JP7546797B2 - Privilege Management System - Google Patents

Description

The present invention relates to a rights management system, in particular to centralized management of user rights in multiple systems.

In large companies, for example, business systems may be created for each task, such as report creation, equipment information, or work management, and corporate systems may be constructed so that the desired business system can be used from multiple branch offices.

Employees and others (hereinafter referred to as "users") belonging to any of the branch offices log in to the business system they use in their work from a terminal such as a PC installed at the branch office and use the functions provided by the business system within the scope of the authority granted to them.

In this way, when operating a system by setting access rights for each user, i.e., the right to use each function provided by the business system, when introducing the system, it is necessary to set access rights for each function for all users in each business system.

JP 2020-052759 A JP 2014-182708 A JP 2010-170208 A JP 2015-087930 A JP 2019-087019 A JP 2021-022201 A

However, the larger the overall system size, for example the greater the number of business systems or users, the greater the load required to set access permissions. In addition, changing the access permission settings after the system is installed also requires a large workload.

The present invention aims to make it easy to manage the authority information of each user in each business system when multiple business systems are used by users from multiple branch offices.

The authority management system of the present invention has an authority information providing means for responding to an inquiry regarding authority settings for a user from a business system shared by multiple users belonging to one of the branches, by returning the personal authority information as the access authority to be set for the user if personal authority information specific to the user has been set in the business system, and by returning default information regarding the access authority that is preset for each branch as the access authority to be set for the user if the personal authority information has not been set for the user, and is characterized in that the personal authority information is stored and managed with information regarding authority settings separately for the branch to which the user belongs and other branches .

According to the present invention, when multiple business systems are used by users from multiple branch offices, it is possible to easily manage the authority information of each user in each business system.

1 is a schematic overall configuration diagram of an enterprise system according to an embodiment of the present invention; 1 is a block diagram showing a configuration of an authority management system according to an embodiment of the present invention; 11 is a diagram showing an example of a data configuration of default information in the present embodiment. FIG. 11 is a diagram showing an example of a data structure of personal authority information in the present embodiment. FIG. 10 is a flowchart showing a user authority setting process according to the present embodiment.

Below, a preferred embodiment of the present invention is described based on the drawings.

Figure 1 is a schematic diagram of the overall configuration of an enterprise system in this embodiment. Figure 1 shows multiple branch office servers 1, multiple business systems 2, and a rights management system 3. The branch office servers 1 and the business systems 2, and the business systems 2 and the rights management system 3 can communicate with each other via a network not shown.

The branch office server 1 is a server computer provided for each branch office of a company. In FIG. 1, the servers are abstracted as "branch office server 1," "branch office server 2," and "branch office server 3," but the branch office server 1 is provided at each base in each region, for example, Hokkaido, Tohoku, Tokyo, Yokohama, etc. A company has branches at multiple bases as well as a head office, but in this embodiment, the servers provided at the head office, branches, and even cooperating companies are collectively referred to as "branch office servers." In addition, an in-house system including the branch office server 1 is constructed in each branch office, and in addition to the branch office server 1, each in-house system includes information processing devices such as PCs and network devices used by users of the branch office, but FIG. 1 only illustrates the branch office server 1.

Business system 2 is a computer system provided for each business carried out by a company. In Figure 1, business systems are illustrated abstractly as "Business System A," "Business System B," and "Business System C," but business system 2 is provided for each business, such as report creation, facility information, and work management.

When a user belonging to one of the branch offices performs work, the user logs into the corresponding business system 2 and uses functions provided by the business system 2 to which the user has logged in. In this embodiment, the user cannot use all functions provided by the business system 2 without any restrictions; even if the user is able to log in, the functions that can be used are limited by the permission information that has been set. In this embodiment, "accessible" or "access permitted" to a function is synonymous with being able to use the function, whereas "inaccessible" or "access not permitted" to a function is synonymous with not being able to use the function.

The rights management system 3 is a system that collectively manages the access rights of each user to each business system 2. The hardware configuration of the rights management system 3 in this embodiment can be realized by a general-purpose server computer. That is, the rights management system 3 is configured by connecting a CPU, ROM, RAM, a hard disk drive as a storage means, and a network interface provided as a communication means to an internal bus. In addition, in this embodiment, a user interface including input means such as a mouse and keyboard and display means such as a display is provided for setting access rights.

Figure 2 is a block diagram showing the authority management system 3 in this embodiment. The authority management system 3 in this embodiment has an authority information setting unit 31, an information management unit 32, a user authority information providing unit 33, and a memory unit 34. Note that components not used in the explanation of this embodiment are omitted from the figure.

The authority information setting unit 31 sets default information and personal authority information stored in the memory unit 34 in response to setting operations by the administrator. The information management unit 32 manages information such as addition, update, and deletion of various information stored in the memory unit 34 in response to setting operations by the administrator. The user authority information providing unit 33, in response to an inquiry about authority settings for a user from any business system 2, responds with personal authority information if the user's personal authority information is set, or with default information if the user's personal authority information is not set, thereby providing the access authority to be set for the user to the business system 2 that originated the inquiry.

The memory unit 34 stores default information, personal authority information, business system management information and user master information.

Figure 3 is a diagram showing an example of the data configuration of default information in this embodiment. In the default information, authority information as an initial value is classified and set for each business system 2. Since the business system 2 in this embodiment provides one or more functions to the user, the "authority information" is setting information regarding whether the user can access the business system 2 or each function provided by the business system 2. In this embodiment, the authority information is set for each function. In the default information, the authority information is set for each branch to which the user belongs. In other words, the access authority to be set for each user is specified by identifying the branch to which each user belongs. In Figure 3, whether access is possible or not is indicated by the symbols "○" and "×".

Incidentally, the access rights to be set for a user are specified by the rights information set in the personal rights information or default information. Therefore, in this embodiment, "access rights" and "rights information" are used as similar terms.

In this embodiment, as shown in FIG. 3, one of the functions is "Launch TOP screen", which is a function that launches the top screen that is first provided to a logged-in user when the business system 2 performs business. The other functions are set up so that they are launched when a specific button or the like displayed on the top screen is selected. Therefore, if access to the "Launch TOP screen" function is not possible, other functions in the business system 2 will also not be accessible. In this way, functions that cannot be accessed because access to the "Launch TOP screen" function is not possible are shown in FIG. 3 associated with a "-".

For example, suppose there is a business system 2 called a report creation system. In addition to the "TOP screen launch" function, the report creation system provides a maintenance information registration function, a repair information registration function, a report download function, etc. For each such function, default information is set as to whether branch office users can access the function ("○") or cannot access the function ("×" or "-").

Figure 4 is a diagram showing an example of the data configuration of personal authority information in this embodiment. The default information is information shared by all users, and there is only one in the entire enterprise system. In contrast, the personal authority information is set for users who are not granted access authority according to the settings in the default information. The personal authority information is configured by associating a man number with the authority information set for that individual. Figure 4 shows an example of personal authority information for user A identified from man number "ABC1234", but the personal authority information can be set for each individual as necessary by the authority management system 3 or the administrator of the branch office to which the user belongs (hereinafter also referred to as "own branch office").

As is clear when compared with the data structure of the default information, in the personal authority information, authority information indicating whether or not a user can access is set for each business system and function, and further for each branch, as in the default information. Normally, the access authority set in the default information for a certain user is set for the branch. In addition, the function cannot be used to access information about branches other than the user's own branch. However, there are exceptional cases where it is desired to allow access to information other than the branch using the function. It is also possible to imagine cases where access is not allowed even for the branch. In FIG. 4, as described above, the personal authority information of user A belonging to branch B is illustrated, but as is clear when compared with the default information, the personal authority information is set so that user A cannot access function 3 provided by business system B, but can also access information about branch D when using a function provided by business system C.

Personal authority information is information related to the authority settings set for individual users, and is managed separately as user authority information and user's own branch authority information, as shown in Figure 2. User authority information includes the personal authority information set for each user described above, excluding information corresponding to user's own branch authority information. On the other hand, information related to the own branch from the personal authority information (authority information corresponding to branch B for user A) is selected and set as user's own branch authority information.

Suppose user A is transferred to branch C. In this case, for user A, his/her own branch becomes branch C, and branch B is no longer his/her own branch. Since personal authority information is usually set when the user belongs to branch B, it is not necessarily desirable to inherit the settings as they are, and it is considered preferable to invalidate them upon the transfer. However, unlike the settings for branches other than his/her own branch, there are cases where the user wishes to inherit the settings for his/her own branch as they are. Therefore, in this embodiment, assuming such a case, the information about his/her own branch among the personal authority information is stored and managed separately from the information about branches other than his/her own branch. In other words, the settings for branch B, which was his/her own branch, are applied to branch C, which has become his/her own branch.

For example, when personal authority information is to be set again for user A after the user A is transferred, the authority information setting unit 31, in response to an instruction from the administrator, simply reflects the setting contents of the information for branch B stored in the user's own branch authority information to branch C, without having to set the information for the own branch again. Since branch B is a branch other than the own branch, the setting will be changed to inaccessible just like branches other than the own branch (branch A, etc.) unless otherwise set by the administrator.

The business system management information is information for managing the business systems 2 included in the enterprise system in this embodiment. The business system management information is generated by associating the identification information of each business system 2 with information regarding the functions provided by the business system 2.

User master information includes information about users of the corporate system. User master information is generated by associating a man number, which serves as identification information that individually identifies each user, with authentication information including a user ID and password, and information such as affiliation and job title that indicates the user's position within the company. Some companies manage personnel information separately in a personnel information management server, etc., but in this embodiment, this personnel information is copied and stored in the authority management system 3 as user master information. The user master information needs to be updated with the latest information each time the personnel information is updated. However, it is also possible not to store the user master information internally, and to have the personnel information management server refer to the latest personnel information each time it is needed.

Each of the components 31 to 33 in the rights management system 3 is realized by the cooperative operation of the computer that forms the rights management system 3 and a program that runs on a CPU mounted on the computer. The storage unit 34 is realized by a HDD mounted on the rights management system 3. Alternatively, RAM or an external storage means may be used via a network.

The programs used in this embodiment can be provided not only by communication means, but also by storing them on a computer-readable recording medium such as a CD-ROM or USB memory. The programs provided from the communication means or recording medium are installed on a computer, and the various processes are realized by the computer's CPU sequentially executing the programs.

Next, we will explain the operation of this embodiment.

As mentioned above, before starting operation of the enterprise system, the administrator must set default information and personal authority information for necessary users in the authority management system 3. Here, the explanation will continue assuming that this has already been set. In this embodiment, the authority management system 3 collectively manages the access authority of each user, and the business system 2 cannot identify the access authority of each user independently. Therefore, when a user starts using the business system 2, the business system 2 that is being used queries the authority management system 3 to obtain what access authority has been set for that user, and allows the user to use functions within the obtained range. Below, the setting of access authority for a user in this embodiment will be explained using the flowchart shown in FIG. 5.

A user logs in to the business system 2 corresponding to the business they wish to perform, for example from a PC in a branch office, by specifying authentication information. Note that, for the purposes of this explanation, authentication is performed using an existing method, and the explanation will continue assuming that the user has been successfully authenticated. The business system 2 specifies the login ID (same as the "user ID") included in the authentication information and makes an inquiry to the authority management system 3 regarding the authority settings for the user.

The user authority information providing unit 33 in the authority management system 3 receives an inquiry from the business system 2 (step 110). Next, the user authority information providing unit 33 obtains the man number and the position of the user (branch and job) by searching the user master information based on the user ID specified in the inquiry (step 120). Then, since the man number is linked to the personal authority information, the user authority information providing unit 33 checks whether the personal authority information linked to the obtained man number has been set.

Here, if personal authority information associated with the user has been set (Y in step 130), the user authority information providing unit 33 acquires the personal authority information (step 140) and responds as the access authority to be set for the user (step 150).

On the other hand, if personal authority information associated with the user has not been set (Y in step 130), the user authority information providing unit 33 obtains the authority information of the branch office to which the user belongs, which is set in the default information (step 160), and responds with this as the access authority to be set for the user (step 150).

In addition, the information sent back to the business system 2 may be limited to the authority information corresponding to the business system 2 that originated the inquiry.

The business system 2 controls access to the logged-in user according to the authority information returned from the authority management system 3. In other words, the business system 2 determines the functions available to the user according to the authority information.

According to this embodiment, as described above, each business system 2 obtains the access authority for the logged-in user by inquiring of the user authority information providing unit 33. In this embodiment, the authority management system 3 is provided to centrally manage the authority information of users to be handled by each business system 2, so that the authority information of each user in each business system 2 can be easily managed. In addition, it is possible to quickly and flexibly respond to changes in the authority information settings due to user transfers, etc. Furthermore, even when a business system 2 is added to an enterprise system, the enterprise system can be put into operation early by simply adding information about the business system 2 to the default information described above.

In addition, in this embodiment, the access rights for a user are set as default information according to the branch to which the user belongs, but, for example, the branches may be subdivided according to the job duties of the users to which they belong, and the permission information may be set for each branch and job, i.e., for each position as mentioned above.

In addition, in this embodiment, the access permission of the functions provided by the business system 2 is set on a branch office basis. Furthermore, the branch offices may be divided into groups according to predetermined rules so that access can be controlled.

For example, each branch office is divided into multiple branch office areas (Hokkaido area, Tohoku area, Yokohama area, etc.) depending on the location of the base, and each branch office may set the authority information to default information so that it can access customer information managed by other branches within the branch office area to which it belongs. In this case, information indicating the correspondence between branches and branch office areas is required.

REFERENCE SIGNS LIST 1 Branch server, 2 Business system, 3 Rights management system, 31 Rights information setting section, 32 Information management section, 33 User rights information providing section, 34 Storage section.

Claims (1)

an authority information providing means for responding to an inquiry about authority setting for a user from a business system shared by a plurality of users belonging to any one of the branch offices, when individual authority information specific to the user is set for the business system, by replying with the individual authority information as an access authority to be set for the user, and when the individual authority information is not set for the user, by replying with default information about the access authority preset for each of the branch offices as the access authority to be set for the user,
The authority management system is characterized in that the personal authority information is stored and managed separately for the branch office to which the user belongs and information regarding authority settings for other branches .

Images