JP7231082B2 - Management system, control device, management method and program - Google Patents

Description

The present invention relates to a management system, control device, management method and program.

Information processing apparatuses (computers) generally have a function of setting access rights (hereinafter simply referred to as rights) to data stored in the information processing apparatus according to user IDs (identifiers). Furthermore, generally, in order to protect important functions, data, etc., access rights to important functions, data, etc. are restricted to administrators or the like of the information processing apparatus. In other words, in order to protect important functions, data, etc., a predetermined user (administrator of an information processing device, etc.) is given stronger authority than a user other than the predetermined user (hereinafter referred to as a general user). to give

In Patent Document 1, with respect to a device that holds control target data internally, access to the control target data is granted a special authority based on the life cycle state of the device and the location and/or time of the device. Techniques for restricting users with

JP 2016-058035 A

It should be noted that the disclosure of the prior art document mentioned above is incorporated herein by reference. The following analysis is made in light of the present invention.

As described above, it is possible to protect the important functions, data, etc. by limiting the access authority to the important functions, data, etc. to the administrator of the information processing apparatus. However, general users may need temporary access to important functions or data.

Here, in the technology described in Patent Document 1, when access to controlled data is restricted to users with special authority (administrators, etc.), users other than the administrator cannot access the controlled data. do not allow access to Therefore, with the technology described in Patent Literature 1, when access to controlled data is restricted to users with special authority, convenience for users other than administrators may be reduced.

Furthermore, in the technique described in Patent Document 1, access rights are granted when the state (life cycle state) of the device, the location and/or the time of the device satisfy predetermined conditions with respect to the device that internally retains data to be controlled. users who have access to the controlled data. Therefore, the technique described in Patent Literature 1 cannot prevent a user who has access rights from unnecessarily accessing the control target data.

SUMMARY OF THE INVENTION Accordingly, it is an object of the present invention to provide a management system, a control device, a management method, and a program that contribute to reducing security risks of managed devices while improving user convenience.

According to a first aspect of the invention, a management system is provided. The management system uses a first ID having a predetermined authority to operate a managed device, a control device that controls the managed device, and terminal location information that indicates the location of its own terminal. and transmitting the terminal location information to the controller. The control device requests authentication of the terminal to the managed device, and if the managed device authenticates the terminal, the control device determines the first An ID usage management unit is provided for determining whether or not to allow the terminal to use the ID.

A second aspect of the present invention provides a control device. The control device controls a managed device that can be operated using a first ID having predetermined authority. Further, the control device requests the managed device to authenticate the terminal, and if the managed device authenticates the terminal, based on the terminal location information indicating the location of the terminal and the usage determination time, An ID usage management unit that determines whether or not to allow the terminal to use the first ID.

A third aspect of the present invention provides a management method. The management method includes the step of acquiring terminal location information indicating the location of the terminal. Further, the management method includes the step of requesting authentication of the terminal from a managed device that can be operated using a first ID having predetermined authority. Further, in the managing method, when the terminal is authenticated, the step of determining whether or not to permit the terminal to use the first ID based on the terminal location information and a use determination time. including.
It should be noted that the method is tied to a specific machine, the controller that controls the managed device.

A fourth aspect of the present invention provides a program. The program causes the computer that controls the control device to receive terminal location information indicating the location of the terminal from the terminal. Further, the program causes the computer to execute a process of requesting terminal authentication from a managed device that can be operated using a first ID having predetermined authority. Further, the program determines whether or not to allow the terminal to use the first ID based on the terminal location information and a usage determination time when the terminal is authenticated. , is executed by the computer.
These programs can be recorded in a computer-readable storage medium. The storage medium can be non-transient such as semiconductor memory, hard disk, magnetic recording medium, optical recording medium, and the like. The invention can also be embodied as a computer program product.

According to each aspect of the present invention, there is provided a management system, a control device, a management method, and a program that contribute to reducing security risks of managed devices while improving user convenience.

1 is a diagram for explaining an overview of an embodiment; FIG. 1 is a block diagram showing an example of the overall configuration of a management system 1; FIG. 6 is a diagram showing an example of a usage application information table 105; FIG. FIG. 11 is a diagram showing an example of a managed server table 106; FIG. 6 is a diagram showing an example of a work user table 107; FIG. 4 is a flow chart showing an example of the operation of the management server 100; 4 is a flow chart showing an example of the operation of the management server 100; 4 is a flow chart showing an example of the operation of the management server 100; 4 is a flow chart showing an example of the operation of the management system 1; 4 is a flow chart showing an example of the operation of the management system 1; 4 is a flow chart showing an example of the operation of the control device 300; 4 is a flow chart showing an example of the operation of the control device 300;

First, an overview of one embodiment will be described with reference to FIG. It should be noted that the drawing reference numerals added to this outline are added to each element for convenience as an example to aid understanding, and the description of this outline does not intend any limitation. Also, connecting lines between blocks in each block diagram include both bi-directional and uni-directional. The unidirectional arrows schematically show the flow of main signals (data) and do not exclude bidirectionality. Furthermore, in the circuit diagrams, block diagrams, internal configuration diagrams, connection diagrams, etc. disclosed in the present application, an input port and an output port exist at the input end and the output end of each connection line, respectively, although not explicitly shown. Input/output interfaces are similar.

As described above, there is a desire for a management system that contributes to reducing security risks of managed devices while improving user convenience.

Therefore, as an example, a management system 1000 shown in FIG. 1 is provided. The management system 1000 includes a managed device 1010 , a control device 1020 and a terminal 1030 .

The managed device 1010 can be operated using a first ID having predetermined authority. Terminal 1030 acquires terminal location information indicating the location of terminal 1030 and transmits the terminal location information to control device 1020 .

The control device 1020 controls the managed device 1010 . Furthermore, the control device 1020 has an ID usage manager 1021 . The ID usage management unit 1021 requests authentication of the terminal 1030 to the managed device 1010 . When managed device 1010 authenticates terminal 1030, ID usage management unit 1021 allows managed device 1010 to use the first ID based on the terminal location information received from terminal 1030 and the time to be determined. , the terminal 1030 determines whether or not to allow it. In the following description, the time subject to determination will be referred to as usage determination time.

Here, it is assumed that the first ID is a user ID (hereinafter referred to as a privileged ID) having stronger authority than the user IDs of general users. It is also assumed that the time to be judged is the time at which the judgment is made. In this case, with respect to the terminal 1030 authenticated by the managed device 1010, the control device 1020 determines whether the terminal 1030 is permitted to use the privileged ID of the managed device 1010 by combining the location of the terminal 1030 and the time of determination. based on Therefore, the control device 1020 assigns the privilege ID in the managed device 1010 to the terminal 1030 that is authenticated by the managed device 1010 and that exists at a position that satisfies the predetermined condition at a time that satisfies the predetermined condition. allow the use of

In other words, in the management system 1000 , the control device 1020 permits an external device (that is, the terminal 1030 ) different from the managed device 1010 to use the privileged ID of the managed device 1010 . Furthermore, in the management system 1000, even a general user can use the privileged ID of the managed device 1010 if a predetermined condition is satisfied. Therefore, the management system 1000 contributes to improving convenience for the user who uses the managed device 1010 .

On the other hand, the control device 1020 causes the managed device 1010 to authenticate the terminal 1030 . Furthermore, based on the location and time of the terminal 1030 , the control device 1020 determines whether or not the terminal 1030 is permitted to use the privileged ID in the managed device 1010 . In other words, the control device 1020 limits the terminal 1030 that can use the privileged ID of the managed device 1010, and the places and times that it can be used. Therefore, the management system 1000 contributes to reducing security risks of the managed device 1010 .

Therefore, the management system 1000 contributes to reducing the security risk of the managed device 1010 while improving user convenience.

[First embodiment]
A first embodiment will be described in detail with reference to the drawings. In the following description, a managed device is called a managed server. However, this is not intended to limit managed devices to servers.

FIG. 2 is a block diagram showing an example of the overall configuration of the management system 1 according to this embodiment. The management system 1 includes a management server 100 , a terminal 200 and a control device 300 . Although FIG. 2 shows one terminal 200 , this does not mean that the management system 1 is configured to include one terminal 200 . Of course, the management system 1 may include two or more terminals 200 .

The control device 300 connects to managed servers (managed devices) (301a, 301b). In the following description, the managed servers (310a, 310b) will be referred to as managed servers 310 when there is no need to distinguish between them. Also, although FIG. 2 shows two managed servers (301a, 301b), this is not meant to limit the number of managed servers 310 to two. Of course, the management system 1 may be configured including one or more managed servers 310 .

The control device 300 and managed servers 310 are arranged in a managed server network (first network) 400 . In the management system 1 according to this embodiment, the managed server network 400 is assumed to be a LAN (Local Area Network). In other words, in the management system 1 according to this embodiment, the control device 300 and the managed server 310 are arranged within the LAN. When the terminal 200 exists within the managed server network 400 , it is assumed that the terminal 200 can be connected to the control device 300 and the managed server 310 via the managed server network 400 .

Also, the terminal 200 can be connected to the management server 100 via a second network different from the managed server network 400 . For example, the second network may be the Internet. Alternatively, the second network may be a LAN different from managed server network 400 .

The management server 100 includes a usage application management unit 103 , a management server control unit 104 and a management server storage unit 101 . Furthermore, the management server 100 comprises communication means (not shown). It goes without saying that the management server 100 may be configured including hardware and/or software (not shown).

The terminal 200 is an information processing device (computer) used by a working user. For example, the terminal 200 may be a smart phone, a tablet terminal, or the like. Terminal 200 includes ID management relay section 201 and location information acquisition section 202 . Furthermore, the terminal 200 comprises communication means (not shown). Of course, the terminal 200 may be configured including hardware and/or software (not shown).

The control device 300 is an information processing device (computer) that controls the managed server 310 . The control device 300 includes an ID usage management section 301 . Furthermore, the control device 300 comprises communication means (not shown). Of course, the control device 300 may be configured including hardware and/or software (not shown).

The managed server 310 is an information processing device (computer). Specifically, the managed server 310 is an information processing device (computer) that can be connected using at least one of a first ID having predetermined authority and a second ID different from the first ID. ). In the following description, it is assumed that the first ID is a privileged ID.

The management server 100 will be described in detail below.

The management server storage unit 101 stores information necessary for operating the management server 100 . Management server storage unit 101 stores ID management database 102 . The management server storage unit 101 is realized by a magnetic disk device, an optical disk device, and a semiconductor memory.

The ID management database 102 will be described in more detail below.

The ID management database 102 stores information that associates information identifying the managed server 310 with usage application information. In the following description, a table in which information identifying the managed server 310 and usage application information are associated is referred to as a usage application information table 105 .

The information for identifying the managed server 310 may be a number assigned to each managed server 310 or the like, and the details are not limited as long as the managed server 310 can be identified. In the following description, information for identifying the managed server 310 is called a managed server ID.

The usage application information includes a privilege ID (first ID), information indicating authority corresponding to the privilege ID, usage start time, and benefit end time.

Information indicating the authority corresponding to the privilege ID is information indicating the authority that can be used in the managed server 310 using the privilege ID. In the following description, of the information indicating the authority corresponding to the privilege ID, the information included in the usage application information will be referred to as the authority to be applied for.

The usage start time is the time when the user plans to start using the managed server 310 . On the other hand, the use end time is the time when the user plans to end the use of the managed server 310 . In other words, the user applies to use the managed server 310 from the use start time to the use end time.

FIG. 3 is a diagram showing an example of the usage application information table 105. As shown in FIG. Specifically, FIG. 3 shows a table in which managed server IDs, work user IDs, privilege IDs, authority to be applied for, use start times, and use end times are associated with each other.

Furthermore, the ID management database 102 associates and stores the managed server ID, the server connection information, the authentication information corresponding to the second ID, the registered position information, and the distance threshold. In the following description, the second ID will be called a connection user ID. The connection user ID is a user ID associated with the privilege ID and is a user ID for connecting to the managed server 310 . Further, in the following description, a table that associates a managed server ID, server connection information, connection user authentication information corresponding to a connection user ID (second ID), registered location information, and a distance threshold is used. , is called a managed server table 106 . In the following description, the authentication information corresponding to the connection user ID is called connection user authentication information. The connection user authentication information is information including a connection user ID and a password corresponding to the connection user ID.

The server connection information is information required to connect to the managed server 310 . For example, server connection information may include a host name and port number corresponding to managed server 310 . Also, for example, the server connection information may include an IP address and port number corresponding to the managed server 310 .

Registered location information is information indicating a location that has been applied for and registered by a user. For example, the registered position information may be information indicating the position where the user of the terminal 200 is scheduled to work using the privileged ID.

The distance threshold is a distance that is used as a threshold for determining whether the difference between the position of terminal 200 and the position for which use has been applied in advance is within a predetermined range.

FIG. 4 is a diagram showing an example of the managed server table 106. As shown in FIG. Specifically, FIG. 4 shows managed server IDs, host names, port numbers, connection user IDs, passwords (connection user passwords) corresponding to the connection user IDs, registered location information, and distance thresholds. shows a table that associates .

Furthermore, the ID management database 102 stores authentication information corresponding to the third ID. In the following description, a table that stores third IDs and passwords corresponding to the third IDs will be referred to as a work user table 107. FIG. Also, in the following description, the third ID is called a working user. Further, in the following description, the authentication information corresponding to the work user ID (third ID) is called work user authentication information.

A work user ID is a user ID corresponding to a user who uses the terminal 200 . The work user authentication information is information including a work user ID and a password corresponding to the work user ID.

FIG. 5 shows an example of the work user table 107. As shown in FIG. Specifically, FIG. 5 shows an example of a table in which work user IDs and passwords are associated with each other. For example, referring to FIG. 5, the password corresponding to the work user ID "suzuki" is "B7343a7cbdd302".

In the following description, for convenience of description, the ID management database 102 stores a user table, a usage application information table 105, and a managed server table 106. FIG. However, this does not mean that the ID management database 102 is limited to storing (holding) data in a table format.

The usage application management unit 103 authenticates the working user. Further, the usage application management unit 103 accepts usage application information and registers the accepted usage application information in the ID management database 102 . Specifically, the usage application management unit 103 stores usage application information including a managed server ID, a privilege ID, an authority to be applied for, a usage start time, and a usage end time. accept. Then, the usage application management unit 103 registers usage application information including the managed server ID, the privilege ID, the authority to be applied for, the usage start time, and the usage end time in the ID management database 102 .

The management server control unit 104 receives a login request of the working user from the ID management relay unit 201 . Upon receiving a login request from the ID management relay unit 201 , the management server control unit 104 sends a list of the managed servers 310 corresponding to the work user among the pre-registered managed servers 310 to the ID management relay unit 201 . respond. When the management server control unit 104 receives the managed server ID from the ID management relay unit 201, the management server control unit 104 refers to the usage application information table 105, and transfers the usage application information corresponding to the received managed server ID to the ID It responds to the management relay unit 201 .

The terminal 200 will be described in detail below.

Location information acquisition section 202 acquires terminal location information indicating the location of own terminal 200 . The positional information acquisition unit 202 is implemented using, for example, a GPS (Global Positioning System) function.

ID management relay section 201 transmits connected user authentication information corresponding to the connected user ID and terminal location information to control device 300 . Furthermore, ID management relay section 201 transmits the registered position information and the distance threshold to control device 300 . Specifically, ID management relay section 201 transmits registered location information and a distance threshold to control device 300 when applying for use. More specifically, the ID management relay unit 201 receives from the management server 100 connection user authentication information and usage application information corresponding to the managed server 310 to be connected. Then, ID management relay section 201 transmits connected user authentication information, usage application information, and terminal location information to control device 300 .

Furthermore, the terminal 200 acquires terminal location information at predetermined time intervals and transmits the terminal location information to the control device 300 . Specifically, after the control device 300 permits the terminal 200 to use the privileged ID of the managed server 310, the location information acquiring unit 202 acquires terminal location information at predetermined time intervals. After the control device 300 permits the terminal 200 to use the privileged ID of the managed server 310, the ID management relay unit 201 transmits the terminal location information to the control device 300 at predetermined time intervals.

The control device 300 will be described in detail below.

When the managed server 310 authenticates the connection user authentication information transmitted from the terminal 200, the ID usage management unit 301 uses the terminal location information and the time when the terminal location information is received to determine the privilege ID (the 1 ID) is permitted to the terminal 200 or not. In the following description, the time at which the ID usage management unit 301 receives the terminal location information is also referred to as usage determination time.

Specifically, when the managed server 310 authenticates the connection user authentication information transmitted from the terminal 200, the difference between the position of the terminal 200 and the position for which the use application has been made in advance is equal to or less than the distance threshold. Suppose it is the case. Further, it is assumed that the usage determination time is after the predetermined usage start time and before the predetermined usage end time. In that case, the ID use management unit 301 permits the terminal 200 to use the first ID. Here, the managed server 310 is assumed to be the managed server 310 to which the terminal 200 is connected. Furthermore, it is assumed that the usage start time and the usage end time are times registered in advance as usage application information.

Furthermore, it is assumed that the ID use management unit 301 receives the terminal location information from the terminal 200 after permitting the terminal 200 to use the privileged ID of the managed server 310 . In this case, the ID usage management unit 301 determines whether or not to allow the terminal 200 to use the privileged ID corresponding to the managed server 310 to be connected, based on the terminal location information and the usage determination time. .

Furthermore, after the ID usage management unit 301 permits the terminal 200 to use the privileged ID corresponding to the managed server 310 to be connected, at least one of the terminal location information and the usage determination time satisfies a predetermined condition. Suppose it is gone. In that case, the ID usage management unit 301 makes the privileged ID unusable from the terminal 200 .

Specifically, after permitting the terminal 200 to use the privileged ID corresponding to the managed server 310 to be connected, the ID use management unit 301 sets the position of the terminal 200 and the work place for which use has been applied in advance. Suppose that the distance exceeds the distance threshold applied for in advance. In that case, the ID usage management unit 301 makes the privileged ID unusable from the terminal 200 .

Also, suppose that the ID usage management unit 301 permits the terminal 200 to use the privileged ID corresponding to the managed server 310 to be connected, and then the usage determination time exceeds the usage application time for which the usage application was made in advance. In that case, the ID usage management unit 301 makes the privileged ID unusable from the terminal 200 .

Furthermore, it is assumed that the ID usage management unit 301 receives the terminal location information from the terminal 200 after disabling the privilege ID corresponding to the managed server 310 to be connected from the terminal 200 . In this case, it is assumed that the usage determination time is after the usage start time for which the usage application has been applied in advance and is before the usage end time for which the usage application has been applied in advance. In this case, the ID usage management unit 301 again permits the terminal 200 to use the privileged ID corresponding to the managed server 310 based on the received terminal location information. Specifically, when the received terminal location information satisfies a predetermined condition, the terminal 200 is permitted again.

Next, the operation of the management system 1 according to this embodiment will be described in detail.

First, referring to FIG. 6, the process of registering a working user will be described.

In step A1, the management server control unit 104 accepts input of a work user ID and password.

For example, an administrator or the like of the management server 100 uses an input device (keyboard or the like (not shown)) connected to the management server 100 to enter a work user ID and a password corresponding to the work user ID. may Alternatively, for example, the administrator or the like of the management server 100 may use an information processing device (computer) different from the management server 100 to input the work user ID and the password corresponding to the work user ID. . Then, an information processing device different from the management server 100 may transmit the input work user ID and the password corresponding to the work user ID to the management server 100 . In that case, the information processing device may transmit the work user ID and the password corresponding to the work user ID to the management server 100 via a network (for example, the Internet).

Hereinafter, similarly, the administrator of the management server 100 may input information using an input device (such as a keyboard (not shown)) connected to the management server 100. are omitted. Also, hereinafter, similarly, the administrator of the management server 100 may use an information processing device (computer) different from the management server 100 to input information, and detailed description thereof will be omitted. In that case, as described above, the information processing apparatus may transmit input information to the management server 100 via a network (for example, the Internet), and detailed description thereof will be omitted. .

In step A<b>2 , the management server control unit 104 registers the input work user ID and password in the work user table 107 .

Next, a process of registering server connection information and connection user authentication information will be described with reference to FIG.

In step A11, the management server control unit 104 inputs managed server information including server connection information, connected user authentication information, registered location information, and distance threshold for one or more managed servers 310. accept. Here, it is assumed that the input connection user authentication information is registered in advance in the managed server 310 .

In step A<b>12 , the management server control unit 104 registers the received managed server information in the managed server table 106 .

In step A<b>13 , the management server control unit 104 receives input of registered position information and a distance threshold for the managed server 310 corresponding to the managed server information registered in the ID management database 102 . In step A<b>14 , the management server control unit 104 registers the inputted registered position information and distance threshold in the managed server table 106 .

Next, the process of registering application information will be described with reference to FIG.

In step A21, the usage application management unit 103 receives usage application information regarding one or more managed servers 310. FIG. Specifically, the usage application management unit 103 includes, for one or more managed servers 310, a managed server ID, a privilege ID, an authority to be applied for, a usage start time, and a usage end time. , accepts usage application information.

In step A22, the usage application management unit 103 presents the received usage application information to the administrator of the management server 100 (that is, the person who approves the usage application). Specifically, the usage application management unit 103 includes, for one or more managed servers 310, a managed server ID, a privilege ID, an authority to be applied for, a usage start time, and a usage end time. , the usage application information is presented to the administrator of the management server 100 or the like.

For example, the usage application management unit 103 may output the accepted usage application information using a display device (such as a display (not shown)). Alternatively, the usage application management unit 103 transmits the accepted usage application information to an information processing device (for example, a PC (Personal Computer)) used by an administrator of the management server 100 or the like via a network (Internet or the like). may There are various methods for presenting the received usage application information to the administrator of the management server 100 (that is, the person who approves the usage application), but the details thereof are not limited.

The administrator or the like of the management server 100 confirms the presented usage application information. The administrator or the like of the management server 100 executes a predetermined approval operation when approving the usage application information. For example, the usage application management unit 103 may display an "Approve" button on the display screen. Then, when the administrator or the like of the management server 100 approves the usage application information, the approval operation may be executed by pressing the "Approve" button.

At step A23, the usage application management unit 103 receives an approval operation by the administrator of the management server 100 or the like regarding the usage application information that has been accepted. In step A<b>24 , the usage application management unit 103 registers the approved usage application information in the usage application information table 105 .

Next, operations of the management system 1 will be described with reference to FIG. In the following explanation, it is assumed that the management server 100 has already executed the processes shown in FIGS. 6 to 8. FIG. In other words, it is assumed that the management server 100 has already registered necessary information in the ID management database 102 . In other words, the management server 100 assumes that information has already been registered in the work user table 107, the managed server table 106, and the usage application information table 105, respectively.

In step S1, the terminal 200 requests authentication of the working user. Specifically, the ID management relay unit 201 transmits the work user ID and password to the management server 100 and requests authentication of the work user. Here, it is assumed that the terminal 200 is connectable to the management server 100 via a network (second network) different from the managed server network 400 .

In step S2, the management server 100 authenticates the working user. Specifically, the management server control unit 104 receives the work user ID and password from the terminal 200 . The management server control unit 104 then determines whether the received work user ID and password are registered in the work user table 107 .

If the received work user ID and password are not registered in the work user table 107, the management server control unit 104 does not authenticate the work user whose authentication is requested. In this case, the management server control unit 104 notifies the terminal 200 that requested authentication that the working user whose authentication has been requested will not be authenticated.

If the received work user ID and password are registered in the work user table 107, the management server control unit 104 authenticates the work user for whom authentication is requested. In the following description, the case where the management server control unit 104 authenticates the working user whose authentication is requested will be described.

In step S3, when the working user is authenticated, the management server 100 acquires a list of managed servers 310 corresponding to the working user. Specifically, the management server control unit 104 refers to the usage application information table 105 and acquires one or more managed server IDs corresponding to the authenticated working user as a list of managed servers 310 .

In step S<b>4 , the management server 100 transmits the acquired list of managed servers 310 to the terminal 200 . In step S<b>5 , the terminal 200 receives the list of managed servers 310 .

In step S<b>6 , the terminal 200 determines the managed server ID corresponding to the managed server 310 for which the use application is made, based on the user's operation. Specifically, the ID management relay unit 201 displays the received list of managed server IDs on the display screen of the terminal 200 . The user of the terminal 200 selects a managed server ID for use application from the displayed list of managed server IDs. Then, the ID management relay unit 201 determines the managed server ID selected by the user as the managed server ID corresponding to the managed server 310 for which the usage application is made.

In step S7, the terminal 200 transmits the determined managed server ID. In step S8, the management server 100 receives the managed server ID.

In step S<b>9 , the management server 100 transmits to the terminal 200 managed server information including server connection information, connected user authentication information, registered location information, and distance threshold, and usage application information. Specifically, the management server control unit 104 refers to the managed server table 106 and acquires managed server information corresponding to the received managed server ID. Here, the managed server information includes server connection information, connected user authentication information, registered location information, and a distance threshold. Further, the management server control unit 104 refers to the usage application information table 105 and acquires usage application information corresponding to the received managed server ID. The management server control unit 104 then transmits the acquired managed server information and usage application information to the terminal 200 .

In step S10, the terminal 200 receives managed server information and usage application information.

Here, the ID management relay unit 201 may display the server connection information among the received managed server information on the display screen of the terminal 200 . Further, ID management relay section 201 may display the received usage application information on the display screen of terminal 200 .

It is assumed that the management system 1 prohibits the user from directly logging into the managed server 310 using the connection user ID. In that case, it is preferable that the ID management relay unit 201 does not present the connected user authentication information in the received managed server information to the user.

In step S<b>11 , the terminal 200 connects to the managed server 310 using the server connection information included in the received managed server information. Then, the process proceeds to step S21 shown in FIG.

Next, the operation of the management system 1 will be described continuously with reference to FIG. 10 . In the following description, the terminal 200 is assumed to be connectable to the control device 300 and the managed server 310 via the managed server network 400 . That is, in the following description, the user operates the terminal 200 at a place where the managed server network 400 can be connected.

In step S<b>21 , the terminal 200 transmits the received managed server information, usage application information, and terminal location information to the control device 300 . Specifically, position information acquisition section 202 acquires terminal position information indicating the position of own terminal 200 . The ID management relay unit 201 then transmits the received managed server information, usage application information, and acquired terminal position information to the control device 300 .

In step S22, the control device 300 receives managed server information, usage application information, and terminal location information.

In step S23, the control device 300 transmits connection user authentication information to the managed server 310 for which the use application has been made, and requests user authentication. Specifically, the ID usage management unit 301 connects to the managed server 310 by using the server connection information included in the received managed server information. Then, the ID usage management unit 301 transmits connection user authentication information to the connected managed server 310 to request authentication of the connection user. Specifically, the ID usage management unit 301 transmits the connected user ID and password to the connected managed server 310, and requests authentication of the connected user.

In step S24, the managed server 310 uses the connected user authentication information to perform user authentication. For example, if the OS (Operating System) is Linux (registered trademark), the managed server 310 may perform user authentication using ssh. Further, for example, when the OS is Windows (registered trademark), the managed server 310 may use PowerShell to perform user authentication. Of course, the managed server 310 may perform user authentication using a method suitable for the operating environment. The managed server 310 then responds to the control device 300 with the authentication result of the connecting user (step S25).

In step S26, the control device 300 determines whether or not the connecting user has been successfully authenticated. If the connecting user is successfully authenticated (Yes branch of step S26), the process proceeds to step S101 shown in FIG. If authentication of the connecting user fails (No branch in step S26), the ID usage management unit 301 transmits a usage application failure notification to the terminal 200 (step S27). Then, the terminal 200 receives the notification that the usage application has failed (step S28).

Next, the operation of the control device 300 will be described continuously with reference to FIG. 11 .

In step S101, the ID usage management unit 301 determines whether or not the difference between the location of the terminal 200 and the location for which usage has been applied in advance is equal to or less than a predetermined distance threshold. Specifically, ID usage management unit 301 compares the terminal location information with the registered location information included in the usage application information. Then, the ID usage management unit 301 determines that the difference between the terminal location information and the registered location information included in the usage application information (for example, the location where the user of the terminal 200 is scheduled to work) is equal to or less than the distance threshold included in the usage application information. The ID usage management unit 301 determines whether or not.

If the difference between the position of the terminal 200 and the position for which the application for use has been made in advance exceeds a predetermined distance threshold (No branch in step S101), the process transitions to step S103. In step S103, the ID use management unit 301 determines that use of the applied privileged ID is not permitted on the managed server 310 to which the use of the privileged ID has been applied. Then, the process transitions to step S106.

On the other hand, if the difference between the position of the terminal 200 and the position for which the application for use has been made in advance is equal to or less than the predetermined distance threshold (Yes branch in step S101), the process transitions to step S102.

In step S102, the ID usage management unit 301 determines whether or not the time when the terminal location information is received is between the usage start time and the usage end time included in the usage application information. That is, the ID usage management unit 301 determines whether or not the usage determination time is after the predetermined usage start time and before the predetermined usage end time.

If the time when the terminal location information is received is not the time between the usage start time and the usage end time included in the usage application information (No branch of step S102), the process proceeds to step S103. In step S103, the ID use management unit 301 determines that use of the applied privileged ID is not permitted on the managed server 310 to which the use of the privileged ID has been applied. Then, the process transitions to step S106.

On the other hand, if the time at which the terminal location information is received is between the usage start time and the usage end time included in the usage application information (Yes branch of step S102), the process transitions to step S104. In step S104, the ID use management unit 301 permits the terminal 200 to use the applied privileged ID on the managed server 310 to which the use application has been applied.

In step S<b>105 , the ID usage management unit 301 sets the requested authority for the requested privilege ID on the managed server 310 . Here, the ID usage management unit 301 may set a password for the privileged ID for which usage is permitted. For example, the ID usage management unit 301 may create a random password as the password corresponding to the privileged ID.

In step S<b>106 , the ID usage management unit 301 transmits to the terminal 200 information about whether or not the privileged ID can be used. Specifically, the ID usage management unit 301 transmits to the terminal 200 information regarding whether or not the privileged ID can be used. Furthermore, when a password is set for a privileged ID whose use is permitted, the ID usage management unit 301 notifies the terminal 200 of the set password.

When the terminal 200 receives the information regarding the availability of the privileged ID, the ID management relay unit 201 displays the information regarding the availability of the privileged ID on the display screen of the terminal 200 . Furthermore, when terminal 200 receives a password corresponding to a privileged ID, ID management relay unit 201 displays the received password on the display screen of terminal 200 . In that case, the user of the terminal 200 uses the displayed password to log in to the managed server 310 and perform work on the managed server 310 .

Next, referring to FIG. 12, processing after the control device 300 permits the terminal 200 to use the privileged ID of the managed server 310 will be described.

In step S201, ID usage management section 301 determines whether or not terminal location information has been received from terminal 200 at predetermined time intervals. Specifically, regarding the privileged ID of the managed server 310, the ID usage management unit 301 determines whether or not the terminal location information has been received at predetermined time intervals from the terminal 200 whose usage is permitted.

When the ID usage management unit 301 receives the terminal location information from the terminal 200 (Yes branch of step S201), the process transitions to step S202. On the other hand, when the ID usage management unit 301 has not received the terminal location information from the terminal 200 (No branch of step S201), the process transitions to step S203.

In step S202, the ID usage management unit 301 determines whether or not the difference between the location of the terminal 200 and the location for which usage has been applied in advance is equal to or less than a predetermined distance threshold. That is, the same processing as step S101 shown in FIG. 11 is performed.

If the difference between the position of the terminal 200 and the position for which the application for use has been made in advance exceeds a predetermined distance threshold (No branch in step S202), the process transitions to step S203. In step S<b>203 , the ID usage management unit 301 disables the privileged ID for which usage is requested on the managed server 310 . Then, the process transitions to step S207.

On the other hand, if the difference between the position of the terminal 200 and the position for which the application for use has been made in advance is equal to or less than the predetermined distance threshold (Yes branch in step S202), the process transitions to step S204.

In step S<b>204 , the ID usage management unit 301 determines whether or not the authority to be applied for is set for the privileged ID for which usage is applied for on the managed server 310 . If the authority to be applied for is set for the privilege ID for which the use application was made on the managed server 310 (Yes branch of step S204), the process transitions to step S208.

On the other hand, if the authority to be applied for is not set for the privilege ID for which the usage application is applied on the managed server 310 (No branch of step S204), the process transitions to step S205. In step S205, the ID usage management unit 301 makes available the privileged ID for which usage has been applied for on the managed server 310 for which usage has been applied for the privileged ID. In other words, the ID usage management unit 301 disables the use of the privileged ID for which a usage application has been applied from the terminal 200, and if the terminal location information and the usage determination time satisfy a predetermined condition, the usage of the privileged ID is The terminal 200 is permitted.

In step S<b>206 , the ID usage management unit 301 sets the authority to be applied for the privileged ID for which usage has been applied for on the managed server 310 .

In step S207, the ID usage management unit 301 transmits to the terminal whether or not the privileged ID can be used.

In step S208, the ID usage management unit 301 determines whether or not the current time has passed the usage end time. If the current time does not exceed the usage end time (No branch in step S208), the process returns to step S201 to continue the process. On the other hand, if the current time exceeds the usage end time (Yes branch of step S208), the ID usage management unit 301 disables the privileged ID applied for on the managed server 310 (step S209). . Then, the ID usage management unit 301 notifies the terminal 200 that the privileged ID that has been applied for cannot be used.

As described above, in the management system 1 according to this embodiment, the control device 300 uses the privilege ID of the managed server 310 from an external device (that is, the terminal 200) different from the managed device 1010. Allow Furthermore, in the management system 1 according to the present embodiment, the control device 300 determines whether or not the terminal 200 is permitted to use the privileged ID in the managed server 310 based on the location and time of the terminal 200. . Specifically, in the management system 1 according to the present embodiment, when the worker (the user of the terminal 200) is at the pre-requested position within the pre-requested time, the control device 300 controls the management The privileged ID of the target server 310 is made available. As a result, the management system 1 according to this embodiment contributes to reducing the security risk of the managed server 310 while improving user convenience.

In addition, in the management system 1 according to the present embodiment, if the control device 300 does not receive the terminal location information at predetermined time intervals after permitting the use of the privileged ID, the privileged ID of the managed server 310 is used. Disable. For example, assume that the user of the terminal 200 ends the use of the privileged ID and powers off the terminal 200 . When terminal 200 is powered off, control device 300 cannot receive terminal location information at predetermined time intervals. In that case, the control device 300 disables the privileged ID of the managed server 310 . In other words, the management system 1 according to this embodiment disables the use of the privileged ID when the user does not actually use the privileged ID. Therefore, the management system 1 according to this embodiment contributes to protecting the managed server 310 appropriately according to the situation while improving user convenience.

Further, in the management system 1 according to this embodiment, the control device 300 and the managed server 310 are arranged within a LAN (managed server network 400). Furthermore, in the management system 1 according to this embodiment, the terminal 200 connects to the management server 100 via a network different from the managed server network 400 . Therefore, the management system 1 according to this embodiment can manage privilege IDs for the managed servers 310 existing within the LAN. As a result, the management system 1 according to this embodiment contributes to reducing security risks while improving user convenience with respect to the managed servers 310 existing within the LAN.

In the above description, a mode has been described in which the management server 100 transmits the managed server IDs corresponding to the authenticated work users to the terminal 200 as a list of the managed servers 310 . Here, the management server 100 may, of course, associate the registered position information, the distance threshold value, etc. with the managed server IDs and transmit them as a list of the managed servers 310 . The list of managed servers 310 transmitted from the management server 100 to the terminal 200 may be of any detail as long as it is information that can be used when the user selects the managed servers 310 that are the target of usage application.

In addition, the terminal 200 may transmit the terminal location information to the management server 100 together with the work user authentication request. When the management server 100 authenticates the working user, the management server 100 refers to the managed server table 106 and identifies the managed server 310 for which the difference between the terminal location information and the registered location information is within a predetermined range. good. The management server 100 may then transmit the managed server IDs of the identified managed servers 310 to the terminal 200 as a list of the managed servers 310 .

Also, a QR (Quick Response) code (registered trademark) including the managed server ID may be attached to the managed server 310 . Furthermore, in Modification 1, the terminal 200 is assumed to have a camera (not shown). In this case, the terminal 200 captures the QR code pasted on the managed server 310 using the camera, and reads the information stored in the QR code (that is, information including the managed server ID). The terminal 200 transmits the read information to the management server 100 . The management server 100 refers to the managed server table 106 and acquires managed server information based on the received managed server ID. Further, the management server 100 refers to the usage application information table 105 and acquires usage application information based on the received managed server ID. The management server 100 may then transmit the acquired managed server information and usage application information to the terminal 200 .

Also, in the above description, the form in which the control device 300 controls whether or not the privileged ID of the information processing device (managed server 310) can be used has been described. However, this does not mean that the control target of the control device 300 is limited to the managed server 310 . A managed device may be a network device. In that case, the control device 300 may connect to a network device (that is, a device to be managed) and control whether or not the privileged ID can be used in the network device.

Also, for example, the control device 300 may control a system including two or more information processing devices. Specifically, the control device 300 may connect to the system and control whether or not privileged IDs can be used in the system. A device to be controlled by the control device 300 may be any device to which a privilege ID is set, regardless of its type.
The present invention is also described in the following additional remarks.
(Appendix 1)
a managed device operable using a first ID having predetermined authority;
a control device that controls the managed device;
a terminal that acquires terminal location information indicating the location of the terminal and transmits the terminal location information to the control device;
including
The control device requests authentication of the terminal to the managed device, and if the managed device authenticates the terminal, the control device determines the first A management system comprising an ID usage management unit that determines whether or not to allow the terminal to use an ID.
(Appendix 2)
the terminal acquires the terminal location information at predetermined time intervals and transmits the terminal location information to the control device;
When the terminal location information is received from the terminal after the managed device has authenticated the terminal, the ID usage management unit determines the connection target device based on the terminal location information and the usage determination time. The management system according to appendix 1, wherein the management system determines whether or not the terminal is permitted to use the first ID corresponding to the managed device.
(Appendix 3)
The terminal transmits registered location information and a distance threshold to the control device,
The ID usage management unit, when the device to be managed authenticates the terminal and when a difference between the terminal location information and the registered location information is equal to or less than the distance threshold, determines the usage. 3. The management system according to appendix 1 or 2, wherein the terminal is permitted to use the first ID when the time is after a predetermined use start time and before a predetermined use end time.
(Appendix 4)
The ID usage management unit receives the terminal location information from the terminal after disabling the use of the first ID corresponding to the managed device to be connected from the terminal, and determines that the usage determination time is: After the usage start time and before the usage end time, the terminal is again permitted to use the first ID corresponding to the managed device based on the terminal location information. 3. The management system according to 3.
(Appendix 5)
the managed device is connectable using a second ID different from the first ID;
The terminal transmits authentication information corresponding to the second ID and the terminal location information to the control device,
When the ID usage management unit receives the authentication information, it requests the managed device to authenticate the authentication information, and when the managed device authenticates the authentication information transmitted from the terminal, the 5. The method according to any one of appendices 1 to 4, wherein it is determined whether or not the terminal is permitted to use the first ID based on the terminal location information and the usage determination time at which the terminal location information is received. Management system as described.
(Appendix 6)
controlling a managed device that can be operated using a first ID having predetermined authority;
When the managed device is requested to authenticate the terminal and the managed device authenticates the terminal, the first ID is used based on the terminal location information indicating the location of the terminal and the usage determination time. , the control device comprising an ID usage management unit that determines whether or not to permit the terminal to use the ID.
(Appendix 7)
a step of acquiring terminal location information indicating the location of the terminal;
a step of requesting authentication of the terminal to a managed device that can be operated using a first ID having predetermined authority;
determining whether or not to allow the terminal to use the first ID based on the terminal location information and a usage determination time when the terminal is authenticated;
A management method executed by a computer controlling a controller, comprising:
(Appendix 8)
a process of receiving terminal location information indicating the location of the terminal from the terminal;
a process of requesting terminal authentication from a managed device that can be operated using a first ID having predetermined authority;
a process of determining whether or not to allow the terminal to use the first ID based on the terminal location information and a use determination time when the terminal is authenticated;
A program that causes the computer that controls the control device to execute
The present invention is also described in the following forms.
(Form 1)
a managed device operable using a first ID having predetermined authority;
a control device that controls the managed device;
a terminal that transmits terminal location information indicating the location of the terminal to the control device;
including
The control device requests the managed device to authenticate a second ID for using the first ID, and if the managed device authenticates the second ID, the terminal A management system that determines whether or not to allow the terminal to use the first ID based on a first time at which terminal location information is received.
(Form 2)
a managed device operable using a first ID having predetermined authority;
a control device that controls the managed device;
a terminal that transmits terminal location information indicating the location of the terminal to the control device;
including
The control device requests the managed device to authenticate a second ID for using the first ID, and if the managed device authenticates the second ID, the terminal A management system that determines whether or not to allow the terminal to use the first ID based on the terminal location information received at a first time.
(Mode 3)
After permitting the use of the first ID to the terminal, if the terminal location information is not received from the terminal at a first time interval, the control device permits the use of the first ID. disable,
The management system according to form 1 or 2.
(Mode 4)
The control device stores a start time and an end time that are a time range in which use of the first ID is permitted,
If the first time is outside the range between the start time and the end time of the previous term, determining that the first ID is not to be used;
A management system according to any one of aspects 1-3.
(Mode 5)
When the current time exceeds the end time after permitting the use of the first ID to the terminal, the control device disables the use of the first ID that is permitted to be used.
The management system according to form 4.
(Mode 6)
controlling an operable managed device using a first ID having predetermined authority;
receiving terminal location information indicating the location of the terminal from the terminal;
requesting the managed device to authenticate a second ID for using the first ID, and receiving terminal location information from the terminal when the managed device authenticates the second ID; a control device that determines whether or not to permit the terminal to use the first ID, based on the obtained first time.
(Mode 7)
controlling an operable managed device using a first ID having predetermined authority;
receiving terminal location information indicating the location of the terminal from the terminal;
When the managed device is requested to authenticate a second ID for using the first ID, and the managed device authenticates the second ID, the terminal sends a request to the managed device at a first time. A control device that determines whether or not to allow the terminal to use the first ID based on the received terminal location information.
(Form 8)
After permitting the use of the first ID to the terminal, if the terminal location information is not received from the terminal at a first time interval, the control device permits the use of the first ID. disable,
8. A control device according to mode 6 or 7.
(Mode 9)
storing a start time and an end time that are a time range in which use of the first ID is permitted;
If the first time is outside the range between the start time and the end time of the previous term, determining that the first ID is not to be used;
A control device according to any one of aspects 6-8.
(Form 10)
When the current time exceeds the end time after permitting the use of the first ID to the terminal, the control device disables the use of the first ID that is permitted to be used.
The control device according to form 9.
(Form 11)
a step of receiving terminal location information indicating the location of the terminal from the terminal;
a step of requesting authentication of a second ID for using the first ID from a managed device that can be operated using the first ID having predetermined authority;
determining whether to allow the terminal to use the first ID based on a first time when the terminal location information is received from the terminal when the second ID is authenticated; ,
A management method executed by a computer controlling a controller, comprising:
(Form 12)
a step of receiving terminal location information indicating the location of the terminal from the terminal;
a step of requesting authentication of a second ID for using the first ID from a managed device that can be operated using the first ID having predetermined authority;
determining whether to permit the terminal to use the first ID based on terminal location information received from the terminal at a first time when the second ID is authenticated; ,
A management method executed by a computer controlling a controller, comprising:
(Form 13)
Disabling the use of the first ID for which use is permitted when terminal location information is not received from the terminal at a first time interval after the use of the first ID is permitted for the terminal. ,
The management method according to form 11 or 12, comprising:
(Form 14)
determining that the use of the first ID is not permitted when the first time is outside the range of the start time and the end time, which are the time range in which the use of the first ID is permitted;
The management method according to any one of aspects 11 to 13, comprising
(Form 15)
disabling the use of the first ID for which use is permitted when the current time exceeds the end time after the terminal is permitted to use the first ID;
The management method according to form 14, comprising:
(Form 16)
a process of receiving terminal location information indicating the location of the terminal from the terminal;
a process of requesting authentication of a second ID for using the first ID from a managed device that can be operated using the first ID having predetermined authority;
a process of determining whether or not to allow the terminal to use the first ID based on a first time when the terminal location information is received from the terminal when the second ID is authenticated; ,
A program that causes the computer that controls the control device to execute
(Form 17)
a process of receiving terminal location information indicating the location of the terminal from the terminal;
a process of requesting authentication of a second ID for using the first ID from a managed device that can be operated using the first ID having predetermined authority;
a process of determining whether or not to allow the terminal to use the first ID based on the terminal location information received from the terminal at a first time when the second ID is authenticated; ,
A program that causes the computer that controls the control device to execute

It should be noted that the disclosure of the above-mentioned patent document is incorporated herein by reference. Within the framework of the full disclosure of the present invention (including the scope of claims), modifications and adjustments of the embodiments are possible based on the basic technical concept thereof. Also, various combinations or selections of various disclosure elements (including each element of each claim, each element of each embodiment, each element of each drawing, etc.) are possible within the framework of the full disclosure of the present invention. be. That is, the present invention naturally includes various variations and modifications that can be made by those skilled in the art according to the entire disclosure including claims and technical ideas. In particular, any numerical range recited herein should be construed as specifically recited for any numerical value or subrange within that range, even if not otherwise stated. When the present invention presents algorithms, software, or flow charts or automated process steps, it is obvious that computers are used, and that computers are associated with processors and memory or storage devices. be. Therefore, even in the absence of explicit indication, it is to be understood that these elements are described herein.

1, 1000 Management system 100 Management server 101 Management server storage unit 102 ID management database 103 Usage application management unit 104 Management server control unit 105 Usage application information table 106 Managed server table 107 Work user table 200, 1030 Terminal 201 ID management relay unit 202 Location information acquisition units 300, 1020 Control devices 301, 1021 ID usage management units 310, 310a, 310b Managed server 400 Managed server network 1010 Managed device

Claims (17)

a managed device operable using a first ID having predetermined authority;
a control device that controls the managed device;
a terminal that transmits terminal location information indicating the location of the terminal to the control device;
including
The control device requests the managed device to authenticate a second ID for using the first ID, and if the managed device authenticates the second ID, the terminal A management system that determines whether or not to allow the terminal to use the first ID based on a first time at which terminal location information is received. a managed device operable using a first ID having predetermined authority;
a control device that controls the managed device;
a terminal that transmits terminal location information indicating the location of the terminal to the control device;
including
The control device requests the managed device to authenticate a second ID for using the first ID, and if the managed device authenticates the second ID, the terminal A management system that determines whether or not to allow the terminal to use the first ID based on the terminal location information received at a first time. After permitting the use of the first ID to the terminal, if the terminal location information is not received from the terminal at a first time interval, the control device permits the use of the first ID. disable,
3. Management system according to claim 1 or 2. The control device stores a start time and an end time that are a time range in which use of the first ID is permitted,
If the first time is outside the range between the start time and the end time of the previous term, determining that the first ID is not to be used;
The management system according to any one of claims 1-3. When the current time exceeds the end time after permitting the use of the first ID to the terminal, the control device disables the use of the first ID that is permitted to be used.
5. Management system according to claim 4. controlling an operable managed device using a first ID having predetermined authority;
receiving terminal location information indicating the location of the terminal from the terminal;
requesting the managed device to authenticate a second ID for using the first ID, and receiving terminal location information from the terminal when the managed device authenticates the second ID; a control device that determines whether or not to permit the terminal to use the first ID, based on the obtained first time. controlling an operable managed device using a first ID having predetermined authority;
receiving terminal location information indicating the location of the terminal from the terminal;
When the managed device is requested to authenticate a second ID for using the first ID, and the managed device authenticates the second ID, the terminal sends a request to the managed device at a first time. A control device that determines whether or not to allow the terminal to use the first ID based on the received terminal location information. After permitting the use of the first ID to the terminal, if the terminal location information is not received from the terminal at a first time interval, the control device permits the use of the first ID. disable,
A control device according to claim 6 or 7. storing a start time and an end time that are a time range in which use of the first ID is permitted;
If the first time is outside the range between the start time and the end time of the previous term, determining that the first ID is not to be used;
The control device according to any one of claims 6-8. When the current time exceeds the end time after permitting the use of the first ID to the terminal, the control device disables the use of the first ID that is permitted to be used.
A control device according to claim 9 . a step of receiving terminal location information indicating the location of the terminal from the terminal;
a step of requesting authentication of a second ID for using the first ID from a managed device that can be operated using the first ID having predetermined authority;
determining whether to allow the terminal to use the first ID based on a first time when the terminal location information is received from the terminal when the second ID is authenticated; ,
A management method executed by a computer controlling a controller, comprising: a step of receiving terminal location information indicating the location of the terminal from the terminal;
a step of requesting authentication of a second ID for using the first ID from a managed device that can be operated using the first ID having predetermined authority;
determining whether to permit the terminal to use the first ID based on terminal location information received from the terminal at a first time when the second ID is authenticated; ,
A management method executed by a computer controlling a controller, comprising: Disabling the use of the first ID for which use is permitted when terminal location information is not received from the terminal at a first time interval after the use of the first ID is permitted for the terminal. ,
The management method according to claim 11 or 12, comprising: determining that the use of the first ID is not permitted when the first time is outside the range of the start time and the end time, which are the time range in which the use of the first ID is permitted;
The management method according to any one of claims 11 to 13, comprising. disabling the use of the first ID for which use is permitted when the current time exceeds the end time after the terminal is permitted to use the first ID;
15. The management method of claim 14, comprising: a process of receiving terminal location information indicating the location of the terminal from the terminal;
a process of requesting authentication of a second ID for using the first ID from a managed device that can be operated using the first ID having predetermined authority;
a process of determining whether or not to allow the terminal to use the first ID based on a first time when the terminal location information is received from the terminal when the second ID is authenticated; ,
A program that causes the computer that controls the control device to execute a process of receiving terminal location information indicating the location of the terminal from the terminal;
a process of requesting authentication of a second ID for using the first ID from a managed device that can be operated using the first ID having predetermined authority;
a process of determining whether or not to allow the terminal to use the first ID based on the terminal location information received from the terminal at a first time when the second ID is authenticated; ,
A program that causes the computer that controls the control device to execute

Images