JP7549717B2 - Server, user terminal, system, and access control method - Google Patents

Description

The present invention relates to a server, a user terminal, a system, and an access control method.

Many tasks involve users accessing servers in offices and handling confidential information. Currently, to prevent confidential information from being leaked, a separate network environment for confidential information, including terminals, networks, and applications, is constructed for each task. This means that users must use different network environments, work locations, and other work environments depending on the task at hand, resulting in poor work and operational efficiency.

Methods for controlling user access to servers, etc. have also been reported (for example, Patent Documents 1 and 2). Patent Document 1 discloses a system consisting of a document management server, a personnel organization management server, and a client, in which default access right setting conditions for documents and folders are stored in a storage unit in advance, and when users and groups are changed based on personnel organization information, access rights to documents and folders are set for newly created users and groups and users and groups at the transfer destination based on the default access right setting condition information. Patent Document 1 discloses that when a personnel organization change occurs, the administrative user can simply set default access right setting conditions for folders, eliminating the need for the administrative user to manually set individual access rights in accordance with operational rules, thereby reducing the administrative user's burden.

Patent Document 2 discloses a system usage time management device that, when a user logs in, checks the information of the user group that the user belongs to stored in a management database, checks the usage time settings according to a predetermined priority order, and determines whether the user can log in or not based on the usage time setting with the highest priority that corresponds to the current time. Patent Document 2 discloses that not only can it prevent unauthorized access by users, it can also reduce the workload of managing system usage time settings and improve the convenience of managing those settings.

JP 2007-323357 A JP 2013-131254 A

However, with conventional technologies, it was difficult to dynamically control whether or not a user can access a given resource depending on various user conditions, such as the location where the user accesses the server or the user's job duties.

A server according to an embodiment of the present disclosure is characterized by having an account information acquisition unit that acquires account information of a user requesting access to a specific resource from a user terminal, a user status information acquisition unit that acquires user status information related to the user's status, a policy storage unit that stores a policy that specifies the relationship between the account information and user status information and the user's access authority to the specific resource, an analysis unit that refers to the policy and analyzes whether the user can access the specific resource based on the account information and user status information, and an access control unit that controls the user's access to the specific resource based on the analysis result by the analysis unit.

In a server according to an embodiment of the present disclosure, the user state information acquisition unit may include an access time information acquisition unit that acquires access time information regarding the time when the user is requesting access.

In a server according to an embodiment of the present disclosure, the user state information acquisition unit may include a location information acquisition unit that acquires location information regarding the location where the user is located.

In a server according to an embodiment of the present disclosure, the user status information acquisition unit may include a personnel information acquisition unit that acquires personnel information related to the user's professional or business status.

In a server according to an embodiment of the present disclosure, the user state information acquisition unit may include a history information acquisition unit that acquires history information regarding the user's behavior history.

In a server according to an embodiment of the present disclosure, the user state information acquisition unit may include a terminal information acquisition unit that acquires terminal information related to the terminal used by the user.

In a server according to an embodiment of the present disclosure, the analysis unit may have a learning model trained using history information on the behavioral history of multiple users and data indicating whether each piece of history information complies with a policy as learning data, and may have a learning model that takes the behavioral history of a user who has attempted to access a resource as input and outputs whether the behavioral history complies with the policy.

In a server according to an embodiment of the present disclosure, the analysis unit may weight the values to be accumulated when each of the multiple pieces of user state information does not satisfy the access permission condition according to the importance of each piece of user state information, determine whether each of the multiple pieces of user state information satisfies the access permission condition, and determine whether access is allowed or not based on whether the accumulated value of the above values exceeds a predetermined threshold.

In a server according to an embodiment of the present disclosure, the access control unit may select an appropriate level of authentication method from among multiple additional authentication methods according to the above value, and perform additional authentication for access permission.

A user terminal according to one embodiment of the present disclosure is characterized by having an input unit for inputting account information of a user requesting access, and a transceiver unit for transmitting a signal requesting access to a specific resource, and for receiving information regarding whether or not the user can access the specific resource based on an analysis result of an analysis of whether or not the user can access the specific resource based on the account information and user status information by referring to a policy that specifies the relationship between the account information, user status information regarding the user's status, and the user's access authority to the specific resource.

A system according to an embodiment of the present disclosure is a system having a user terminal and a server, the user terminal having an input unit for inputting account information of a user requesting access, and a transceiver unit for transmitting a signal requesting access to a specific resource, and receiving information on whether or not the user can access the specific resource based on an analysis result of an analysis of whether or not the user can access the specific resource based on the account information and user status information, with reference to a policy that specifies the relationship between the account information, user status information related to the user's status, and the user's access authority to the specific resource; the server has an account information acquisition unit for acquiring account information of a user requesting access to the specific resource from the user terminal, a user status information acquisition unit for acquiring user status information related to the user's status, a policy storage unit that stores a policy that specifies the relationship between the account information, user status information, and the user's access authority to the specific resource, an analysis unit for analyzing whether or not the user can access the specific resource based on the account information and user status information with reference to the policy, and an access control unit for controlling access to the specific resource by the user based on the analysis result by the analysis unit.

An access control method according to an embodiment of the present disclosure is characterized in that a server acquires account information of a user requesting access to a specific resource from a user terminal, acquires user status information relating to the user's status, stores a policy that specifies the relationship between the account information and user status information and the user's access authority to the specific resource, refers to the policy, and analyzes whether the user should be able to access the specific resource based on the account information and user status information, and controls the user's access to the specific resource based on the analysis result.

The server, user terminal, system, and access control method of the present invention can dynamically control whether or not a user can access a specific resource depending on various user conditions, such as the location where the user accesses the server and the user's job duties.

FIG. 1 is a conceptual diagram illustrating a configuration of a system according to an embodiment of the present disclosure. 11 is a first example of a flowchart for explaining an operation procedure of a server according to an embodiment of the present disclosure. 13 is a second example of a flowchart for explaining an operation procedure of a server according to an embodiment of the present disclosure. 13 is a third example of a flowchart for explaining an operation procedure of a server according to an embodiment of the present disclosure. 4 is a fourth example of a flowchart for explaining an operation procedure of a server according to an embodiment of the present disclosure. 5 is a fifth example of a flowchart for explaining an operation procedure of a server according to an embodiment of the present disclosure. 13 is a sixth example of a flowchart for explaining an operation procedure of a server according to an embodiment of the present disclosure. 13 is a flowchart for explaining an operation procedure of a server according to an embodiment of the present disclosure, and is an example of a flowchart for performing access control based on weighting of a plurality of pieces of user status information. 11 is a table showing examples of NG factors and NG value weights in a server according to an embodiment of the present disclosure. 13 is a flowchart for explaining an operation procedure of a server according to an embodiment of the present disclosure, and is an example of a flowchart for performing access control based on weighting of a plurality of pieces of user status information. 11 is a table showing an example of NG value ranges and additional authentication in a server according to an embodiment of the present disclosure.

The following describes the server, user terminal, system, and access control method according to the present invention with reference to the drawings. However, please note that the technical scope of the present invention is not limited to these embodiments, but extends to the inventions described in the claims and their equivalents.

(Overview of the system according to the embodiment of the present disclosure)
1 shows a conceptual diagram of a system according to an embodiment of the present disclosure. A user uses a user terminal 200 to access a resource 400 via a server 100 over a network 300. The server 100 acquires user status information from the user terminal 200 and dynamically controls whether or not the user should be permitted to access a specific resource according to a predefined policy. Since the server 100 determines whether or not the user is permitted to access a specific resource based on the user's status, the user does not need to prepare a separate network environment for accessing various resources, and business efficiency and operational efficiency can be improved.

Resource 400 may be, for example, data including confidential information, or a server or cloud service that stores such data. Resource 400 may also be, for example, a business system that handles confidential information, or a server or cloud service that provides such a system.

For example, a case will be described in which a policy specifies that access to a specific resource is permitted on the condition that the user is present at a specific location. In this case, conventionally, the user was required to enter the specific location and access the specific resource using a terminal installed at the specific location. In contrast, in a system according to an embodiment of the present disclosure, the server 100 can obtain information regarding whether or not the user is present at the specific location. The server 100 can refer to a predefined policy and determine whether or not to permit the user to access the specific resource based on information regarding whether or not the user is present at the specific location. The server 100 controls the user's access to the specific resource based on the result of the determination of whether or not access is permitted.

In the above example, the server controls to allow the user to access the specified resource 400 based on information that the user is present in a specified location. Therefore, as long as the user is present in the specified location, any user terminal can be used, and the user can access the specified resource without having to individually prepare a network environment for accessing the specified resource, such as by selecting the terminal to be used.

(Server configuration)
The server 100 has an account information acquisition unit 1, a user state information acquisition unit 2, a policy storage unit 3, an analysis unit 4, and an access control unit 5. Each of these units is a functional module realized by a program executed by a processor included in the server 100. Alternatively, each of these units may be implemented in the server 100 as firmware. The server 100 may further include an access log storage unit 6 that stores past access logs by users, and a transmission/reception unit 7. The server 100 may be an information processing device installed in an office or a data center, or a virtual server virtually defined on a cloud service.

The account information acquisition unit 1 acquires account information of a user requesting access to a specific resource 400 from the user terminal 200. The account information may include access rights to the specific resource and user information for uniquely identifying the holder of the access rights. For example, the account information may include user identification information (ID), a password, an email address, etc.

The user status information acquisition unit 2 acquires user status information related to the user's status. The user status information may include, for example, information related to the time when the user is making an access request (access time), information related to the location (hereinafter, location information), information related to the user's professional or business status (hereinafter, also referred to as "personnel information"), information related to the user's behavior history, etc. The user status information acquisition unit 2 may have at least one of an access time information acquisition unit 21, a location information acquisition unit 22, a personnel information acquisition unit 23, a history information acquisition unit 24, and a terminal information acquisition unit 25.

The access time information acquisition unit 21 acquires access time information relating to the time when the user is requesting access. For example, the access time information acquisition unit 21 may acquire from the user terminal 200 the time when access was made from the user terminal 200. Alternatively, when the access time information acquisition unit 21 detects access from the user terminal 200, it may refer to the clock unit 13 and acquire information relating to the time when access was made from the clock unit 13.

The location information acquisition unit 22 acquires location information of the user. For example, when the user enters a specified area in which the entrance status detection unit 12 is provided, the location information acquisition unit 22 may acquire location information related to the location where the user is located from the entrance status detection unit 12. That is, the location information may include information related to entry and exit to a specified facility. Alternatively, the location information acquisition unit 22 may acquire information related to the location of the user terminal 200 from a location information acquisition unit (not shown) using a GPS or the like provided in the user terminal 200. Alternatively, the location information acquisition unit 22 may acquire information related to the network to which the user terminal 200 is connected, such as a wireless LAN access point, a mobile base station, or a network switch.

The personnel information acquisition unit 23 acquires personnel information of the user. The personnel information may include, for example, attribute information (e.g., information on the department to which the user belongs, information on the position, information on whether the user is on leave, information on the status of the conclusion of a non-disclosure agreement (NDA), information on the access permission/prohibition specified by the security administrator, etc.), business information (information on the user's work), career information (e.g., information on the user's skills, information on past work responsibilities, information on acquired qualifications, information on the training attendance history, information on the user's promotion, transfer, and demotion within the workplace, etc.), health information disclosed based on the user's consent (e.g., information on the status or results of legal health checkups, vaccinations, antigen tests, etc.), or attendance information (e.g., working hours, shifts, vacation information, information on whether the user has submitted work-related notifications such as overtime work, vacation, resignation notice, and domestic and overseas business trips, cumulative work hours information for a specified period, etc.), etc.

The history information acquisition unit 24 acquires history information regarding the user's behavioral history. The history information regarding the user's behavioral history may include, for example, information regarding whether or not the user's behavior violates job regulations, or information regarding whether or not there are any problems with the user's past logs stored in the access log storage unit 6. In addition, the history information regarding the user's behavioral history may include, for example, information regarding the number of times the user has failed authentication, information regarding the most recent customer response history, etc.

The terminal information acquisition unit 25 acquires terminal information related to the terminal used by the user. The terminal information related to the terminal used by the user may include, for example, identification information of the user terminal 200 to which the user is accessing (IMSI (International Mobile Subscription Identity), IMEI (International Mobile Equipment Identifier), MAC address, etc.), information on the connected network (IP address, PLMN (Public Land Mobile Network), 0ABJ number which is a 10-digit phone number format, etc.), information on the terminal status (security patch application status, access certificate setting status, security software installation status, etc.), and information on the client certificate. The terminal information related to the terminal used by the user may also include information on whether the user terminal 200 to which the user is accessing is an authorized terminal. The terminal information related to the terminal used by the user may also include information on whether the user terminal to which the user is attempting to access is the same as the terminal normally used by the user, and information on the combination of the terminal and the user.

The policy memory unit 3 stores policies that define the relationship between account information, user status information, and a user's access authority to a specified resource. The policy memory unit 3 may be a storage device such as a hard disk or a semiconductor memory element such as a ROM or RAM. The policies stored in the policy memory unit 3 define the correspondence between a user's status and information regarding whether or not access is permitted. For example, it may define whether a user performing a specified task can access a specified resource at a specified location during a specified time period. Or it may define whether a user with a specified job responsibility can enter a specified location during a specified time period.

The analysis unit 4 refers to the policy and analyzes whether the user is permitted to access a specific resource based on the account information and user status information. For example, the analysis unit 4 analyzes whether the user's status satisfies the conditions for permitting access to a specific resource, as stipulated in the policy.

The access control unit 5 controls user access to a specific resource 400 based on the analysis results by the analysis unit 4.

(Configuration of user terminal)
The user terminal 200 has an input unit 201, a display unit 202, and a transmission/reception unit 203. The input unit 201 may be an input device such as a keyboard or a mouse. The display unit 202 may be a display device such as a liquid crystal display device or an organic EL display device. The transmission/reception unit 203 is connected to the network 300 and can transmit and receive data between the server 100. The user terminal 200 may be a virtual terminal as well as a physical terminal as described above. By using a virtual terminal, applications and data can be consolidated in the server and data can be prevented from remaining in the terminal, thereby preventing information leakage.

The input unit 201 inputs the account information of the user requesting access.

The transmitting/receiving unit 203 transmits a signal requesting access to a specific resource, and receives information regarding whether or not the user can access the specific resource based on the analysis results of an analysis of whether or not the user can access the specific resource based on the account information and the user status information, with reference to a policy that specifies the relationship between the account information, user status information regarding the user's status, and the user's access authority to the specific resource.

(Resource configuration)
Examples of the specified resource 400 include, for example, SaaS (Software as a Service) 401, an in-house system 402, a file server 403, and an Internet connection 404, but are not limited to these examples. The server 100 can utilize various resources to which access from users can be controlled.

Next, we will explain the server's operating procedures while giving examples of user state information.

(First Example: Access Control Based on Access Time)
2 shows a first example of a flowchart for explaining an operation procedure of a server according to an embodiment of the present disclosure. First, in step S101, when a user inputs user account information using the input unit 201 of the user terminal 200, the account information acquisition unit 1 of the server 100 acquires the user account information via the network 300. The user account information may include the user's identification information, password, information about the department to which the user belongs, information about the position, identification information of the terminal to be used, attendance information, etc. The account information may be transmitted in a plain text format, or may be transmitted and received between the server 100 and the user terminal 200 in a format in which the account information has been subjected to processing such as binary encoding, encryption, and data compression.

Next, in step S102, when the user attempts to access the specified resource 400, the access time information acquisition unit 21 acquires information on the time when the user accessed the specified resource 400. For example, the access time information acquisition unit 21 can acquire information on the time when the user attempted to access the specified resource using the user terminal 200 from the clock unit 13. In addition, the access time information may include, for example, information on the time zone of the server 100 and the user terminal 200, information on the day of the week, and information on holidays based on the time zone.

Next, in step S103, the analysis unit 4 refers to the policy stored in the policy memory unit 3. Here, for example, the policy pre-specifies information regarding the time period during which a user can access a specific resource among the resources 400. For example, the policy may specify that the time period during which the in-house system 402 among the resources 400 can be accessed is limited to the time period from 9:00 a.m. to 5:00 p.m. The accessible time period may be set to an individual value for each user based on attendance information including, for example, the user's working hours, shifts, and vacation information. For example, the attendance information of user A is assumed to be such that the user is scheduled to work from 09:00 to 17:45 on October 18, 2021, and is scheduled to work from 17:00 to 10:30 the next morning on October 19, 2021. In this case, the policy storage unit 3 may store a policy that permits user A to access the resource 400 during the period from 09:00 to 17:45 on October 18, 2021, the period from 17:00 to 23:59 on October 19, 2021, and the period from 00:00 to 10:30 on October 20, 2021.

Next, in step S104, the analysis unit 4 refers to the policy and analyzes whether or not the user should be permitted to access the specified resource. For example, the analysis unit 4 refers to the policy and analyzes whether or not the user should be permitted to access the specified resource based on whether or not the time when the user accessed the in-house system 402 is included in a specified time period defined in the policy.

If the analysis unit 4 determines in step S104 that the user should be permitted to access the specified resource, the access control unit 5 permits the user to access the specified resource in step S105. For example, if the time when the user accesses the in-house system 402 is 10:00 a.m., this is within the time period (9:00 a.m. to 5:00 p.m.) defined in the policy, so the access control unit 5 permits the user to access the in-house system 402, and the user can access the in-house system 402.

On the other hand, if the analysis unit 4 determines in step S104 that the user should not be permitted to access the specified resource, the access control unit 5 does not permit the user to access the specified resource in step S106. For example, if the user accesses the in-house system 402 at 6:00 p.m., this is not included in the time period specified in the policy (the time period from 9:00 a.m. to 5:00 p.m.), so the access control unit 5 does not permit the user to access the in-house system 402, and the user's access to the in-house system 402 is restricted.

In this way, the server 100 can control a user's access to the specified resource 400 depending on whether the time when the user attempts to access the specified resource 400 is included in the time period specified in the policy. The result of the server 100's decision on whether or not access is permitted is transmitted to the transceiver unit 203 of the user terminal 200 by the transceiver unit 7 of the server 100. The user can recognize whether or not access to the specified resource 400 is permitted based on the result of the decision on whether or not access is permitted displayed on the display unit 202 of the user terminal 200.

In addition, information regarding the time when a user attempted to access a specific resource 400 and the result of the judgment on whether access was allowed may be stored in the access log storage unit 6. Information regarding the access log stored in the access log storage unit 6 can be used as the user's behavior history.

(Second Example: Access Control Based on User's Entry/Exit to a Predetermined Area)
3 shows a second example of a flowchart for explaining an operation procedure of the server according to an embodiment of the present disclosure. First, in step S201, when a user inputs user account information using the input unit 201 of the user terminal 200, the account information acquisition unit 1 of the server 100 acquires the user account information via the network 300.

Next, in step S202, when the user attempts to access a specific resource 400, the location information acquisition unit 22 acquires the user's location information at the time the user accessed the specific resource 400. For example, the location information acquisition unit 22 may acquire information regarding whether the user has entered the company building based on information from an employee ID card recognition device installed at the entrance gate of the company building to which the user belongs, or a face recognition device that identifies an image of the user's face through image recognition. Alternatively, for example, information indicating that the user has entered a specific room can be acquired by acquiring information indicating that the user has brought an ID card close to an ID card reader installed at the entrance of a specific room in the company building and detected that the lock to the specific room has been unlocked.

Next, in step S203, the analysis unit 4 refers to the policy stored in the policy storage unit 3. Here, for example, the policy specifies that the user must be present in a specified room as a condition for allowing the user to access a specified resource. For example, the policy specifies that the user can only access the file server 403 that stores confidential information among the resources 400 when the user is in the room in which the file server 403 is installed (confidential area).

Next, in step S204, the analysis unit 4 refers to the policy and analyzes whether or not the user should be permitted to access a specific resource. For example, the analysis unit 4 refers to the policy and analyzes whether or not to permit access based on whether or not the user is in a specific room defined in the policy when the user accesses the file server 403.

If the analysis unit 4 determines in step S204 that the user should be permitted to access the specified resource, the access control unit 5 permits the user to access the specified resource in step S205. For example, when the user accesses the file server 403, if the user is in the room in which the file server 403 is installed, the user can access the file server 403 because the condition stipulated in the policy that the user is in the room in which the file server 403 is installed is satisfied.

On the other hand, if the analysis unit 4 determines in step S204 that the user should not be permitted to access the specified resource, the access control unit 5 does not permit the user to access the specified resource in step S206. For example, if the user accesses the file server 403 but is not in the room in which the file server 403 is installed, the condition stipulated in the policy that the user is in the room in which the file server 403 is installed is not met, and the user's access to the file server 403 is restricted.

In this way, when a user attempts to access a specific resource 400, the server 100 can control the user's access to the specific resource 400 depending on whether the user is present in a specific location. The result of the server 100's determination on whether access is permitted is transmitted to the transceiver unit 203 of the user terminal 200 by the transceiver unit 7 of the server 100. The user can recognize whether access to the specific resource 400 is permitted based on the result of the access permission determination displayed on the display unit 202 of the user terminal 200.

In addition, information regarding the location where the user was when the user attempted to access a specific resource 400 and the result of the judgment on whether or not access was allowed may be stored in the access log storage unit 6. Information regarding the access log stored in the access log storage unit 6 can be used as the user's behavior history. For example, if a user attempts to access a specific resource that stores confidential information from a location where access is not permitted by policy, the access can be logged as an unauthorized access.

(Third Example: Access Control Based on User Status)
4 shows a third example of a flowchart for explaining an operation procedure of the server according to an embodiment of the present disclosure. First, in step S301, when a user inputs user account information using the input unit 201 of the user terminal 200, the account information acquisition unit 1 of the server 100 acquires the user account information via the network 300.

Next, in step S302, when the user attempts to access the specified resource 400, the personnel information acquisition unit 23 acquires personnel information of the user who attempted to access the specified resource 400. For example, the personnel information acquisition unit 23 may acquire information about the user's status, such as information about the department to which the user belongs and transfers between departments, the user's career information, information about the user's current job content, information about the user's current position and changes in position, information about whether the user is currently on vacation, information about the status of the conclusion of a non-disclosure agreement, health information, or information about whether the user has submitted a resignation notice, from the personnel information storage unit 11 in which such information is stored.

Next, in step S303, the analysis unit 4 refers to the policy stored in the policy storage unit 3. Here, for example, the policy may specify that conditions for allowing a user to access a specific resource require that the user belongs to a specific department, that the user has completed a specific training course, that the user is engaged in a specific job, that the user holds a specific position or higher, that the user is not on vacation, or that the user has not submitted a resignation letter, etc. As an example, a case will be described in which the policy specifies that a condition for a user to access a specific in-house system 402 among resources 400 is that the user has completed a specific training course.

Next, in step S304, the analysis unit 4 refers to the policy and analyzes whether or not the user should be permitted to access the specified resource. For example, the analysis unit 4 refers to the policy and analyzes whether or not to permit access based on whether or not the user has completed a specified training course defined in the policy at the time the user accesses the specified in-house system 402.

If the analysis unit 4 determines in step S304 that the user should be permitted to access the specified resource, the access control unit 5 permits the user to access the specified resource in step S305. For example, if the user has completed a specified training course at the time the user accesses the specified in-house system 402, the user can access the specified in-house system 402 because the condition stipulated in the policy, that is, completion of the specified training course, is satisfied.

On the other hand, if the analysis unit 4 determines in step S304 that the user should not be permitted to access the specified resource, the access control unit 5 does not permit the user to access the specified resource in step S306. For example, if the user has started but not completed a specified training course at the time the user accesses the specified in-house system 402, or has not started the specified training course, the user's access to the specified in-house system 402 is restricted because the condition stipulated in the policy that the specified training course must be completed is not met.

In this way, when a user attempts to access a specific resource 400, the server 100 can control the user's access to the specific resource 400 depending on whether the user has completed the specific training. The server 100's decision on whether access is permitted is sent to the transceiver unit 203 of the user terminal 200 by the transceiver unit 7 of the server 100. The user can recognize whether access to the specific resource 400 is permitted based on the decision on whether access is permitted displayed on the display unit 202 of the user terminal 200.

In addition, at the time when a user attempts to access the specified resource 400, information regarding the user's application status for taking the specified training, the progress of taking the specified training, and the result of the judgment on whether or not access is permitted may be stored in the access log storage unit 6. The information regarding the access log stored in the access log storage unit 6 can be used as the user's behavior history. For example, if a policy specifies that a user must complete the specified training as a condition for accessing the specified resource, but the user has not even applied to take the specified training, this can be used as a reference for determining whether or not to strengthen monitoring of the user.

In addition, for example, if a user belongs to a specific department and has access rights to specific resources, and then the user is transferred to another department, the access control unit 5 may control the user to restrict the access rights that were given to the user when the user was employed in the original department.

In addition, for example, a demoted user may not have a good impression of the workplace, and therefore monitoring of the demoted user may need to be strengthened. Therefore, when a user's job position is demoted, the access control unit 5 may control the user to restrict the access rights to specific resources that were given to the user before the demotion.

In addition, for example, if a user is on leave and it is determined that it is difficult for the user to perform normal work, the access control unit 5 may control the user to restrict access rights to specific resources.

For example, when a user submits a resignation notice, the user may be transferred to another company, so the access control unit 5 may control the user to restrict access rights to certain resources that were given to the user before the user submitted the resignation notice.

(Fourth Example: Access Control Based on User Action History, etc.)
5 shows a fourth example of a flowchart for explaining an operation procedure of the server according to an embodiment of the present disclosure. First, in step S401, when a user inputs user account information using the input unit 201 of the user terminal 200, the account information acquisition unit 1 of the server 100 acquires the user account information via the network 300.

Next, in step S402, when the user attempts to access the specified resource 400, the history information acquisition unit 24 acquires the user's history information for a specified period up to the time when the user accessed the specified resource 400. For example, the history information acquisition unit 24 acquires history information on the user's behavior history for a specified period from a certain point before the user accesses the specified resource to the time when the user accesses the specified resource. For example, the history information on the user's behavior history may include information on the history of the user's actions from the time when the user joined the company where the user currently works until the time when the user accesses the specified resource. For example, the history information acquisition unit 24 can acquire information on the access log that records what sites the user accessed within a specified period from the access log storage unit 6 as the history information on the user's behavior history.

Next, in step S403, the analysis unit 4 refers to the policy stored in the policy storage unit 3. Here, for example, the policy specifies that, as a condition for allowing a user to access a specific resource, the user must not have previously engaged in any behavior that violates company regulations. For example, the policy specifies that a user can only access the file server 403 among resources 400 if the user has never previously engaged in any behavior that violates company regulations.

The analysis unit 4 can also use artificial intelligence to analyze whether or not a policy is met. For example, the analysis unit 4 according to one embodiment may have a learning model trained using history information on the behavioral history of multiple users and data indicating whether or not each piece of history information meets a policy as learning data, the learning model using the behavioral history of a user who attempted to access a resource as input data and outputting whether or not the user's behavioral history meets a policy. The learning model may be trained using any machine learning method. For example, the learning model may be trained using supervised machine learning using the past behavioral history of all employees and data indicating whether or not each behavioral history violates a policy as learning data.

Next, in step S404, the analysis unit 4 refers to the policy and analyzes whether or not the user should be permitted to access the specified resource. For example, the analysis unit 4 refers to the policy and analyzes whether or not to permit access based on whether or not the user has never engaged in any behavior that violates company regulations, as stipulated in the policy, during a specified period before the user accessed the file server 403.

If the analysis unit 4 determines in step S404 that the user should be permitted to access the specified resource, the access control unit 5 permits the user to access the specified resource in step S405. For example, if the user has not engaged in any behavior that violates company regulations during a specified period of time before accessing the file server 403, the user can access the file server 403 because the condition specified in the policy, that is, that the user has not engaged in any behavior that violates company regulations during a specified period of time, is satisfied.

On the other hand, if the analysis unit 4 determines in step S404 that the user should not be permitted to access the specified resource, the access control unit 5 does not permit the user to access the specified resource in step S406. For example, if the user has engaged in an action that violates company regulations once or multiple times during a specified period before the user accesses the file server 403, the user's access to the file server 403 is restricted because the condition specified in the policy that the user has not engaged in an action that violates company regulations even once during the specified period is not met.

In this way, when a user attempts to access a specific resource 400, the server 100 can control the user's access to the specific resource 400 depending on whether the user has engaged in behavior that violates company regulations within a specified period of time. The server 100's decision on whether or not access is permitted is transmitted to the transceiver unit 203 of the user terminal 200 by the transceiver unit 7 of the server 100. The user can recognize whether or not access to the specific resource 400 is permitted based on the decision on whether or not access is permitted displayed on the display unit 202 of the user terminal 200.

In addition, information regarding the user's behavior history during a specified period up until the time when the user attempted to access a specified resource 400, information regarding the user's access history to the site, and information regarding the result of the access permission decision may be stored in the access log storage unit 6. The information regarding the access log stored in the access log storage unit 6 can be used as a basis for deciding whether or not to monitor the user's behavior. For example, if a user has behaved in a manner that violates company regulations in the past, but still attempts to access a file server that stores confidential company information, this information can be used as a reference for deciding whether or not to further strengthen monitoring of the user in the future.

In addition, for example, if the user's behavior is suspected to violate the job regulations, the access control unit 5 may control the user to restrict access rights to specified resources. Also, if a record of access to an unauthorized site is found in the log that records the user's past access history stored in the access log storage unit 6, the access control unit 5 may control the user to restrict access rights to specified resources.

(Fifth Example: Access Control Based on the Model of the Terminal Used by the User)
6 shows a fifth example of a flowchart for explaining an operation procedure of the server according to an embodiment of the present disclosure. First, in step S501, when a user inputs user account information using the input unit 201 of the user terminal 200, the account information acquisition unit 1 of the server 100 acquires the user account information via the network 300.

Next, in step S502, when the user attempts to access the specified resource 400, the terminal information acquisition unit 25 acquires terminal information related to the terminal used by the user at the time the user accesses the specified resource 400. For example, if the user's account information acquired by the account information acquisition unit 1 includes identification information of the user terminal 200 used by the user, the terminal information acquisition unit 25 may acquire terminal information related to the terminal used by the user from the account information acquisition unit 1. Alternatively, for example, if the identification information of the user terminal 200 used by the user is associated with the user's identification information and stored in the personnel information storage unit 11, the terminal information acquisition unit 25 may acquire the identification information of the user terminal 200 used by the user from the personnel information storage unit 11.

Next, in step S503, the analysis unit 4 refers to the policy stored in the policy storage unit 3. Here, for example, the policy specifies that, as a condition for allowing a user to access a specific resource, the user must use a predetermined user terminal. Here, as an example, a case will be described in which the policy specifies that a user can only access the file server 403 of the resource 400 if the user uses a user terminal equipped with a specific function.

Next, in step S504, the analysis unit 4 refers to the policy and analyzes whether or not the user should be permitted to access the specified resource. For example, the analysis unit 4 refers to the policy and analyzes whether or not to permit access based on whether or not the user terminal 200 used by the user when the user accesses the file server 403 is a specified user terminal defined in the policy.

If the analysis unit 4 determines in step S504 that the user should be permitted to access the specified resource, the access control unit 5 permits the user to access the specified resource in step S505. For example, if the user terminal 200 used by the user when accessing the file server 403 is a user terminal equipped with the specified function defined in the policy, the condition defined in the policy that the user terminal is equipped with the specified function is satisfied, and the user can access the file server 403.

On the other hand, if the analysis unit 4 determines in step S504 that the user should not be permitted to access the specified resource, the access control unit 5 does not permit the user to access the specified resource in step S506. For example, if the user terminal 200 used by the user when accessing the file server 403 does not have the specified function defined in the policy, the condition defined in the policy that the user terminal is a user terminal having the specified function is not met, and therefore the user's access to the file server 403 is restricted.

In this way, the server 100 can control a user's access to the specified resource 400 depending on whether the user terminal being used when the user attempts to access the specified resource 400 has the specified function defined in the policy. The server 100's decision on whether or not access is permitted is transmitted to the transceiver unit 203 of the user terminal 200 by the transceiver unit 7 of the server 100. The user can recognize whether or not access to the specified resource 400 is permitted based on the decision on whether or not access is permitted displayed on the display unit 202 of the user terminal 200.

The access log storage unit 6 may store identification information of the user terminal used by the user when the user attempted to access the specified resource 400, and information regarding the result of the judgment on whether or not access is permitted. The information regarding the access log stored in the access log storage unit 6 can be used as the user's behavior history. For example, if a user attempts to access a specified resource that stores confidential information, etc., using a user terminal that is personally owned and to which access is not permitted according to the policy, the access can be logged as an unauthorized access.

(Sixth Example: Access Control Based on Complex User State Information)
7 shows a sixth example of a flowchart for explaining the operation procedure of the server according to an embodiment of the present disclosure. In the above first to fifth examples, the examples of performing access control based on the status information of one user have been described, but the present invention is not limited to such examples, and access control may be performed based on the status information of multiple users.

For example, in step S601, the account information acquisition unit 1 acquires the user's account information, and then in step S602, the access time information acquisition unit 21 acquires information regarding the time the user accessed a specific resource, and in step S603, the location information acquisition unit 22 acquires location information regarding the location where the user was located when the user attempted to access the specific resource.

Next, in step S604, the analysis unit 4 refers to the policy stored in the policy storage unit 3. Here, for example, the policy specifies that a user can access a specific resource among the resources 400 if both a first condition that the time period during which the access is made is a specific time period and a second condition that the user attempting the access is in a specific location are satisfied. For example, the policy specifies that the time period during which the in-house system 402 among the resources 400 can be accessed is limited to the time period between 9:00 a.m. and 5:00 p.m. and when the user is in a specific room. If the server 100 and the user terminal 200 are located in different time zones, the time zone of either the server 100 or the user terminal 200 may be set to make the determination based on the time zone information included in the information regarding the access time. Specifically, for example, when a user at an office outside Japan accesses a resource 400 in Japan, the determination may be made based on the access permission time based on the Japanese time, or based on the standard time of the country in which the user is located.

Next, in step S605, the analysis unit 4 refers to the policy and analyzes whether or not the user should be permitted to access the specified resource. For example, the analysis unit 4 refers to the policy and analyzes whether or not to permit access based on whether or not a first condition is satisfied that the time when the user accessed the in-house system 402 is included in a specified time period defined in the policy, and a second condition is satisfied that the user is in a specified room when the user attempts to access the in-house system 402.

In step S605, if the analysis unit 4 analyzes that the user should be allowed to access the specified resource, in step S606, the access control unit 5 allows the user to access the specified resource. For example, if the time when the user accesses the in-house system 402 is 10:00 a.m., the time is included in the time period (9:00 a.m. to 5:00 p.m.) specified in the policy, so the user satisfies the first condition for accessing the in-house system 402. Also, if the user is in a specified room when attempting to access the in-house system 402, the user satisfies the second condition for accessing the in-house system 402. Therefore, in this way, if both the first condition and the second condition are satisfied, the access control unit 5 allows the user to access the specified resource.

On the other hand, if the analysis unit 4 determines in step S605 that the user should not be allowed to access the specified resource, the access control unit 5 does not allow the user to access the specified resource in step S607. For example, if the time when the user accesses the in-house system 402 is 6:00 p.m., the analysis unit 4 analyzes that the user does not meet the first condition for accessing the in-house system 402 because the time is not included in the time period specified by the policy (the time period from 9:00 a.m. to 5:00 p.m.), and the user's access to the in-house system 402 is restricted. If the time when the user accesses the in-house system 402 is 10:00 a.m., the analysis unit 4 analyzes that the user meets the first condition for accessing the in-house system 402 because the time is included in the time period specified by the policy (the time period from 9:00 a.m. to 5:00 p.m.), but even in this case, if the user is not in a specified room when attempting to access the in-house system 402, the analysis unit 4 analyzes that the user does not meet the second condition for accessing the in-house system 402, and the user's access to the in-house system 402 is restricted.

In this way, the server 100 can control a user's access to a specific resource 400 depending on whether the time and place at which the user attempts to access the specific resource 400 satisfy the complex conditions defined in the policy. The server 100's decision on whether or not access is permitted is transmitted to the transceiver unit 203 of the user terminal 200 by the transceiver unit 7 of the server 100. The user can recognize whether or not access to the specific resource 400 is permitted based on the decision on whether or not access is permitted displayed on the display unit 202 of the user terminal 200.

In the above example, the conditions for controlling a user's access to a specific resource 400 are shown to be based on two pieces of user state information: the time when the user attempted to access the specific resource, and the location when the user attempted to access the specific resource. However, the user state information is not limited to these, and access control may be performed based on multiple other pieces of user state information. By increasing the number of pieces of user state information used for access control, access control can be performed more strictly.

As an example of controlling access to a specific resource by a user based on multiple pieces of user status information, access control may be performed based on two pieces of information: the user's identification information and information related to the user's work content. For example, access control may be performed by allowing a user who is performing customer support (CS) work to send emails only to the customers that the user is responsible for while responding to inquiries.

As another example of controlling access to a specific resource by a user based on multiple pieces of user status information, access control may be performed based on two pieces of information: the user's identification information and information related to the user's working hours. For example, access may be restricted if the number of times an employee accesses an internal system from outside the company outside working hours exceeds a certain threshold.

As yet another example of controlling a user's access to a specific resource based on multiple pieces of user status information, access control may be performed based on two pieces of information: information on whether a user has entered a specific room, and information on whether the entry to the specific room occurred during a specific time period. For example, the entry management system may be controlled so that a user is permitted to enter a limited area only during permitted time periods.

As another example of controlling a user's access to a specific resource based on multiple pieces of user status information, access control may be performed based on two pieces of information: information regarding entry to a specific facility or a specific room, and the user's health information. For example, even if the location from which the user is accessing is a location for which access is permitted as defined by the policy, if the user's health information includes a specific high-risk disease, the analysis unit 4 may determine that this is unauthorized access to an internal system, and the access control unit 5 may restrict the access.

(Access control by weighting multiple user status information)
In the above access control based on multiple user status information, the weight of each user status information is not taken into consideration. However, multiple user status information may be weighted according to the importance. Therefore, an example of access control based on weighting of multiple user status information will be described.

FIG. 8 is a flowchart for explaining the operation procedure of a server according to an embodiment of the present disclosure, showing an example of a flowchart for performing access control by weighting multiple pieces of user state information. The analysis unit of the server according to an embodiment of the present disclosure may weight the values to be accumulated when each piece of user state information does not satisfy the access permission condition according to the importance of each piece of user state information, determine whether each piece of user state information satisfies the access permission condition, and determine whether access is allowed or not based on whether the accumulated value exceeds a predetermined threshold.

First, in step S701, the analysis unit 4 performs personal authentication of the user. In the personal authentication, it is determined whether or not the account information satisfies a predetermined condition (hereinafter also referred to as an "access permission condition") defined in the policy. The access permission condition may be, for example, that the combination of user identification information and password entered by the user matches the account information. If the result of the personal authentication does not satisfy the access permission condition (NG), in step S716, the access control unit 5 denies access by the user.

On the other hand, if the result of personal authentication in step S701 indicates that the access permission conditions are met (OK), in step S702, the analysis unit 4 acquires the access permission conditions of the request destination. The access permission conditions may be a policy stored in the policy storage unit 3.

Next, in step S703, the user status information acquisition unit 2 acquires information indicating the user's status. The information indicating the user's status may include information regarding personal authentication, information regarding the "person," "location," "time," and "task" performing the access, and information regarding the "behavioral history."

Next, in step S704, the analysis unit 4 determines whether the attribute information included in the user state information satisfies the access permission conditions (hereinafter also referred to as "person" consistency).

In step S704, if the consistency condition of "person" is not met (NG), the NG value is incremented by 1 in step S705. Specifically, for example, if the access permission condition is "being a user belonging to the human resources department" and the department information to which the user belongs included in the attribute information is "legal department", the analysis unit 4 may determine NG. In addition, the analysis unit 4 may determine whether the user's business information, career information, health information, and attendance information meet the consistency condition of "person". The initial value of the NG value may be 0. Here, the "NG value" is a value determined according to the importance of the consistency judgment element, and is a value used to distinguish between cases when performing additional authentication, which will be described later.

On the other hand, if in step S704 the information indicating the user's status satisfies the "person" consistency condition (OK), then no NG value is added, and in step S706, the analysis unit 4 determines whether the location information included in the user status information satisfies the access permission condition (hereinafter also referred to as "location" consistency).

If the information indicating the user's status does not satisfy the "location" consistency condition (NG) in step S706, the NG value is incremented by 2 in step S707. Specifically, for example, if the access permission condition is set to "be in the operation room" and the user's location information indicates that the user is in a "conference room," the analysis unit 4 may determine NG.

On the other hand, if in step S706 the information indicating the user's status satisfies the "location" consistency condition (OK), the NG value is not added, and in step S708, the analysis unit 4 determines whether the access time information included in the user status information satisfies the access permission condition (hereinafter also referred to as "time" consistency).

If the information indicating the user's status does not satisfy the "time" consistency condition (NG) in step S708, the NG value is incremented by 4 in step S709. Specifically, for example, if the access permission condition is set to "weekdays from 9:00 to 17:45" and the access time information is "weekdays 22:00," the analysis unit 4 may determine it as NG.

On the other hand, if in step S708 the user status information satisfies the "time" consistency condition (OK), the NG value is not added, and in step S710, the analysis unit 4 determines whether the business information included in the user status information satisfies the access permission condition (hereinafter also referred to as "business" consistency).

If the user status information does not satisfy the consistency condition for "business" in step S710 (NG), the NG value is incremented by 8 in step S711. Specifically, for example, if "customer service" is defined as the access permission condition and the business information is "accounting," the analysis unit 4 may determine that the information is NG.

On the other hand, if, in step S710, the information indicating the user's status satisfies the consistency condition for "business" (OK), the NG value is not added, and in step S712, the analysis unit 4 determines whether the user's behavior history satisfies the access permission condition (hereinafter also referred to as "behavior history" consistency).

If the user's behavior history does not satisfy the access permission condition (NG) in step S712, the NG value is incremented by 16 in step S713. Specifically, for example, if the access permission condition is set to "never attempt to log in to a system for which the user does not have access rights," and the behavior history records "attempts to log in to a system for which the user does not have access rights," the analysis unit 4 may determine that the access is NG.

On the other hand, if the user's behavior history satisfies the predetermined condition (OK) in step S712, the NG value is not added, and in step S714, it is determined whether the NG value exceeds the threshold value.

If the NG value is equal to or less than a predetermined threshold (e.g., 1) in step S714 (No), in step S715, the access control unit 5 allows the user to access the requested destination.

On the other hand, if the NG value exceeds the predetermined threshold value (Yes) in step S714, the process continues in the flowchart shown in FIG. 10 as described later. In this embodiment, an example in which the threshold value is 1 will be described, but the present invention is not limited to such an example, and the threshold value may be 2 or more. The threshold value may be a common value for all resources, or a different value may be set for each resource. Note that, in FIG. 8, an example in which authentication is performed in six stages from S703 to S712 is shown, but the authentication stages used do not need to be common for all resources. Specifically, for example, for resource A, only two stages of confirmation, the personal authentication shown in S703 and the consistency of "person" in S704, may be performed, and for resource B, all stages from S703 to S712 may be performed. The elements used to determine access permission may be changed, for example, depending on the importance of the resource, the result of personal authentication, that is, conditions according to the user, etc.

In the authentication flow shown in FIG. 8, the NG value is set to be larger in the order of "person" consistency, "place" consistency, "time" consistency, "task" consistency, and "action history" consistency. For example, in FIG. 8, if the four items of "person" consistency, "place" consistency, "time" consistency, and "task" consistency are NG, and the "action history" consistency is OK, the NG value is 15, and if the four items of "person" consistency, "place" consistency, "time" consistency, and "task" consistency are OK, and one item of "action history" consistency is NG, the NG value is 16. In other words, the NG value may be a value that changes depending on the content of the item whose consistency is NG, rather than the number of items whose consistency is NG. In other words, in access control to resources that are the object of access control, the NG value of important items may be increased. For example, in the authentication flow shown in FIG. 8, the consistency of "action history" can be said to be the most important authentication item. In this way, by setting different NG values for each authentication item, authentication that takes into account the importance of the authentication item is possible.

Here, the NG value to be accumulated when the information indicating the user's status does not satisfy the consistency conditions (access permission conditions) for each of "person", "place", "time", "task", and "action history" may be weighted based on the importance of each element, as shown in FIG. 9. In FIG. 9, the NG value weights for the NG elements "person", "place", "time", "task", and "action history" are shown as "1", "2", "4", "8", and "16", respectively, but the weights are not limited to these examples and may be set to other values. Furthermore, the weights for each element may be a common value for all resources, or different values may be set for each resource.

In the flowchart shown in FIG. 8, when the NG value exceeds a threshold, additional authentication may be performed according to the size of the NG value to permit access. That is, the access control unit 5 may select an appropriate level of authentication method according to the value from among a plurality of additional authentication methods to perform additional authentication to permit access. As described above, when the information indicating the user's status does not satisfy the respective consistency conditions of "person", "location", "time", "task", and "action history", if the NG value (total value) exceeds a predetermined threshold, access to the request destination is not permitted. However, it may be preferable to permit access by performing additional authentication by other means such as ensuring security. Therefore, an example of permitting access by performing additional authentication when the total value of the NG value exceeds a predetermined threshold will be described. Note that, since it is considered that the larger the total value of the NG value, the more careful the additional authentication for permitting access is required, the content of the additional authentication may be adjusted according to the total value of the NG value.

Figure 10 is a flowchart for explaining the operation procedure of a server according to an embodiment of the present disclosure, showing an example of a flowchart for performing access control by weighting multiple pieces of user state information. In step S714 shown in Figure 8, if the NG value exceeds a predetermined threshold, the case is classified according to the size of the NG value.

In step S717, the analysis unit 4 determines whether the NG value is greater than 15. If the NG value is greater than 15 (NG value > 15) in step S717, the access control unit 5 performs additional authentication (4) in step S718. Additional authentication (4) may be, for example, inputting a one-time password, obtaining approval from a superior by pressing an email link, or forcibly resetting the password.

Next, in step S719, the analysis unit 4 determines whether or not the additional authentication (4) is OK, i.e., whether or not the additional authentication (4) has been performed properly. If the additional authentication (4) is OK (Yes), in step S720, the access control unit 5 permits access. On the other hand, if the additional authentication (4) is not OK (No), in step S721, the access control unit 5 denies access.

If the NG value is 15 or less in step S717, the analysis unit 4 determines in step S722 whether the NG value is greater than 7. If the NG value is greater than 7 (7<NG value≦15) in step S722, the access control unit 5 performs additional authentication (3) in step S723. Additional authentication (3) may be, for example, entering a one-time password and obtaining approval from a superior by pressing an email link.

Next, in step S724, the analysis unit 4 determines whether or not the additional authentication (3) is OK, i.e., whether or not the additional authentication (3) has been performed properly. If the additional authentication (3) is OK (Yes), the access control unit 5 permits access in step S725. On the other hand, if the additional authentication (3) is not OK (No), the access control unit 5 denies access in step S726.

If the NG value is 7 or less in step S722, the analysis unit 4 determines in step S727 whether the NG value is greater than 3. If the NG value is greater than 3 (3<NG value≦7) in step S727, the access control unit 5 performs additional authentication (2) in step S728. Additional authentication (2) may be, for example, inputting a one-time password.

Next, in step S729, the analysis unit 4 determines whether or not the additional authentication (2) is OK, i.e., whether or not the additional authentication (2) has been performed properly. If the additional authentication (2) is OK (Yes), the access control unit 5 permits access in step S730. On the other hand, if the additional authentication (2) is not OK (No), the access control unit 5 denies access in step S731.

If the NG value is 3 or less (1<NG value≦3) in step S727, the access control unit 5 performs additional authentication (1) in step S732. Additional authentication (1) may be, for example, pressing an email link.

Next, in step S733, the analysis unit 4 determines whether or not the additional authentication (1) is OK, i.e., whether or not the additional authentication (1) has been performed properly. If the additional authentication (1) is OK (Yes), the access control unit 5 permits access in step S734. On the other hand, if the additional authentication (1) is not OK (No), the access control unit 5 denies access in step S735.

FIG. 11 shows an example of the NG value range and additional authentication in a server according to an embodiment of the present disclosure. The NG value may be larger as the number of inconsistencies not satisfied in the authentication flow increases. In this case, the larger the NG value, the higher the possibility that the user attempting to access the resource is not a legitimate user. That is, in the authentication flow, the larger the NG value, the stricter the additional authentication may be. For example, when the NG value is 3 or less and when the NG value is greater than 3 and less than 7, the additional authentication may be performed by a stricter method than the former case. Here, an example of performing four types of additional authentication is shown, but the types of additional authentication are not limited to four. When the NG value is 0 or more and 1 or less (0≦NG value≦1), the NG value is less than the threshold value (=1), so access is permitted without additional authentication.

As shown in FIG. 11, by adjusting the content of the additional authentication depending on the size of the NG value, it is possible to appropriately control access rights according to the importance of the user status information for determining whether or not access is allowed.

In the above description, an example has been described in which the server controls whether or not to permit a user to access a specific resource based on the result of the analysis of the user's status information. However, the present invention is not limited to such an example, and the access control unit 5 may control to switch the resources accessible to the user based on the analysis result by the analysis unit 4. For example, when the user's status information satisfies a first predetermined condition defined in the policy, access to the first resource may be permitted, and when the user's status information satisfies a second predetermined condition defined in the policy, access to the second resource may be permitted, thereby controlling to switch the resources accessible to the user. Specifically, for example, when a user attempts to access a file server 403 storing confidential information, if the analysis of the user's status information shows that access to the file server 403 storing the confidential information cannot be permitted, the accessible resources may be controlled to be switched so as to permit access to another file server not containing confidential information. In this way, the resources accessible to the user can be appropriately switched based on the user's status information.

REFERENCE SIGNS LIST 1 Account information acquisition unit 2 User status information acquisition unit 3 Policy storage unit 4 Analysis unit 5 Access control unit 6 Access log storage unit 7 Transmission/reception unit 21 Access time information acquisition unit 22 Location information acquisition unit 23 Personnel information acquisition unit 24 History information acquisition unit 25 Terminal information acquisition unit 100 Server 200 User terminal 201 Input unit 202 Display unit 203 Transmission/reception unit 300 Network 400 Resource 401 SaaS
402 In-house system 403 File server 404 Internet connection

Claims (7)

an account information acquisition unit that acquires account information of a user requesting access to a predetermined resource from a user terminal;
a user status information acquisition unit for acquiring user status information relating to the user's status;
a policy storage unit that stores a policy that defines a relationship between the account information and the user status information and an access right of the user to a predetermined resource;
an analysis unit that refers to the policy and analyzes whether the user is permitted to access the predetermined resource based on the account information and the user status information;
an access control unit that controls access to the predetermined resource by the user based on an analysis result by the analysis unit;
A personnel information storage unit that stores personnel information including information regarding the user's current job responsibilities;
having
the user status information acquisition unit acquires the personnel information of the user from the personnel information storage unit as the user status information;
The analysis unit further analyzes whether or not access to the predetermined resource is possible based on the personnel information.
A server comprising: The server according to claim 1 , wherein the analysis unit analyzes whether or not the predetermined resource can be accessed based on a plurality of pieces of user status information. The user state information acquisition unit further acquires, as the user state information, at least one of (a) location information regarding a location where the user is present, (b) access time information regarding a time when the user is requesting access, (c) history information regarding a behavior history of the user, or (d) terminal information regarding a terminal used by the user;
The server according to claim 1 , wherein the analysis unit analyzes whether or not the predetermined resource can be accessed based on the user status information. The analysis unit includes:
a learning model trained using history information on the behavioral histories of a plurality of users and data indicating whether each piece of history information complies with the policy as learning data, the learning model receiving an input of a behavioral history of a user who has attempted to access a resource and outputting whether the behavioral history complies with the policy;
The server of claim 1. The analysis unit includes:
weighting the values to be accumulated when each of the plurality of pieces of user status information does not satisfy the access permission condition according to the importance of each of the plurality of pieces of user status information;
determining whether each of the plurality of pieces of user state information satisfies the access permission condition;
determining whether or not to permit access based on whether or not the integrated value of the values exceeds a predetermined threshold;
the access control unit selects an authentication method having an appropriate level from among a plurality of additional authentication methods according to the integrated value, and performs additional authentication for access permission.
The server of claim 1 . A system having a user terminal and a server,
The user terminal,
an input section for inputting account information of a user requesting access;
a transceiver unit that transmits a signal requesting access to a specific resource, and receives information regarding whether or not the user can access the specific resource based on an analysis result of analyzing whether or not the user can access the specific resource based on the account information and the user status information by referring to a policy that defines a relationship between the account information, user status information regarding the status of the user, and the user's access authority to the specific resource;
having
The server,
an account information acquisition unit that acquires account information of a user requesting access to a predetermined resource from a user terminal;
a user status information acquisition unit for acquiring user status information relating to the user's status;
a policy storage unit that stores a policy that defines a relationship between the account information and the user status information and an access right of the user to a predetermined resource;
an analysis unit that refers to the policy and analyzes whether the user is permitted to access the predetermined resource based on the account information and the user status information;
an access control unit that controls access to the predetermined resource by the user based on an analysis result by the analysis unit;
A personnel information storage unit that stores personnel information including information regarding the user's current job responsibilities;
having
the user status information acquisition unit acquires the personnel information of the user from the personnel information storage unit as the user status information;
The analysis unit further analyzes whether or not access to the predetermined resource is possible based on the personnel information.
A system characterized by: The server
Acquire account information of a user requesting access to a specific resource from the user terminal;
obtaining user status information relating to a status of the user;
storing a policy that defines a relationship between the account information and the user status information and the user's access authority to a predetermined resource;
Analyzing whether the user is allowed to access the predetermined resource based on the account information and the user status information by referring to the policy;
Controlling access to the predetermined resource by the user based on the analysis result;
storing personnel information including information regarding the user's current job responsibilities;
acquiring the personnel information of the user as the user status information;
and analyzing whether or not the predetermined resource can be accessed based on the personnel information.
13. An access control method comprising:

Images