterized by comprising worker information deleting means for deleting information input by the access means from within the worker terminal after transmission. Also, work for transmitting identification information unique to a worker together with information for identifying a work target device to an information processing device that authenticates whether or not the worker is permitted to work on the identified work target device. It is characterized by comprising a target device specifying means. Further, the present invention is characterized in that a second worker information deleting means for deleting the information input by the work target device specifying means from the worker terminal is provided.

Furthermore, in the present invention, the worker terminal operated by the worker who works on the work target device,
Access means for transmitting worker-specific identification information and worker terminal-specific identification information to an information processing apparatus connected via a network;
In an information processing apparatus that stores worker authentication information in which identification information unique to a worker and identification information unique to a worker terminal are associated, and an application that executes a login process on the work target device, the access means Application receiving means for receiving and storing an application transmitted according to an authentication result based on the information transmitted and the information for worker authentication;
Login means for executing an application and performing login processing on the work target device;
It is characterized by realizing.

  Even the information processing apparatus, worker terminal, and program configured as described above operate in the same manner as the worker management method, and therefore, the object of the present invention described above can be achieved.

  Since the present invention is configured and functions as described above, according to this, the login application is provided to the worker terminal only when both the worker and the worker terminal are successfully authenticated, and the application is executed. In this case, since the login to the work target device is realized, a plurality of conditions can be imposed on the login, and the security of the work target device can be improved.

  The present invention relates to maintenance support for maintenance personnel (operators) in a company that performs maintenance work such as computer devices (work target devices). Specifically, a method of logging in by switching a user account of a computer device used in normal work using a mobile phone (worker terminal) held by a maintenance worker who is going to perform maintenance work Thus, the system is intended to improve the convenience of maintenance personnel and to improve the security of the computer device to be worked.

  Hereinafter, in the embodiment, a terminal device that is a computer device that can log in will be described as an example of a work target device. However, any device that has a login function for each user or maintenance personnel may be used. Good. In addition, a mobile phone is described as an example of a worker terminal in which a maintenance person switches an account and performs a login operation with respect to a terminal device. However, other portable information processing devices that can be carried to a place where the terminal device is installed Alternatively, it may be a fixed information processing apparatus capable of performing a login operation by remote operation.

  A first embodiment of the present invention will be described with reference to FIGS. FIG. 1 is a block diagram showing the configuration of the entire system, and FIGS. 2 to 13 are diagrams for explaining the configuration of each device. FIG. 14 is a sequence diagram showing the operation of the entire system.

[Constitution]
The system for managing workers according to the present invention is operated by a terminal device 10 (work target device) that is a target of maintenance work and a maintenance worker (worker) who performs maintenance work on the terminal device 10. A mobile phone 20 (worker terminal), a maintenance person who logs in to the terminal device 10, that is, a login authentication server 30 that manages the mobile phone 20, and a login account management server 40 (information processing device) are provided. The terminal device 10 and the mobile phone 20 can transmit and receive information using the infrared ray 200. The mobile phone 20, the login authentication server 30, and the login account management server 40 are connected via a network 100 such as the Internet or an intranet. Hereinafter, the configuration of each device will be described in detail.

<Terminal device>
The terminal device 10 is a normal computer device operating for business processing, and is a device operated by a user or maintenance personnel, as will be described later, and is uniquely assigned to each device model number and terminal device. Information of the terminal device ID being stored. And as shown in FIG. 2, the control part 11, the apparatus information recording part 12, and infrared rays I / F13 are provided.

  The control unit 11 is an arithmetic device that executes arithmetic processing of the terminal device 10 and controls the device information recording unit 12 and the infrared I / F 13. The device information recording unit 12 records information of a terminal device ID uniquely assigned to each terminal device related to the system of the terminal device 10, and is configured by, for example, a built-in fixed disk (HDD or the like). The infrared I / F 13 is an application for switching from an account used by the user to an account dedicated to maintenance personnel from the infrared transmission / reception port 23 of the mobile phone 20 or a control transmitted when the application is executed on the mobile phone 20. This is the part that receives data such as commands.

  And the control part 11 will perform the process which switches a login account from a user to a maintenance worker, if an application or a control command etc. are received from the mobile telephone 20, so that it may mention later.

<Mobile phone>
The mobile phone 20 is a general mobile phone held by maintenance personnel. As shown in FIG. 3, an information transmission / reception unit 21 that transmits / receives information via the network 100 and an arithmetic device that controls the operation of the mobile phone. A control unit 22, an infrared transmission / reception port 23 for transmitting and receiving information by infrared communication, and a recording medium 24 such as a flash memory. As will be described later, an application for switching the account used by the user from the account used by the user to the account dedicated to the maintenance staff or a control command based on the execution, and the login authentication server 30 and the login, as will be described later. A function of connecting to the account management server 40 via the network 100 such as the Internet or an intranet and a function of transmitting / receiving information to / from the login authentication server 30 or the login account management server 40 are realized. The details will be described below.

  First, by installing a predetermined program in the control unit 22, as shown in FIG. 4, a transmission / reception processing unit 221, an input information deletion processing unit 222, an application reception processing unit 223, a login processing unit 224, an application deletion process Part 225 is constructed. Each of these processing units 221 to 225 will be described in detail.

  The transmission / reception processing unit 221 connects to the login authentication server 30 and the login account management server 40 from the information transmission / reception unit 21 via the network 100 such as the Internet or an intranet in response to an operation from a maintenance staff. It has a function to send and receive information. For example, the login authentication server 30 is accessed and a screen (see FIG. 6) for inputting maintenance staff information transmitted from the login authentication server 30 is received and temporarily stored in the recording medium 24 (reference numeral 242). reference). When the maintenance person inputs a maintenance person ID and a password, which are identification information unique to the maintenance person, on the screen, the portable information stored in the storage medium 24 in the mobile phone 20 in advance together with the maintenance person ID and the password. The mobile phone ID (see reference numeral 241), which is identification information unique to the phone, functions to transmit to the login authentication server 30 (access means). At this time, information such as the maintenance personnel ID input on the input screen is temporarily stored in the storage medium 24 together with the input screen information.

  Then, after the information is transmitted by the transmission / reception processing unit 221, the input information deletion processing unit 222 carries the information input on the input screen, that is, the maintenance personnel ID and the password temporarily stored here. It has a function of deleting from the telephone 20 (worker information deleting means).

  Further, when maintenance personnel authentication succeeds in the login authentication server 30 described above, an input screen is transmitted from the login account management server 40, as will be described later. Therefore, the transmission / reception processing unit 221 includes the input screen (see FIG. 13). ) And temporarily stored in the recording medium 24 (see reference numeral 242). Then, a maintenance person inputs a terminal device ID unique to the terminal device for specifying the terminal device 10 performing the maintenance work together with the maintenance personnel ID serving as the user name on the screen. Furthermore, the maintenance staff inputs the number of times to log in to the terminal device 10 on the input screen. Then, these pieces of information are transmitted from the transmission / reception processing unit 221 to the login account management server 40. Therefore, the transmission / reception processing unit 221 has a function of specifying the terminal device 10 that is a work target (terminal device specifying means). As a result, the login account management server 40 determines whether the logged-in maintenance staff has the login authority of the identified terminal device 10. At this time, information such as a maintenance staff ID and a terminal device ID as a user name input on the input screen is temporarily stored in the storage medium 24 together with the input screen information.

  Then, after the information is transmitted to the login account management server 40 by the transmission / reception processing unit 221, the input information deletion processing unit 222 described above is the information input on the input screen, that is, temporarily stored here. It also has a function of deleting the maintenance staff ID and the terminal device ID, which are user names, from the mobile phone 20 (second worker information deleting means).

  In addition, when the login account management server 40 determines that the application reception processing unit 223 has the login authority for the specific terminal device 10 as described above, the application reception processing unit 223 uses the account for the maintenance device dedicated to the terminal device 10. Since an application for switching and executing login processing is transmitted from the login account management server 40, it has a function of receiving it and storing it in the storage medium 24 (see reference numeral 243) (application receiving means). The login account management server 40 also transmits information indicating the number of executions designated by the maintenance staff together with the application, and stores this information together with the application.

  The log-in processing unit 224 executes the application when the maintenance staff performs maintenance work on the terminal device 10, and accounts the maintenance terminal 10 from the infrared transmission / reception port 23 to the infrared I / F 13 of the terminal device 10. It functions to transmit data such as the application itself for executing the switching or a control command (login means). As a result, the account of the terminal device 10 can be switched to that of the maintenance person himself, and login can be performed so that maintenance work can be performed. Note that the login processing unit 224 counts the number of times the application has been executed on the terminal device 10 and notifies the application deletion processing unit 225 of the count.

  The application deletion processing unit 225 functions to delete the application from the storage medium 24 according to the counted number of times of executing the application (application deletion unit). That is, as described above, the application is deleted from the storage medium 24 when the actual number of executions reaches the number of executions specified by the maintenance staff and transmitted from the login account management server 40 and stored. For example, each time the mobile phone 20 executes the application, the login processing unit 224 counts the number of execution times information transmitted and stored together with the application by one. When 0, the application is deleted.

<Login authentication server>
The login authentication server 30 is a general server computer installed on the network 100. As shown in FIG. 5, the login authentication server 30 controls the operation of the information transmission / reception unit 31 that transmits / receives information via the network 100 and the server itself. And a maintenance staff information database 33 formed in a recording device such as a hard disk drive. Then, as will be described later, the function of connecting to the mobile phone 20 or the login account management server 40 via the network 100 such as the Internet or an intranet, and the maintenance staff ID, password and mobile phone ID transmitted from the mobile phone 20 are used as the maintenance staff. A function of authenticating by comparing with the information database 33 and a function of transmitting information related to the authenticated mobile phone 20 to the login account management server 40 are realized. The details will be described below.

  First, as shown in FIG. 6, an input screen management processing unit 321, an authentication processing unit 322, and an authentication result notification processing unit 323 are constructed by incorporating a predetermined program in the control unit 32. Also, the maintenance staff information database 33 manages maintenance staff authentication information (information for worker authentication) that is information related to the mobile phone 10 held by the maintenance staff. As shown in FIG. For each employee, a mobile phone ID, a maintenance worker ID, and a password are associated and stored in a database.

  Then, the input screen management processing unit 321 transmits a screen for inputting a maintenance person ID, a password, and the like as shown in FIG. 8 to the mobile phone 20 that has accessed through the information transmitting / receiving unit 31. The maintenance staff ID and password input and transmitted from the mobile phone 20 and the function of receiving the mobile phone ID (access receiving means). Then, the received information is notified to the authentication processing unit 322.

  The authentication processing unit 322 checks whether or not the received maintenance staff ID, password, and mobile phone ID are registered in the maintenance staff information database 33 as those of the same maintenance staff, and whether or not they are a valid maintenance staff. Has a function of performing such authentication (authentication means). When the authentication is successful, the authentication result notification processing unit 323 notifies the login account management server 40 of the authentication information of the mobile phone 20 via the information transmission / reception unit 31.

  In this way, both the maintenance staff and the mobile phone can be authenticated by the maintenance staff ID and the mobile phone ID, and only when the maintenance staff registered in advance accesses with his / her registered mobile phone. The login account management server 40 is notified and connected.

<Login account management server>
The login account management server 40 is a general server computer installed on the network 100. As shown in FIG. 9, the login account management server 40 performs operations of an information transmission / reception unit 41 that transmits / receives information via the network 100 and the server itself. A control unit 42, which is an arithmetic device to be controlled, and a terminal device ID database 43 and a login account switching application database 44 formed in a recording device such as a hard disk drive are provided. As will be described later, a function of connecting the mobile phone 20 and the login authentication server 30 via the network 100 such as the Internet and an intranet, a function of receiving authentication information related to the mobile phone 20 from the login authentication server 30, and a mobile phone 20, a function for transmitting a screen for inputting information related to the terminal device 10, a function for comparing and authenticating a user name transmitted from the mobile phone 20 and the terminal device ID, and a user of the terminal device 10 on the authenticated mobile phone 20. The function to send together with information on the number of logins using an application that switches from the account used by the account to an account exclusively for maintenance personnel. The details will be described below.

  First, a predetermined program is incorporated in the control unit 32, so that a mobile phone information reception processing unit 421, an input screen management processing unit 422, an authentication processing unit 423, an application transmission processing unit 424, as shown in FIG. Has been built.

  The terminal device ID database 43 is a database that manages information related to the terminal device 10 that the maintenance staff is attempting to log in. As shown in FIG. 11, a user name and a terminal device ID are associated with each other. . That is, for each terminal device, the maintenance personnel ID of the maintenance personnel permitted to log in to the terminal device is associated with the terminal device ID (work target device information storage means).

  Further, the login account switching application database 44 is a database that manages an application for switching from an account used by the user of the terminal device 10 to an account dedicated to maintenance personnel. As shown in FIG. The execution file name of the corresponding application is stored in a database in association with the terminal device ID.

  Then, the mobile phone information reception processing unit 421 receives authentication information about the mobile phone 20 that has been successfully authenticated from the login authentication server 30 via the information transmitting / receiving unit 41 and notifies the input screen management processing unit 422 of the authentication information.

  The input screen management processing unit 422 transmits a screen for inputting terminal device information as shown in FIG. 13 to the mobile phone 20 that has been successfully authenticated. And the user name (maintenance personnel ID) and terminal device ID input and transmitted on the screen, and information regarding the number of times to log in using an application for switching from an account used by the user to an account dedicated to maintenance personnel, Receive. That is, it has a function of accepting information for specifying the terminal device 10 on which the maintenance worker performs maintenance work and information on the number of times login is performed for the maintenance work (work target device specifying means, execution number receiving means).

  The authentication processing unit 423 authenticates whether the terminal device ID transmitted from the mobile phone 20 and the maintenance personnel ID as the user name are registered in association with the terminal device ID database 43 illustrated in FIG. The maintenance staff has a function to check whether or not work is permitted for the terminal device 10 (second authentication means).

  The application transmission processing unit 424 reads the login account switching application of the identified terminal device 10 from the database 44 with respect to the mobile phone 20 of the maintenance staff who has been successfully authenticated by the authentication processing unit 423 with reference to FIG. And a function of transmitting to the mobile phone 20 (application transmitting means). At this time, information indicating the number of logins accepted by the input screen management processing unit 422 is transmitted together with the application. That is, when login is executed on the mobile phone 20 as many times as specified by the maintenance staff, the application is set to be deleted and the application is transmitted. Note that the application transmission processing unit 424 may transmit the application by setting to be deleted when the login process is executed a predetermined number of times instead of the number specified by the maintenance staff.

[Operation]
Next, the operation of the system configured as described above will be described with reference to FIG. First, a maintenance person who is going to perform maintenance and inspection of the terminal device 10 connects the mobile phone 20 that he / she owns to the login authentication server user 30 via the network 100 such as the Internet or an intranet (step A1).

  The login authentication server 30 that has received the access transmits a screen for inputting the maintenance personnel ID and password as shown in FIG. 8 to the mobile phone 20 (step A2). Then, the mobile phone 20 stores the received maintenance personnel ID and password input screen in the recording medium 203 (step A3).

  Subsequently, the maintenance person inputs the maintenance person ID and the password with the mobile phone 20 (step A4). Then, when the maintenance person presses the transmission button of the mobile phone 20, the mobile phone 20 adds the mobile phone ID of the mobile phone 20 together with the maintenance person ID and the password, and transmits it to the login authentication server 30 ( Step A5, access process). At this time, after transmitting the maintenance personnel ID, password, and cellular phone ID to the login authentication server 30, the cellular phone 20 automatically erases the maintenance personnel ID and password input from the recording medium 203 so that the input content does not remain. (Step A6, worker information deletion step).

  Subsequently, the login authentication server 30 receives the maintenance worker ID, password, and mobile phone ID transmitted from the mobile phone 20, and compares the information with the information in the maintenance worker information database 33 as shown in FIG. A7, authentication step). If the result of the comparison is that they do not match (No in step A7), the process returns to step A2 and the screen for entering the maintenance personnel ID and password is transmitted to the mobile phone 20 again. If they match (Yes in step A7), the authenticated information is transmitted to the login account management server 40, and the process proceeds to step A9 (step A8).

  Subsequently, the login account management server 40 transmits a screen for inputting the user name, the terminal device ID, and the number of logins of the terminal device 10 as shown in FIG. 13 to the mobile phone 20 (step A9). Then, the cellular phone 20 stores the received user name, terminal device ID, and login count input screen in the recording medium 203 of the cellular phone 20 (step A10). On the other hand, the maintenance staff inputs the user name, the terminal device ID, and the number of logins using the mobile phone 20 (step A11). Then, when the maintenance person presses the transmission button of the mobile phone 20, these pieces of information are transmitted to the account management server 40 (step A12, work target device specifying step, use number specifying step). Thereafter, the mobile phone 20 deletes the user name, terminal device ID, and login count input content transmitted to the login account management server 40 so as not to remain in the recording medium 24 (step A13, second worker information deletion step). .

  Thereafter, the login account management server 40 compares the user name and terminal device ID transmitted and received from the mobile phone 20 with information in the terminal device ID information database 43 as shown in FIG. 11 (step A14, Second authentication step). If they do not match as a result of the comparison (No in step A15), the process returns to step A9, and the screen for inputting the user name, the terminal device ID, and the number of logins is transmitted again to the mobile phone 20. If they match (Yes in step A15), the process proceeds to step A16.

  In step A16, the login account management server 40 searches for an application to switch from the account used by the user matching the terminal device ID in the login account management application database 44 to the account dedicated to the maintenance staff (step A16). . After the search, an application for switching from the account used by the user related to the matched terminal device 10 to the account dedicated to the maintenance staff is transmitted to the mobile phone 20 together with information regarding the number of logins (step A17, application transmission process).

  Subsequently, the mobile phone 20 stores the application and the execution frequency information received from the login account management server 40 in the storage medium 24 (application holding step). Then, the actual number of executions of the application, that is, the actual number of times of login to the terminal device 10 is compared with the number of times of execution information stored, and the number of times of login using the application is still stored. If the executed number of executions information has not been reached, it is in the loop of steps A18 to A21. Note that the number of execution times of the application is reduced by 1 each time the mobile phone 20 executes the application and logs in to the terminal device 10, and the execution number information is 1 or more. In this case, the loop (step A19 to step A21) is repeated, and when the number of execution times information becomes 0, the process exits the loop and proceeds to step A22 (step A18).

  When the maintenance staff performs maintenance work on the terminal device 10, the maintenance staff executes an application for switching from the account used by the user transmitted from the login account management server 40 on the mobile phone 20 to the account dedicated to the maintenance staff. (Step A19). After executing the application for switching from the account used by the user to the account exclusively for maintenance personnel, the application itself for automatically switching the account from the infrared transmission / reception port 23 of the mobile phone 20 to the infrared I / F 13 of the terminal device 10, or Information such as a control command is transmitted (step A20, login process).

  In response to the transmission from the mobile phone 20, the terminal device 10 performs the log-off operation of the account used by the user, the switch of the user, and the logon operation with the account dedicated to the maintenance staff, and the account used by the user Is switched to an account exclusively for maintenance personnel (step A21).

  When the number of logins reaches 0, the application for switching from the account used by the user to the account dedicated to the maintenance staff is automatically deleted from the mobile phone 20 (step A22, application deletion process).

  In this way, in the present invention, first, when the maintenance and inspection of the terminal device 10 are performed, the maintenance staff ID and password of the account dedicated to the maintenance staff are inquired to the call center and the person in charge of the equipment, the work manual, etc. It is not necessary to check the contents described in the document, etc., and the business efficiency can be improved.

  In particular, since the login application is provided only when the authentication of both the maintenance staff and the mobile phone operated by the maintenance staff is successful, it is possible to improve the security of the terminal device that is the maintenance target.

  In the present invention, in order to obtain an application for login, information on maintenance personnel ID and password input to the mobile phone and held in the memory, and further information on the user name and terminal device ID of the terminal device 10 Since it is deleted from the memory of the mobile phone 20 after being sent to the login authentication server 30 or the login account management server 40, even if the mobile phone is lost or stolen, information is not leaked and higher security is provided. can do.

  In addition, there is a setting for the number of times the user can log in with an application that switches from the account used by the user to an account exclusively for maintenance personnel. After the number of logins is exceeded, it is automatically deleted, so the mobile phone can be lost or stolen. The login application cannot be executed even when there is a problem, and higher security can be provided.

  In the above, the login authentication server 30 authenticates the mobile phone 20, and the login account management server 40 authenticates the mobile phone 20 to the terminal device 10. These authentications are performed at different stages, and Since it is running on a different computer, higher security can be provided. However, the login authentication server 30 and the login account management server 40 may be configured by one information processing apparatus, or may be configured by more information processing apparatuses.

  INDUSTRIAL APPLICABILITY The present invention can be used to improve security for a maintenance target device in a company that performs maintenance work for computer devices and the like, and has industrial applicability.

It is a block diagram which shows the structure of the whole system. It is a block diagram which shows the structure of a terminal device. It is a block diagram which shows the structure of a mobile telephone. It is a functional block diagram which shows the detail of a structure of a mobile telephone. It is a block diagram which shows the structure of a login authentication server. It is a functional block diagram which shows the detail of a structure of a login authentication server. It is a figure which shows the data structure of a maintenance worker database. It is a figure which shows the input screen provided to a mobile telephone from a login authentication server. It is a block diagram which shows the structure of a login account management server. It is a functional block diagram which shows the detail of a structure of a login account management server. It is a figure which shows the data structure of a terminal device ID database. It is a figure which shows the data structure of a login account switching application database. It is a figure which shows the input screen provided to a mobile telephone from a login account management server. It is a sequence diagram which shows operation | movement of the whole system.

Explanation of symbols

10 Terminal device 11 Control unit 12 Device information storage unit 13 Infrared I / F
20 Mobile phone 21 Information transmission / reception unit 22 Control unit 23 Infrared transmission / reception port 24 Recording medium 30 Login authentication server 31 Information transmission / reception unit 32 Control unit 33 Maintenance staff information database 40 Login account management server 41 Information transmission / reception unit 42 Control unit 43 Terminal device ID database 44 login account switching application database 221 transmission / reception processing unit 222 input information deletion processing unit 223 application reception processing unit 224 login processing unit 225 application deletion processing unit 321 input screen management processing unit 322 authentication processing unit 323 authentication result notification processing unit 421 mobile phone information Reception processing unit 422 Input screen management processing unit 423 Authentication processing unit 424 Application transmission processing unit

Claims (10)

A worker terminal operated by a worker who performs work on the work target device;
Unlike the work target device, the identification information unique to the worker and the identification information unique to the worker terminal are associated with each other and stored as worker authentication information, and the worker terminal executes a login process for the work target device. An information processing apparatus storing an application to be
A worker management method for managing workers of the work target device by:
An access step in which the worker terminal transmits identification information unique to the worker and identification information unique to the worker terminal to the information processing device;
An authentication step in which the information processing apparatus receives information transmitted from the worker terminal and performs authentication based on the worker authentication information;
The worker terminal, together with information for identifying the work target device, a work target device identifying step for transmitting worker-specific identification information to the information processing device;
The information processing apparatus is identified based on information associated with a work target apparatus stored in advance and identification information unique to the worker, and information transmitted from the worker terminal. A second authentication step for authenticating whether the worker is permitted to work;
An application transmission step in which the information processing apparatus transmits the application to the worker terminal that has been successfully authenticated in the second authentication step ;
An application holding step in which the worker terminal stores and holds the application received from the information processing apparatus;
Login in which the worker terminal executes the application stored and holds , switches from an account used by a user of the work target device to an account dedicated to maintenance personnel, and performs a log-in process for the work target device Process,
A worker management method characterized by comprising: In the application transmission step, the information processing apparatus transmits execution frequency information designated together with the application to the worker terminal,
The application holding step stores and holds the execution count information together with the application,
The login step counts the number of times the worker terminal has executed the application for the work target device,
After the login step, the worker terminal has an application deletion step of deleting the application from within the worker terminal when the number of executions of the application reaches the number of times of execution information.
The worker management method according to claim 1, wherein: Before the application transmission step, the worker terminal has an execution number designation step of designating and transmitting the number of executions of the application to the information processing apparatus,
In the application transmission step, the information processing apparatus transmits, to the worker terminal, execution frequency information designated by the worker terminal together with the application.
The worker management method according to claim 2, wherein: After the access step, the worker terminal has a worker information deletion step of deleting the information input in the access step from within the worker terminal.
The worker management method according to claim 1, 2, or 3 . After the work target device specifying step, the worker terminal has a second worker information deletion step of deleting information input in the work target device specifying step from within the worker terminal.
The worker management method according to claim 1, 2, 3 or 4 . An information processing device connected to a worker terminal operated by a worker who performs work on the work target device via a network, different from the work target device,
Storage means for storing worker authentication information in which identification information unique to a worker and identification information unique to a worker terminal are associated, and an application for the worker terminal to perform login processing on the work target device, ,
Access receiving means for receiving the worker-specific identification information and the worker terminal-specific identification information transmitted from the worker terminal;
Authentication means for performing authentication based on the information received from the worker terminal by the access receiving means and the worker authentication information;
From the worker terminal that has been successfully authenticated by the authenticating means, together with information for identifying the work target device, work target device specifying means for receiving worker-specific identification information;
Work target device information storage means in which work target devices and worker identification information are stored in association with each other;
Based on the information received by the work target device specifying means and the work target device information storage means, a second authentication is made as to whether or not work is permitted for the work target device specified by the worker. Authentication means,
By switching the account used by the user of the work target device from the account used by the user of the work target device to the worker terminal that has been successfully authenticated by the second authentication means , Application transmitting means for transmitting the application for performing login processing on the work target device ;
An information processing apparatus comprising: The application transmitting means transmits the application by setting the application to be deleted when the application is executed a predetermined number of times on the work target device at the worker terminal.
The information processing apparatus according to claim 6 . From the worker terminal that has been successfully authenticated by the authenticating means, comprising an execution number receiving means for receiving designation of the execution number of the application,
The application transmitting means transmits the application by setting the designated number of times as the number of times the application is deleted at the worker terminal.
The information processing apparatus according to claim 7 . The information processing apparatus according to claim 6 , wherein the information processing apparatus includes at least two units. It is connected to a worker terminal operated by a worker who performs work on the work target device via a network, is a device different from the work target device, and identification information unique to the worker and identification information unique to the worker terminal In an information processing apparatus provided with storage means for storing worker authentication information associated with and an application in which the worker terminal executes login processing for the work target device,
Access receiving means for receiving the worker-specific identification information and the worker terminal-specific identification information transmitted from the worker terminal;
Authentication means for performing authentication based on the information received from the worker terminal by the access receiving means and the worker authentication information;
From the worker terminal that has been successfully authenticated by the authenticating means, together with information for identifying the work target device, work target device specifying means for receiving worker-specific identification information;
Work is performed on the work target device specified by the worker based on the information received by the work target device specifying means and information stored in advance in association with the work target device and the worker identification information. A second authentication means for authenticating whether or not it is permitted;
By switching the account used by the user of the work target device from the account used by the user of the work target device to the worker terminal that has been successfully authenticated by the second authentication means , Application transmitting means for transmitting the application for performing login processing on the work target device ;
A program to realize

Images