JP4955434B2 - Authentication processing device - Google Patents

Description

  The present invention relates to an entrance / exit management system that performs entrance / exit management based on information to be authenticated, and more particularly, to an authentication processing apparatus that performs authentication processing in entrance / exit management using personnel information.

  In recent years, in companies and the like, with increasing handling of confidential information, physical security awareness has increased. Therefore, by causing the user to possess an ID card on which ID (IDentification) information assigned to each user such as an employee is recorded as an identification card, the ID card is recognized by a predetermined reader such as a card reader. An entrance / exit management system (access control device) that has a high security level and allows the user to enter the corresponding room is attracting attention.

In recent years, in order to set entry qualifications more finely, a technique for managing entry / exit using personnel information has also been proposed (see, for example, Patent Document 1). In such an entry / exit management system using personnel information, it is easy to set user access permission for each department by setting an access time that grants entry permission to the building for each user's department. can do.
JP 2004-092057 A

  However, in the conventional entrance / exit management system using personnel information, the personnel information system is different for each company. For example, when a plurality of different companies such as group companies are to be managed on the same system, there is no response. There was a problem of becoming complicated.

  In addition, in the conventional entrance / exit management system using personnel information, even when it is applied to a single company, it is necessary to make a complicated setting change for each organizational reform period when organizational reform is frequently performed. There was also a problem.

  Therefore, the present invention has been devised to solve the above-described problems, and even if a plurality of personnel information systems having different organizational structures are used, the workload of the administrator is greatly increased. It is an object of the present invention to provide an authentication processing apparatus that can reliably perform entrance / exit management.

  The authentication processing apparatus of the present invention permits entry into a physical area, a first table that associates user identification information that uniquely identifies a user, and user attribute information that identifies the user's affiliation. Given to the second table that defines the authentication permission condition information, the third table that specifies the door information that specifies the door separating the entrance to and exit from the predetermined physical area, the user attribute information, and the user attribute information A fourth table that associates access authority information that identifies the access authority, the access authority information in the fourth table, authentication permission condition information in the second table, and door information in the third table And the fourth table based on the user attribute information and the second table, the third table, and the fourth table. A collaborative setting means for creating the fifth table using a bull and linking information of each table, the user attribute information acquired from the first table based on the user specifying information, and the user The access authority information acquired from the fourth table based on attribute information, and the authentication permission condition information of the second table associated with the access authority information of the fourth table by the fifth table And the above-mentioned subject is solved by providing the authentication processing means which performs the user's authentication processing based on the door information of the 3rd table.

  According to the authentication processing device of the present invention, even when a plurality of personnel information systems having different organizational structures are used, differences between a plurality of tables having different structures depending on the organization are absorbed using the fourth table. Therefore, the manager's work burden can be greatly reduced, and entrance / exit management can be performed reliably.

  Hereinafter, embodiments of the present invention will be described with reference to the drawings.

[First Embodiment]
First, an entrance / exit management system 1 will be described as a first embodiment of the present invention with reference to FIG. As shown in FIG. 1, the entrance / exit management system 1 includes an equipment system 10, an authentication processing device 20, and a personnel management system 30.

  The facility system 10 and the authentication processing device 20 manage the entry and exit of a user from an area with a low security level (low security level area) to an area with high confidential information (high security level area).

  The personnel management system 30 is a system that manages personnel information of users who use the entrance / exit management system 1 such as employees. The personnel information is information defining employee attributes such as employee department, gender, and position. The personnel management system 30 provides personnel information as appropriate in response to a request from the authentication processing device 20.

  Such an entrance / exit management system 1 may be of any form as long as it is configured to manage entry / exit from the low security level area to the high security level area. A low security level area is physically separated using a door or the like, and movement to each area is permitted according to the authentication process.

  Specifically, the entrance / exit management system 1 performs authentication processing for all users who wish to enter the advanced security level area, authenticates only legitimate users registered in advance, and enters the advanced security level area. Allow entry. Further, the entrance / exit management system 1 performs an authentication process on a user who wants to leave the high security level area as necessary, and permits the user to leave the high security level area. The low security level region and the high security level region are physically separated by a door 12 having an electric lock that can be locked and unlocked by electrical action.

  The facility system 10 is configured to show, for example, a non-contact IC card (Integrated Circuit) 5 owned by the user by a card reader 11 provided outside the room R1 which is an advanced security level area provided outside the advanced security level area. The information stored in the semiconductor memory is not read. The authentication processing device 20 is locked by an entrance / exit control unit (not shown) when the user is authenticated as a valid user based on the card ID that is the information to be authenticated among the information read by the card reader 11. The entrance to the high security level area is permitted by unlocking the electric lock.

  The entrance / exit management system 1 uniquely identifies the IC card 5 among the information stored in the IC card 5 owned by the user when unlocking the locked electric lock by such authentication processing. Card ID, a door ID (DNO: door number) unique to the locked door, and information indicating whether to enter or leave the room are transmitted to the authentication processing device 20. In addition, you may make it show the information which shows whether it is entering or leaving a room with device ID which specifies card reader 11 uniquely, for example.

  The authentication processing device 20 includes a personnel information database 21, an organization master database 22, a physical information database 23, an access time database 24, a linkage setting database 25, a linkage setting unit 26, an entrance / exit permission determination unit 27, And an information updating unit 28.

  The personnel information database 21 stores personnel information acquired from the personnel management system 30. For example, the personnel information database 21 includes an employee basic information table ST1 as shown in FIG. 2A and employee affiliation information tables ST2-a and ST2-b as shown in FIGS. 2B and 2C. And a card information table ST3 as shown in FIG. 2 (d) and an employee position information table ST4 as shown in FIG. 2 (e). The employee basic information table ST1 is a table in which an employee number (No) and an employee's first and last name are associated with each other. The employee affiliation information tables ST2-a and ST2-b are tables in which employee numbers and attribute codes related to employee affiliations are associated with each other. At the same time, affiliation information is hierarchized, and the number of hierarchies varies from company to company. Specifically, the employee affiliation information table ST2-a is a specific example in which the attribute code is hierarchized into four parts: a company code, an affiliation code, a department code, and a section code. The employee affiliation information table ST2-b is a specific example in which the attribute code is hierarchized into two, a company code and a section code. Note that the attribute codes in the employee affiliation information tables ST2-a and ST2-b are not necessarily in the same hierarchy even in the same organization. Further, the card information table ST3 is a table in which the card ID of the IC card 5 owned by the user, the user ID (employee number), the effective date of the IC card 5 and the expiration date are associated with each other. Furthermore, the employee post information table ST4 is a table in which an employee number is associated with an employee post code.

  The organization master database 22 includes a company master table MT11 as shown in FIG. 3A, an affiliation master table MT12 as shown in FIG. 3B, and a department master table MT13 as shown in FIG. The section master table MT14 as shown in FIG. 3 (d) and the post master table MT2 as shown in FIG. 3 (e) are stored. The company master table MT11 is a table in which company codes and company names are associated with each other. The affiliation master table MT12 is a table in which company codes, affiliation codes, and affiliation names are associated with each other. Furthermore, the department master table MT13 is a table in which company codes, department codes, department codes, and department names are associated with each other. Furthermore, the section master table MT14 is a table in which a company code, an affiliation code, a department code, a section code, and a section name are associated with each other. The post master table MT2 is a table in which post codes and post names are associated with each other. As described above, the organization master database 22 is configured in a hierarchy in accordance with the employee affiliation information tables ST2-a and ST2-b described above.

  The physical information database 23 includes a door information table TT1 as shown in FIG. 4A, a gate group registered door information table GT1 as shown in FIG. 4B, and a gate group as shown in FIG. An information table GT2 is stored. The door information table TT1 is a table in which door numbers (DNO) and door names are associated with each other. The gate group registration door information table GT1 is a table in which door numbers (DNO) and gate group codes are associated with each other. Furthermore, the gate group information table GT2 is a table in which gate group codes and work districts are associated with each other.

  As shown in FIG. 5, the access time database 24 stores an access time master table AT1 for designating the entry / exit permitted days of the week and the entry / exit permitted time zones for each access time ID.

  The cooperation setting database 25 stores an access zone table Z1 by affiliation as shown in FIG. 6A and a zone registration gate group information table Z2 as shown in FIG. 6B. The access zone table by affiliation Z1 associates an access authority code that specifies the access authority given to the attribute code related to the affiliation, the zone code that hierarchizes the gate group information table GT2, and the access time ID of the access time master table AT1. It is a table. The zone registration gate group information table Z2 is a table in which zone codes and gate group codes are associated with each other. Note that the affiliation master table MT1 affiliation code is not provided as an item in the affiliation-specific access zone table Z1, if the hierarchy differs for each personnel information system, the system is individually handled, and the number of table reorganization steps occurs. This is to avoid an increase in the amount of work due to the change of the association setting due to organizational reorganization or the like.

  Further, the cooperation setting database 25 stores an access authority information table X1 as shown in FIG. The access authority information table X1 is a table in which access authority codes are associated with attribute codes of various master tables stored in the organization master database 22. The authentication processing device 20 stores such an access authority information table X1 in the cooperation setting database 25 and uses a combination of the access authority information table X1 and the access zone table Z1 by affiliation, for example, as shown in FIG. In addition, it is possible to minimize the change of the table configuration due to the hierarchization of the organization without providing the affiliation code of the affiliation master table MT1 as an item in the affiliation-specific access zone table Z1. Therefore, when the contents of the organization master database 22 are changed due to organization reorganization or the like, the authentication processing device 20 can set the hierarchical affiliation only by changing the contents of the access authority information table X1. It becomes.

  Note that the above-described various tables are held by the authentication processing device 20, but the holding form of the tables is not limited to this embodiment, and can be held in any form.

  Note that the access time database 24 and the cooperation setting database 25 are constructed by performing setting processing by the cooperation setting unit 26 before the entry / exit management system 1 operates.

  The linkage setting unit 26 links information stored in various databases and sets information used in the entry / exit permission determination process by the entry / exit permission determination unit 27. The database setting processing operation by the cooperation setting unit 26 will be described later.

  The entrance / exit permission determination unit 27 determines entrance / exit permission based on information read from the IC card 5 by the card reader 11. The entrance / exit permission determination processing operation by the entrance / exit permission determination unit 27 will be described later.

  The information updating unit 28 updates the contents of the personnel information database 21, the organization master database 22, and the cooperation setting database 25 when the contents of the personnel management system 30 are changed due to organizational reform or the like.

  Such an authentication processing device 20 performs setting processing of the access time database 24 and the cooperation setting database 25 as shown in FIG. As a result of this processing operation, a database for determining the user entry qualification is constructed in the cooperation setting database 25.

  First, in step S1, the cooperation setting unit 26 acquires the company master table MT11, the affiliation master table MT12, the department master table MT13, the section master table MT14, and the post master table MT2 from the organization master database 22, and also includes physical information. The gate group information table GT2 is acquired from the database 23. The gate group information GT2 is information for managing a gate group that is a set unit of doors managed by the authentication processing device 20. Specifically, a gate group defines a set of doors that are boundaries of a certain physical space such as a room, an entire building, or an entire door in a site.

  Subsequently, in step S <b> 2, the cooperation setting unit 26 creates an access time master table AT <b> 1 that designates the entry / exit permitted day of the week and the entry / exit permitted time zone for each access time ID, and stores the access time master table AT <b> 1 in the access time database 24.

  Then, in step S3, the linkage setting unit 26 creates an access authority information table X1 in which the attribute code and the access authority code are associated with each other, and the zone code and access time in which the access authority code and the gate group information table GT2 are hierarchized. The access zone table Z1 classified by affiliation in which the access time ID of the master table AT1 is associated is created and stored in the cooperation setting database 25.

  Here, the zone is a concept in which the gate group defining the set of doors is further hierarchized, and a plurality of gate groups can be defined for each zone code as in the zone registration gate group information table Z2. Logical set unit. The access zone table Z1 by affiliation enables an administrator who manages the entrance / exit management system 1 to perform hierarchical management of physical configuration information.

  The authentication processing device 20 can perform setting processing of the access time database 24 and the cooperation setting database 25 by performing such processing by the cooperation setting unit 26 before the entrance / exit management system 1 operates.

  Next, the entrance / exit permission determination processing by the entrance / exit permission determination unit 27 will be described using the flowchart shown in FIG. For the sake of explanation, it is assumed that the user of employee number “M0001” tries to enter the door of door number (DNO) “D0001” at 20:00 on April 3, 2006 (nighttime on weekdays).

  First, in step S <b> 11, information stored in the IC card 5 is read by the card reader 11. The card reader 11 acquires the card ID stored in the IC card 5, the door number (DNO) of the door 12 on which the card reader 11 is installed, and the reading time. Thereafter, the card reader 11 transmits the acquired information to the authentication processing device 20. As a result, the card reader 11 inquires about entrance qualification determination. If the difference between the time when the card reader 11 reads the card ID of the IC card 5 and the time when the card reader 11 inquires the entrance / exit permission determination unit 27 is short enough that the authentication determination process is not hindered, the reading time Is no longer necessary.

  Further, the entrance / exit management system 1 may be provided with a time management server system (not shown) that manages accurate time in order to obtain time consensus between the card reader 11 and the authentication processing device 20.

  Subsequently, in step S12, the entrance / exit permission determination unit 27 refers to the card information table ST3 as shown in FIG. 2D from the acquired card ID, and determines whether the IC card 5 is within the expiration date. Determine whether. The entry / exit permission determination unit 27 advances the process to step S13 when the IC card 5 is within the expiration date, and advances the process to step S20 when the IC card 5 is not within the expiration date.

  In step S13, the entry / exit permission determination unit 27 refers to the personnel information database 21 using the card ID as a key, and acquires an attribute code related to the affiliation of the user who owns the IC card 5. For example, the entrance / exit permission determination unit 27 uses the user ID of the card information table ST3 as a key, and the employee affiliation information table ST2-a shown in FIG. 2B or the employee affiliation information table ST2 shown in FIG. The employee attribute code is acquired from -b. At this time, when the affiliation information is hierarchized according to the organization hierarchy as in the employee affiliation information tables ST2-a and ST2-b, the entrance / exit permission determination unit 27 acquires all the attribute codes. To do.

  Subsequently, in step S14, the entry / exit permission determination unit 27 refers to the gate group registration door information table GT1 of the physical information database 23 shown in FIG. 4B using the door number (DNO) as a key, and applies. Get the gate group code including the door.

  Subsequently, in step S15, the entrance / exit permission determination unit 27 uses the combination of the attribute code acquired in step S13 and the gate group code acquired in step S14, and the cooperation illustrated in FIG. Refer to the access zone table Z1 by affiliation stored in the setting database 25, the zone registration gate group information table Z2 shown in FIG. 6B, and the access authority information table X1 shown in FIG. Get information. For example, the user of the employee number “M0001” can be seen to belong to the belonging code “D0001” by referring to the employee belonging information table ST2-a. Further, referring to the gate group registered door information table GT1, it can be seen that the door with the door number (DNO) “D0001” belongs to the gate group represented by the gate group code “G0001”. Therefore, the entrance / exit permission determination unit 27 confirms the contents set as the entrance qualification by the combination of the affiliation code “D0001” and the gate group code “G0001”, and the access zone table by affiliation Z1 and the zone registration gate Reference is made to the group information table Z2 and the access authority information table X1. When the user belongs to a plurality of departments or the door is included in a plurality of gate groups, a plurality of pieces of cooperation setting information can be acquired.

  Subsequently, the entrance / exit permission determination unit 27 determines whether or not valid cooperation setting information exists in step S16. The entry / exit permission determination unit 27 advances the process to step S17 when the valid cooperation setting information exists, and advances the process to step S20 when the effective cooperation setting information does not exist.

  For example, referring to the employee affiliation information table ST2-a, the user with the employee number “M0001” belongs to the affiliation code “D0001”, and the door with the door number (DNO) “D0001” is the gate group registration door information. Referring to the table GT1, since it belongs to the gate group represented by the gate group code “G0001”, it belongs to the zone groups of the zone codes “Z0001” and “Z9999” from the zone registration gate group information table Z2. You can see that

  Therefore, referring to the access zone table Z1 by affiliation, it can be seen that the zone code “Z0001” and “Z9999” correspond to the three linkage setting information of the access authority codes “A0001”, “A0002”, and “A9001”.

  Subsequently, in step S <b> 17, the entrance / exit permission determination unit 27 acquires a time zone in which the user can enter the room from the valid cooperation setting information. Specifically, the entrance / exit permission determination unit 27 refers to the access zone table Z1 by affiliation and acquires the access time ID of the valid cooperation setting information. As described above, in the access zone table Z1 by affiliation shown in FIG. 6A, the access authority codes of the valid linkage setting information are “A0001”, “A0002”, and “A9001”. It can be seen that the corresponding access time IDs are “T0001” and “T0002”. As described above, the entrance / exit permission determination unit 27 refers to the access time master table AT1 of the access time database 24, and acquires a time zone in which the user can enter the room from the access time ID.

  Subsequently, in step S18, the entrance / exit permission determination unit 27 can enter the room by comparing the acquired time zone during which the room can be entered and the time when the inquiries about the entry qualification or the card ID of the IC card 5 are read. Determine whether or not. Then, the entry / exit permission determination unit 27 proceeds to step S19 when it is possible to enter the room, and grants entry permission, while if it is not the available time zone, the process proceeds to step S20. Proceed with refusal to enter.

  At this time, when there are a plurality of access time IDs, the entrance / exit permission determination unit 27 selects any one access time ID based on a predetermined rule.

  Therefore, by selecting any one of the access time IDs in the access time master table AT1 of the access time database 24, the result of the room permission with respect to the room entry time is changed.

  The predetermined rules will be described below. First, it is possible to define a rule that a determination is made based on data having the earliest registration date and time registered in the access time master table AT1. As shown in FIG. 5, since the data with the earliest registration date / time exists in the upper part of the access time master table AT1, there is an advantage that it can be searched in a very short time. Therefore, the authentication processing speed can be increased.

  Further, as shown in FIG. 5, for each access time ID in the access time master table AT1, a priority is set as attribute information, and a rule is selected so that an access time with a high priority is selected. Also good. By setting the priority in this way, it becomes possible to cope with a stricter condition.

  Further, by calculating the logical sum or logical product of the access times, specifically, the logical sum or logical product of the entry / exit permitted day of the access time master table AT1 shown in FIG. It is also possible to define a rule for determining a new authentication permission time zone in consideration of the above.

  Furthermore, by setting the start date when the data in the table becomes valid and the end date when it becomes invalid as the attribute of the access zone table by membership shown in FIG. 6A, for example, access Even if the work location of the user belonging to the authority code “A0003” is changed from “G0001” to “G0002” on October 1, 2006, all of the employee's entrance qualifications are individually set. It is possible to set in advance without having to change. Therefore, the setting can be easily changed even if it is a transfer or temporary assignment.

  The authentication processing device 20 can appropriately perform entry / exit permission determination processing even when the affiliation is hierarchized by performing such processing by the entry / exit permission determination unit 27.

  In this way, the entrance / exit management system 1 shown as the first embodiment of the present invention stores the access authority information table X1 in the linkage setting database 25, and the authentication processing device 20 uses the personnel information. When executing exit management, the access authority of the access authority information table X1 by the attribute code regarding the user's affiliation, the access authority code acquired from the access authority information table X1 based on the attribute code, and the access zone table Z1 by affiliation Based on the access time ID and the zone code associated with the code, a user authentication process is performed. Thereby, in this entrance / exit management system 1, the difference in the some table from which a structure differs with organizations can be absorbed using the access authority information table X1. For this reason, according to the entrance / exit management system 1, it is possible to make a flexible response regardless of the organizational form, such as combining the personnel information having different organizational structures into one, and greatly reduce the work load of the administrator. be able to.

  In the entrance / exit management system 1, as shown in FIG. 11, the access authority code, the corresponding table name, and the attribute code to be referred to are made variable by acquiring the attribute code related to the affiliation from each master table. An authority information table X1 ′ is created to generalize the access authority information table. As a result, it is not necessary to fix the attribute code to be referred to in advance, so that it is possible to cope with companies of different organizations.

  Further, in the entrance / exit management system 1, by using the access authority information table X1 ′, attributes having completely different meanings such as setting the entrance authority of the changing room using a combination of affiliation and gender, for example. Access authority can be set using a combination.

  Furthermore, in the entrance / exit management system 1, information on the number of tables to be referred to, that is, the number of items of the attribute code to be referred to is added to the access authority information table X1 ′, so that the number of attribute codes to be referred to is fixed in advance. Without being variable. Therefore, according to the entrance / exit management system 1, the data area of the access authority information table X1 'can be flexibly changed, and the entrance / exit permission determination process can be appropriately performed with the minimum necessary data amount.

  Furthermore, in the entrance / exit management system 1, an access authority that determines a combination of tables to be referred to at the time of user authentication processing by a logical operation, such as an access authority information table X1 ″ shown in FIG. it can. As a result, it is possible to perform finer authority settings such as different access authority for each company such as the head of the head office and the director of an affiliated company.

  In the entrance / exit management system 1 shown as the first embodiment, the data access at the time of the user authentication process is complicated, so that a long processing time is required. Steps S13 to S17 out of 10 can be executed, and a time zone in which each door can enter the door for each IC card 5 can be stored in advance. Thereby, data access at the time of authentication can be facilitated, and the authentication processing by the authentication processing device 20 can be speeded up.

[Second Embodiment]
Next, an entrance / exit management system 1 shown as a second embodiment of the present invention will be described. The entrance / exit management system 1 has the same configuration as the entrance / exit management system 1 shown in FIG. Accordingly, overlapping portions are denoted by the same reference numerals and detailed description thereof is omitted.

  The information update unit 28 acquires update data related to the personnel information database 21 and the organization master database 22 from the personnel management system 30 when the organization is reorganized or the like due to organization reorganization or the like, and updates based on the contents. Do.

  However, when only the organization master database 22 is simply updated, inconsistency with data in the cooperation setting database 25 may occur, and correct authentication processing may not be performed. Accordingly, the information update unit 28 updates the contents of the cooperation setting database 25 whenever the contents of the organization master database 22 are updated or periodically.

  Specifically, the information update unit 28 performs an update process as shown in FIG.

  First, in step S <b> 21, the information update unit 28 acquires and updates update data of the personnel information database 21 and the organization master database 22 from the personnel management system 30. For example, when the section master table MT14 as shown in FIG. 14A is changed to the section master table MT14 ′ as shown in FIG. The section master table change information MT141 indicating the correspondence before and after the change as shown in FIG. If the configuration of the section master table change information MT141 is clear by comparing the section master table MT14 and the section master table MT14 ′, the information update unit 28 changes the section master table from the personnel management system 30. Only the table MT14 ′ may be acquired and the section master table change information MT141 may be created.

  Subsequently, in step S22, the information update unit 28 updates the original access authority information table to the access authority information table X1 ′ ″ as shown in FIG. 15 based on the section master table change information MT141, and sets the cooperation setting. Store in the database 25.

  Thereafter, the entrance / exit permission determination unit 27 uses the updated personnel information database 21, the organization master database 22, and the linkage setting database 25 to determine the entrance / exit permission according to the series of procedures shown in FIG. Will do.

  In addition, in the entrance / exit management system 1, with the organizational integration or the like, the access authority setting contents such as the access authority code “A0003” in the access authority information table X1 ′ ″ as shown in FIG. There may be duplicates. In such a case, in step S23, the information update unit 28 integrates and deletes duplicate data in the access authority information table X1 ′ ″, and creates an access authority information table X1 ″ ″ as shown in FIG. To do.

  Thereby, in the entrance / exit management system 1, the data area of the access authority information table can be reduced, and the authentication processing by the authentication processing device 20 can be speeded up.

  The authentication processing device 20 performs such processing by the information updating unit 28, thereby avoiding inconsistency between the personnel information database 21, the organization master database 22, and the linkage setting database 25, and correct authentication processing. Can be performed.

  The information update unit 28 determines whether or not duplicate information is included in the cooperation setting database 25 when deleting duplicate data in the access authority information table, and the duplicate data is determined based on a predetermined rule. It may be deleted. For example, when the information update unit 28 deletes the duplicate data in the access authority information table X1 ′ ″ as shown in FIG. 15 and updates the access authority information table X1 ″ ″ as shown in FIG. Then, the data of the access authority code “A0002” in the affiliation access zone table Z1 as shown in FIG. 6A stored in the cooperation setting database 25 is duplicated. Therefore, the information updating unit 28 deletes the duplicate data in the affiliation-specific access zone table Z1 and updates the affiliation-specific access zone table Z1 'as shown in FIG.

  Note that the information update unit 28 may generate a predetermined warning, for example, when it is determined that duplicate information is included in the cooperation setting database 25. Thereby, the manager who manages the entrance / exit management system 1 can select the data to be deleted. In addition, the processing content may be automatically determined such that none of the duplicated data is applied or the data to be deleted is determined based on the priority.

  As described above, in the room entrance / exit management system 1, when duplicate information is included in the cooperation setting database 25, different access rights are allocated before organization integration by deleting the duplicate data. Even when organizations are integrated, access authority settings can be appropriately operated.

  Thus, in the entrance / exit management system 1 shown as the second embodiment of the present invention, the information update unit 28 in the authentication processing device 20 has changed the attribute code that affects the contents of the access authority information table X1. In this case, by updating the contents of the access authority information table X1, entry / exit permission determination processing can be appropriately performed even when organizational change or the like is performed.

  In the entrance / exit management system 1, a name is assigned to each access authority code as in the access authority information table X1 ′ ″ ″ as shown in FIG. 18 so that the administrator can confirm the setting contents. When displaying on the setting screen, the name may be displayed. As a result, in the entrance / exit management system 1, when the administrator refers to the setting contents of the complicated access authority at a later date, it is necessary to refer to all the setting items and check if only the name of the access authority code is referred to. It becomes possible to confirm easily in a short time.

  Moreover, in the entrance / exit management system 1, as shown in FIG. 19, you may make it provide the name rule engine table which prescribed | regulated the rule for assigning a name to an access authority code automatically. Thereby, in the entrance / exit management system 1, it is not necessary for the administrator to give the name of the access authority code himself, and the setting input time can be shortened.

  Furthermore, in the entrance / exit management system 1, when the name is given to the access authority code, if the length is long, it becomes difficult for the administrator to display the setting screen for confirming the setting contents. Therefore, in the entrance / exit management system 1, as shown in FIG. 19, a rule for shortening the name to be given to the access authority code is specified, and the name of the access authority code is kept within a predetermined length so that the administrator Visibility can be improved.

  Furthermore, in the entrance / exit management system 1, as shown in FIG. 20, an alias table may be provided in which abbreviations for aliases are defined for attribute codes related to affiliations. In this way, in the entrance / exit management system 1, by applying a predetermined short name, it is possible to give a name that is easy for the administrator to understand even if the name of the access authority code is short. Easy to understand.

  Moreover, in the entrance / exit management system 1, you may make it change the display content of the setting screen for an administrator confirming a setting content according to uses, such as the kind of display apparatus, for example. For example, in the entrance / exit management system 1, by switching the display content of the setting screen depending on whether the setting screen referred to by the administrator is a monitor of a personal computer or a display screen of a mobile phone, It is possible to perform highly convenient display according to the administrator's situation.

  The above-described embodiment is an example of the present invention. For this reason, the present invention is not limited to the above-described embodiment, and various modifications can be made depending on the design and the like as long as the technical idea according to the present invention is not deviated from this embodiment. Of course, it is possible to change.

It is a block diagram which shows the structure of the entrance / exit management system shown as the 1st Embodiment of this invention. It is a figure which shows the specific example of the table memorize | stored in a personnel information database, (a) shows the specific example of an employee basic information table, (b) and (c) show the specific example of an employee affiliation information table. (D) shows a specific example of the card information table, (e) is a diagram showing a specific example of the employee post information table. It is a figure which shows the specific example of the table memorize | stored in an organization master database, (a) shows the specific example of a company master table, (b) shows the specific example of an affiliation master table, (c) is A specific example of a department master table is shown, (d) shows a specific example of a section master table, and (e) shows a specific example of a post master table. It is a figure which shows the specific example of the table memorize | stored in a physical information database, (a) shows the specific example of a door information table, (b) shows the specific example of a gate group registration door information table, (c ) Is a diagram showing a specific example of a gate group information table. It is a figure which shows the specific example of the access time master table memorize | stored in an access time database. It is a figure which shows the specific example of the table memorize | stored in a cooperation setting database, (a) shows the specific example of an access zone table classified by affiliation, (b) shows the specific example of a zone registration gate group information table. It is. It is a figure which shows the specific example of the access authority information table memorize | stored in a cooperation setting database. It is a figure which shows the specific example of the access authority information table memorize | stored in a cooperation setting database, and the access zone table classified by affiliation, and is a figure for demonstrating the hierarchy response | compatibility of a cooperation setting database. It is a flowchart for demonstrating the setting process of the access time database and the cooperation setting database by the cooperation setting part in the entrance / exit management system shown as the 1st Embodiment of this invention. It is a flowchart for demonstrating the entrance / exit permission determination process by the entrance / exit permission determination part in the entrance / exit management system shown as the 1st Embodiment of this invention. It is a figure which shows the specific example of the access authority information table memorize | stored in a cooperation setting database, and is a figure which shows the specific example of the generalized access authority information table. It is a figure which shows the specific example of the access authority information table memorize | stored in a cooperation setting database, and is a figure which shows the specific example of the access authority information table which prescribes | regulates the access authority which determines the combination of the table to refer by logical operation . It is a flowchart for demonstrating the update process by the information update part in the entrance / exit management system shown as the 2nd Embodiment of this invention. It is a figure which shows the specific example of the table memorize | stored in an organization master database, (a) is a figure which shows the specific example of the section master table before change, (b) is the specific of the section master table after change It is a figure which shows an example, (c) is a figure which shows the specific example of the section master table change information which shows the response | compatibility before and behind a change. It is a figure which shows the specific example of the access authority information table memorize | stored in a cooperation setting database, and is a figure which shows the specific example of the access authority information table updated based on the section master table change information. It is a figure which shows the specific example of the access authority information table memorize | stored in a cooperation setting database, and is a figure which shows the specific example of the access authority information table which deleted duplicate data. It is a figure which shows the specific example of the access zone table classified by affiliation memorize | stored in a cooperation setting database, and is a figure which shows the specific example of the access zone table classified by affiliation from which duplicate data was deleted. It is a figure which shows the specific example of the access authority information table memorize | stored in a cooperation setting database, and is a figure which shows the specific example of the access authority information table which gave the name to the access authority code. It is a figure which shows the specific example of the name rule engine table memorize | stored in a cooperation setting database. It is a figure which shows the specific example of the alias table memorize | stored in a cooperation setting database.

Explanation of symbols

DESCRIPTION OF SYMBOLS 1 Entrance / exit management system 5 IC card 10 Equipment system 11 Card reader 12 Door 20 Authentication processing apparatus 21 Personnel information database 22 Organization master database 23 Physical information database 24 Access time database 25 Cooperation setting database 26 Cooperation setting part 27 Judgment of entrance / exit permission Department 28 Information Update Department 30 Personnel Management System AT1 Access Time Master Table GT1 Gate Group Registration Door Information Table GT2 Gate Group Information Table MT11 Company Master Table MT12 Affiliation Master Table MT13 Department Master Table MT14, MT14 'Section Master Table MT141 Section Master Table Change Information MT2 Post master table ST1 Basic employee information table ST2-a, ST2-b Employee affiliation information table ST Card information table ST4 Employee position information table TT1 Door information table X1, X1 ′, X1 ″, X1 ′ ″, X1 ″ ″, X1 ′ ″ ″ Access authority information table Z1, Z1 ′ Access zone Table Z2 Zone registration gate group information table

Claims (4)

A first table that associates user identification information that uniquely identifies a user with user attribute information that identifies the user's affiliation;
A second table defining authentication permission condition information permitting entry into an arbitrary physical area;
A third table for identifying door information for identifying a door separating the entrance to and exit from a predetermined physical area;
A fourth table associating the user attribute information with access authority information for specifying the access authority given to the user attribute information;
A fifth table associating the access authority information of the fourth table, authentication permission condition information of the second table, and door information of the third table;
The fourth table is created based on the user attribute information, and the fifth table is created using the second table, the third table, and the fourth table. Linkage setting means for linking information;
The user attribute information acquired from the first table based on the user identification information, the access authority information acquired from the fourth table based on the user attribute information, and the fifth table Authentication processing means for performing authentication processing of the user based on authentication permission condition information of the second table and door information of the third table associated with the access authority information of the fourth table; An authentication processing apparatus comprising: The authentication processing apparatus according to claim 1, wherein the cooperation setting unit creates the fourth table based on the user attribute information acquired from a master table that defines an affiliation destination.   The authentication processing apparatus according to claim 1, wherein the fourth table is configured by associating the number of items of the user attribute information referred to during the authentication processing of the user and the access authority information. .   4. An information updating unit for updating the contents of the fourth table when the user attribute information affecting the contents of the fourth table is changed. The authentication processing device according to any one of the above.

Images