JP6569378B2 - Execution control device, process execution system, and program - Google Patents

Description

  The present invention relates to an execution control device, a process execution system, and a program.

  In the event of any injustice or problem such as information leakage from a computer or device, it is common practice to identify the cause by analyzing trail information such as entry / exit history information and access log information. In order to correctly identify the cause, it may be necessary to analyze the correlation between various types of trail information. For this purpose, it is assumed that various types of trail information to be analyzed have been acquired.

  Conventionally, as a technique for protecting trail information such as log information from falsification and the like, it has been proposed to add and accumulate time information (time stamp) distributed from a time distribution server to log information (for example, patents) Reference 1).

JP 2005-277796 A JP 2008-160485 A JP 2007-199813 A JP 2010-170314 A

  In order to specify which access is associated with the process executed illegally, it is necessary to collect trail information in which a trail when the process is executed is recorded. In other words, in the state where the trail information based on the access cannot be collected in response to an access request to any device, the cause of the fraud cannot be specified when the access is unauthorized.

  An object of the present invention is to perform control so as to permit execution of a process only when a trail when a requested process is executed can be recorded.

The execution control apparatus according to the present invention includes a collection unit that collects log information generated in a plurality of log information generation apparatuses having a log information generation function as trail information; When all the trail information necessary for recording the trail when the process is executed can be collected by the collecting means , control is performed to permit the execution of the process, and all the trail information can be collected by the collecting means. And a control means for controlling to reject the execution of the process in the case where it is not .

Also, the control unit, even when the all trail information capable collected by said collecting means, when the conditions permitting the execution of the process does not meet the preset run permissive Control is performed so as to reject the execution of the processing.

Also, the control unit, even if possible collected by the all trail information the collector means, when the trail information associated with the execution request of the processing does not meet the time-series consistency , And control to reject the execution of the process.

A process execution system according to the present invention includes a plurality of log information generation apparatuses having a log information generation function, a collection unit that collects log information from each of the log information generation apparatuses as trail information, and a reception for receiving a process execution request When the trail information necessary for recording the trail when the process is executed can be collected by the collecting means in response to the execution request of the means and the process accepted by the accepting means, the execution destination of the process Control means for controlling the execution of the process in the designated process execution device, and for controlling the rejection of the execution of the process when all the trail information cannot be collected by the collection means. It is characterized by.

  In addition, when the execution of the process is permitted by the reception unit, the control unit, and the control unit, the process execution specified by the execution request of the process received by the reception unit as the execution destination of the process And an execution control device having transmission means for transmitting to the device.

  In addition, the process execution device includes the reception unit and the control unit.

  Further, the trail information is added with information indicating authenticity.

The program according to the present invention includes a collection unit that collects log information generated in a plurality of log information generation apparatuses having a log information generation function as trail information, When all the trail information necessary for recording the trail when the process is executed can be collected by the collecting means , control is performed to permit the execution of the process, and all the trail information can be collected by the collecting means. If not, it is made to function as a control means for controlling to reject the execution of the processing .

  According to the first aspect of the present invention, it is possible to control to permit execution of the process only when the trail when the requested process is executed is in a recordable state.

  According to the second aspect of the present invention, it is possible to perform control so as to permit execution of the process when the execution permission condition is further satisfied.

  According to the third aspect of the present invention, when the trail when the execution of the process is requested satisfies the time-series consistency, the execution of the process can be permitted.

  According to the fourth aspect of the present invention, it is possible to control to permit the execution of the process only when the trail when the requested process is executed can be recorded.

  According to the fifth aspect of the present invention, the execution control device can collectively control the execution of the requested processing.

  According to the sixth aspect of the present invention, execution control of the requested process can be distributed to the process execution devices.

  According to the seventh aspect of the invention, the evidence information can be given evidence.

  According to the invention described in claim 8, it is possible to perform control so as to permit the execution of the process only when the trail when the requested process is executed is in a recordable state.

It is the block block diagram which showed the process execution system in this Embodiment. It is a hardware block diagram of the computer which forms the access control apparatus in this Embodiment. It is the figure which showed an example of the data structure of the access control information memorize | stored in the access control information storage part in this Embodiment. It is the figure which showed an example of the data structure of the log management information memorize | stored in the log management information storage part in this Embodiment. It is the figure which showed an example of the data structure of the required log information memorize | stored in the required log information storage part in this Embodiment. It is the flowchart which showed the access control process which the access control part in this Embodiment implements. It is the conceptual diagram which showed the relationship of log information in this Embodiment. It is the conceptual diagram which showed the relationship of the time of a trail in this Embodiment.

  Hereinafter, preferred embodiments of the present invention will be described with reference to the drawings.

  FIG. 1 is a block configuration diagram showing a processing execution system in the present embodiment. FIG. 1 shows a plurality of log information generation apparatuses 1 and an access control apparatus 10. Each of the log information generation devices 1 has a function of generating log information as processing is performed. In FIG. 1, as an example of the log information generating device 1, an entrance / exit management server which is a main configuration of an entrance / exit management system, a document management server for managing documents, a mail server having a mail transmission / reception function, and access control to the outside A proxy server that performs processing, a user terminal 2 used by a user requesting execution of processing, a multifunction device having various functions such as a copy function and a print function, a network device that can be used as a user terminal, and a person who manages personal information of the user Information management server is shown. Among these, for example, the user terminal 2 and the network device generate log information based on a user login / logout or the like. Further, the document server or the multifunction peripheral executes the process in response to a process execution request from the user, but generates log information in order to record the execution contents of the process. In the present embodiment, these devices are collectively referred to as the log information generation device 1 when it is not necessary to individually explain these devices. In the present embodiment, the plurality of devices described above are examples of log generation devices, but other devices may be included.

  The access control device 10 is connected to each log information generating device 1 so as to be accessible via various networks. The access control apparatus 10 functions as an execution control apparatus for the requested process, accepts an execution request for the process transmitted from the user terminal 2, and applies the process execution apparatus specified as the execution destination to the received request. Send processing execution request to execute. In FIG. 1, a document server that registers and retrieves documents, a mail server that transmits and receives mail, a multifunction machine that executes various functional processes such as print processing and FAX transmission processing, and a personal information database are stored and managed. A personal information management server or the like that performs registration and retrieval of personal information corresponds to the processing execution device.

  The access control device 10 according to the present embodiment performs access control in which batch execution requests from a user are received and the received execution requests are distributed to a process execution device designated as a process execution destination by the user. When a request to execute the accepted process is transmitted to the specified process execution device, the transmission is temporarily suspended, and log information necessary for recording a trail when the process is executed can be collected It is characterized by transmitting after confirming whether or not.

  Here, “the trail when the process is executed” in the present embodiment is evidence that can specifically identify the contents of the executed process. Specifically, it is evidence that can specify “who, what, when, where, what, what route, what information, what information was done”. In other words, this embodiment can confirm that when a requested process is executed, a trail of the execution of the process is recorded in one or a plurality of log information collected from the log information generating device 1. For the first time, execution of the processing is permitted. As a trail when the process is executed, in this embodiment, as described above, “who”, “when”, “where”, “using”, “which route”, “what information” ”And“ What did you do ”to verify the trail of the execution of the process based on the log information, but depending on the content of the process, there are also unnecessary elements such as“ in which route ” Yes. Elements necessary for the certification of the trail are defined in access control information described later.

  FIG. 2 is a hardware configuration diagram of a computer forming the access control apparatus 10 according to the present embodiment. The computer forming the access control device 10 in the present embodiment can be realized by a general-purpose hardware configuration that has existed in the past. That is, as shown in FIG. 2, the computer connects the CPU 21, ROM 22, RAM 23, hard disk drive (HDD) 24, mouse 25 and keyboard 26 provided as input means, and display 27 provided as a display device. An input / output controller 28 and a network controller 29 provided as communication means are connected to an internal bus 30.

  Returning to FIG. 1, the access control apparatus 10 according to the present embodiment includes a log information collection unit 11, a necessary log information generation unit 12, an access control unit 13, a log information storage unit 14, an access control information storage unit 15, log management information. A storage unit 16 and a necessary log information storage unit 17 are provided. Note that components not used in the description of the present embodiment are omitted from the drawings. The log information collection unit 11 provides a log collection function that collects log information recorded in the log information generation device 1 as trail information and accumulates it in the log information accumulation unit 14. The necessary log information generation unit 12 sets log information necessary for trail recording when each process is executed based on the information stored in the access control information storage unit 15 and the log management information storage unit 16. The generated necessary log information is generated and set and registered in the necessary log information storage unit 17. The access control unit 13 is provided as a control unit, a reception unit, and a transmission unit, and provides an access control function that is characteristic in the present embodiment. That is, the access control unit 13 accepts an execution request for processing sent from the user terminal 2, and in response to the execution request for the processing, the trail information necessary for recording the trail when the processing is executed is log information. When collection is possible by the collection unit 11, control is performed to permit execution of the processing. When the execution of the process is permitted, an execution request for the received process is transmitted to the process execution apparatus designated as the execution destination of the process. The data included in the storage units 14 to 17 will be described later.

  Each component 11-13 in the access control apparatus 10 is implement | achieved by cooperation operation | movement with the program which operate | moves with the computer which forms the access control apparatus 10, and CPU21 mounted in the computer. The storage units 14 to 17 are realized by the HDD 24 mounted in the access control apparatus 10. Alternatively, the RAM 23 or an external storage means may be used via a network.

  Further, the program used in this embodiment can be provided not only by communication means but also by storing it in a computer-readable recording medium such as a CD-ROM or USB memory. The program provided from the communication means or the recording medium is installed in the computer, and various processes are realized by the CPU of the computer sequentially executing the program.

  Next, although the operation in the present embodiment will be described, it is necessary to generate necessary log information before the access control apparatus 10 executes access control. Hereinafter, generation of necessary log information will be described together with information stored in the storage units 15 to 17.

  FIG. 3 is a diagram illustrating an example of a data configuration of access control information stored in the access control information storage unit 15 according to the present embodiment. In the present embodiment, it is necessary to generate access control information in advance and register it in the access control information storage unit 15.

  In the present embodiment, the user terminal 2 transmits a process execution request to the access control apparatus 10 in response to an instruction from the user or an application so that the user can use a service provided by any of the process execution apparatuses. . The execution request for this process includes a command in a predetermined format for specifying the contents of the process and a user ID for identifying the requesting user. In the present embodiment, a process execution request or the content of a process that requests execution is referred to as a “request”.

  In the access control information, a service, a command, a necessary history type, and a necessary state condition are set as a set. In the usage service, a processing execution device that executes a service that the user wants to use by issuing a request is set. In the command, a command indicating the content of processing for the processing execution apparatus is set. In the required history type, a history type necessary for recording a trail when processing is executed according to the command is set. For example, in response to a document acquisition request, the time, user ID, and operation target are set as the required history type. This is because when (time), who (user ID), which information (document) This indicates that log information in which what is done (operation object) is recorded is necessary. In the above, we explained to record “who, when, where, what, what route, what information, what, what” with the document acquisition request. This indicates that one or a plurality of pieces of log information in which “when”, “who” and “for which information” are recorded should be collected.

  In the necessary state condition, a condition for permitting execution of the process for the request is preset as an execution permission condition. For example, this indicates that a document acquisition request needs to be made during business hours. The personal information browsing request indicates that it is necessary to satisfy the time-series consistency requirement that the user has logged into any terminal after entering any room. In FIG. 3, an example in which a time series relationship (“when” context) is required in the trail when a request is made is set as a necessary state condition. You may make it set execution permission conditions other than a time-sequential relationship, such as an apparatus used with a person, such as it being necessary to make a request using which user terminal.

  FIG. 4 is a diagram illustrating an example of a data configuration of log management information stored in the log management information storage unit 16 in the present embodiment. In the present embodiment, it is characterized that the log information necessary for recording the trail when the process is executed can be collected and then the execution of the process is permitted. Which trail element can be obtained from the log management information is set in the log management information. As shown in FIG. 4, the log management information is set with a log information collection source, a log information name, and a trail type. The log information collection source is a log information generation device that the log information collection unit 11 collects log information. The log information name is a name for identifying log information collected from the log information generation apparatus. The trail type is a trail element obtained from the log information. In the present embodiment, the elements of “who”, “when”, “where”, “using”, “on which route”, “for which information”, and “what” have been described above It is shown as an example.

  Incidentally, log information (login history) collected from the user terminal 2 includes the date and time when the user logged in or logged out, the IP address of the user terminal that logged in or logged out, the user ID of the user who logged in or logged out, and the login or logout type. Is included at least. The log information (entrance / exit history) collected from the entry / exit management server includes at least entry / exit date, user ID, room, entry / exit. Log information (document service usage history) collected from the document server is sent for the use of the service, the date and time when the document service was used, the IP address of the user terminal used to request the use of the service At least the content of the request (command) is included. The log information (remote login history) collected from the SSL-VPN device includes at least the date and time when the user logged in or logged out, the IP address of the user terminal that logged in or logged out, the user ID of the user, and login or logout. It is. The log information (service usage history) collected from the MFP includes the service ID of the service used, the date and time when the service was used, the IP address of the user terminal used to request the use of the service, and the use of the service The content (command) of the request sent for is included at least. The log information (mail transmission / reception history) collected from the mail server includes at least the date and time of transmission or reception, the user ID of the user who transmitted or received, and the type of transmission or reception. The log information (access history) collected from the proxy server includes at least the date of GET or PUT, the user ID of the GET or PUT user, and the type of GET or PUT.

  In the present embodiment, the type of trail acquired from each of the above log information is specified and set in the log management information, but the trail type illustrated in FIG. 4 is an example, and is specified from the log information. If the trail is possible, the trail may be set as the trail type.

  A system administrator or the like needs to set the access control information and log management information shown in FIGS. Then, when these pieces of information are set, the necessary log information generation unit 12 generates necessary log information based on these information as described below.

  FIG. 5 is a diagram showing an example of a data configuration of necessary log information stored in the necessary log information storage unit 17 in the present embodiment. In the necessary log information, a command and log information are set in association with each other. The command is a command included in the request, and the process execution device executes a process according to the command. In the log information, log information necessary for recording a trail when processing is executed based on the command is set. That is, the necessary log information generation unit 12 specifies log information necessary for obtaining the necessary history type corresponding to the command by referring to the log management information for each command included in the access control information, The identified log information is set in association with the command.

  When the necessary log information is set as described above, the characteristic access control processing in this embodiment can be executed. The processing performed by the access control apparatus 10 in this embodiment can be broadly divided into log collection processing in the log information collection unit 11 and access control processing in the access control unit 13. First, log collection processing performed by the log information collection unit 11 will be described.

  The log information collection unit 11 sequentially collects log information each time log information is generated from each log information generation device. Note that a log information generation apparatus that is a collection destination of log information is determined in advance by a system administrator or the like. At this time, each log information generation device proves the authenticity of the time by acquiring the time stamp from the clock server that issues the time stamp that proves the time and adding it to the log information transmitted to the access control device 10. You may do it. Each log information generation device may prove the authenticity of the information content by adding an electronic signature to the log information. As a result, the log information collection unit 11 can acquire log information having evidence ability. Here, “log information with proof ability” means that the origin of log information is not misrepresented, the log information is not falsified, the date and time information is guaranteed, and “who, when and where , What is used, what information is used for which information on which route ”means log information generated in a traceable manner. It can be said that the access control unit 13 can execute access control more accurately by using only log information with evidence capability.

  Next, the access control process performed by the access control unit 13 in the present embodiment will be described using the flowchart shown in FIG.

  When a request is transmitted from any user terminal 2, the access control unit 13 receives the request (step 101). Then, the access control unit 13 specifies the log information set in the necessary log information storage unit 17 in association with the command included in the received request (step 102). Subsequently, the access control unit 13 determines whether all the specified log information is currently available (step 103). For example, if the log information generation device that the log information is transmitted to is stopped, or if the network with the log information generation device is disconnected, the log information is not currently available. Other than that, it is determined that the current acquisition is possible.

  FIG. 7 is a conceptual diagram showing the relationship of log information. In FIG. 7, the “pidb / get” command is taken as an example. Referring to the necessary log information of this command, the command is associated with log information of login history, document service history and entry / exit history. As is apparent from FIG. 7, each log information is associated with the IP address and the user ID. Thus, “who” by the user ID, “when” by the date and time, “where” from the room of the entry / exit history, and “what (which user terminal)” is requested by the IP address, the document service history request Thus, “to which information (document)” and “what was done” are recorded in a state of being associated as a trail. In the case of this command, “by which route” is determined as an unnecessary trail element, and log information for recording the element has not been set in the access control information by the system administrator or the like.

  If all the log information set in the necessary log information is currently available (Y in step 104), the trail when the command is executed is recorded by these log information. . In this case, the access control unit 13 subsequently refers to the access control information and specifies a necessary state condition corresponding to the request (command) (step 105). Then, time-series consistency is determined (step 106). For example, a “pidb / get” command for browsing personal information will be described as an example. In the necessary state condition of this command, “entering room” and “logging in” are set. Usually, in order to view personal information using the user terminal 2 installed in any room, the user terminal 2 is logged in after entering the room where the user terminal 2 is installed. That is, the room entry time is earlier than the login time. In this embodiment, such time-series consistency is verified using log information. FIG. 8 is a conceptual diagram showing the relationship of the trail time in the present embodiment. The time-series consistency verification will be specifically described with reference to FIG.

  The access control unit 13 identifies the request requesting user terminal from the content of the request. In this example, assuming that the request is from the terminal A, the access control unit 13 refers to the login history of the terminal A, and the user ID is “ID111111” from the issue date and time (2015/3/20 10:34) of the request. It is recognized that the user has issued a request because the user "" is currently logged in. Further, the access control unit 13 can refer to the entry / exit history to determine that the user with the user ID “ID111111” is entering the room A when the request is issued.

  Here, comparing the entry date and time with the login date and time, it was 8:12 on March 20, 2015 that the room was entered before 9:03 on March 20, 2015. Recognize. That is, it can be determined that there is time-series consistency because the user terminal A is logged in after entering the room.

  As described above, when it is determined that there is time-series consistency as a result of comparing the date and time of the log information (Y in Step 107), the access control unit 13 permits the request received in Step 101, and the request Is transmitted to the designated request destination (step 108).

  As described above, in the present embodiment, it is confirmed that the trail when the process is executed can be recorded, and the request is processed only when the behavior of the user who has made the request has time-series consistency. To send to.

  On the other hand, if all the log information is not currently available (N in step 104), the access control unit 13 determines that the execution trail cannot be recorded even if the process is executed according to the request. The request is rejected (step 109). For example, in the case of a “pidb / get” command for browsing personal information, a trail of “where (in which room)” cannot be recorded if log information cannot be collected from the entry / exit management server. In this case, the access control unit 13 notifies the request transmission source that the request has been rejected.

  By the way, in the above description, the access control apparatus 10 collectively receives requests from the user terminal 2, determines whether to permit the execution of the process depending on whether the trail can be recorded, Deliver the request. In other words, the execution control device collectively controls the requested processing by causing the access control device 10 to function as a reception unit, a control unit, and a transmission unit. However, it may be configured such that each processing execution device determines whether or not each processing execution device is permitted to execute processing by disposing a receiving unit and a control unit in each processing execution device. In this case, the access control function in the access control device 10 is allocated to each processing execution device, and the access control device 10 functions as a log information collection function and a storage unit for log information and the like.

  The basic process flow may be the same as described above, but the request transmitted from the user terminal 2 is directly received by the process execution apparatus that executes the process. Whether the process execution apparatus that has received the request can collect log information necessary for recording a trail when the process is executed by inquiring of the access control apparatus 10 based on the request or by analyzing the log information itself. If it can be collected, the process is executed.

  In the present embodiment, for example, log information for recording a trail of “who” is set in the access control information. According to the necessary log information created based on the access control information, the document acquisition command (docdb / get) confirms the trail of “who” in the login history. However, as is clear from referring to the log management information, the log information that can specify “who” is not limited to the login history. Therefore, if the log information of the login history cannot be collected, “who” (user ID) of other log information may be referred to instead of the login history. Alternatively, a plurality of log information may be set as necessary log information for the “who” trail.

  DESCRIPTION OF SYMBOLS 1 Log information generation apparatus, 2 User terminal, 10 Access control apparatus, 11 Log information collection part, 12 Necessary log information generation part, 13 Access control part, 14 Log information storage part, 15 Access control information storage part, 16 Log management information Storage unit, 17 Necessary log information storage unit, 21 CPU, 22 ROM, 23 RAM, 24 Hard disk drive (HDD), 25 Mouse, 26 Keyboard, 27 Display, 28 Input / output controller, 29 Network controller, 30 Internal bus.

Claims (8)

Collection means for collecting log information generated in a plurality of log information generation devices having a log information generation function as trail information;
In response to the execution request of the process that has been sent , control is performed to permit the execution of the process when all the trail information necessary for recording the trail when the process is executed can be collected by the collection means , Control means for controlling to reject the execution of the process when all the trail information cannot be collected by the collecting means;
An execution control device comprising: Said control means, even when the all trail information capable collected by said collecting means, when the conditions permitting the execution of the process does not meet the preset run permissive the process The execution control apparatus according to claim 1, wherein control is performed so as to reject execution of the execution. Said control means, said also all trail information in a case that can be collected by the collecting means, when the trail information associated with the execution request of the processing does not meet the time-series integrity, the The execution control apparatus according to claim 2, wherein control is performed so as to reject execution of the process. A plurality of log information generation devices having a log information generation function;
A collecting means for collecting log information as trail information from each of the log information generating devices;
A receiving means for receiving a processing execution request;
In response to the execution request of the process received by the reception unit, the trail information necessary for recording the trail when the process is executed is designated as the execution destination of the process when the collection unit can collect the trail information. Control means for controlling the execution of the process in the process execution device, and controlling to reject the execution of the process when all the trail information cannot be collected by the collection means;
A processing execution system comprising:   When the execution of the process is permitted by the reception unit, the control unit, and the control unit, the execution request of the process received by the reception unit is sent to the process execution device designated as the execution destination of the process The processing execution system according to claim 4, further comprising: an execution control device having a transmission means for transmitting.   The process execution system according to claim 4, wherein the process execution apparatus includes the reception unit and the control unit.   The processing execution system according to claim 4, wherein information indicating authenticity is added to the trail information. Computer
Collection means for collecting log information generated in a plurality of log information generation devices having a log information generation function as trail information;
In response to the execution request of the process that has been sent , control is performed to permit the execution of the process when all the trail information necessary for recording the trail when the process is executed can be collected by the collection means , Control means for controlling to reject the execution of the process when all the trail information cannot be collected by the collecting means;
Program to function as.

Images