JP7556097B2 - Access Management Methods - Google Patents

Description

The present invention relates to data processing technology, and in particular to technology for managing user access to information processing devices.

As network technology advances, access to computer systems via networks has become widespread. Password authentication is widely used as a means of authentication when a user logs into a computer system. Measures to increase the security of password authentication include forcing users to change their passwords after a certain period of time has passed, and refusing subsequent login attempts if the user fails to enter the password a certain number of times in a row.

In the following Patent Document 1, the applicant proposes a technology that makes it easy to detect unauthorized access without reducing ease of use for legitimate users.

JP 2006-004333 A

Conventional password authentication requires users to disclose the password of the information processing device on which they are to perform work (hereafter also referred to as the "target device"). This can pose a security risk to the target device. For example, there is a possibility that the password of the target device may be leaked from a legitimate user to a malicious third party.

The present invention was made in consideration of these problems, and its main purpose is to provide technology for reducing security risks in information processing devices.

In order to solve the above problem, an access management method according to one aspect of the present invention includes a step of storing in a first storage area in association with a user the work conditions for the work target device, which are login IDs for logging in to the work target device and include a login ID corresponding to a predetermined account, and which are work conditions permitted by an administrator; an authentication step of determining that the user has been successfully authenticated if the user's account specified in a connection request to the device received from the user's terminal matches the user's account previously stored in the account storage area; a step of providing a login destination designation screen to the terminal of the user who has been successfully authenticated in the authentication step; a login request acceptance step of accepting from the user's terminal a login request including information on the login target work target device designated on the designation screen; and a login step of enabling the user to work on the login target work target device when the login request is accepted by logging in to the login target work target device using a login ID and password for logging in to the login target work target device previously stored in a second storage area, which login ID and password correspond to the login ID specified in the work conditions stored in the first storage area.

In addition, any combination of the above components, or any expression of the present invention converted between a system, a program, or a recording medium storing a program, is also valid as an aspect of the present invention.

The present invention can reduce security risks for information processing devices.

FIG. 1 illustrates a configuration of an information processing system according to an embodiment. 2 is a block diagram showing a functional configuration of the access management device of FIG. 1 . 10 is a flowchart showing the operation of the access management device. 10 is a flowchart showing the operation of the access management device.

Figure 1 shows the configuration of an information processing system according to an embodiment. The information processing system 100 is a system within a certain company, and includes an operator terminal 10, an administrator terminal 12, work target devices 14a, 14b, and 14c, collectively referred to as work target devices 14, and an access management device 16.

The operator terminal 10 is a PC operated by an operator or developer (hereafter referred to as the operator) of the information processing system 100 who is to perform work on the work target device 14. The administrator PC 12 is a PC operated by the administrator of the information processing system 100.

The work target device 14 is a server that is the target of work (e.g., updating files, adjusting various settings, etc.) by the operator of the information processing system 100. For example, it may be a web server, application server, database server, etc. Furthermore, there is no restriction on the software configuration of the work target device 14, and the configurations may differ between the work target devices 14a to 14c. For example, the OS of the work target device 14a may be UNIX (registered trademark), the OS of the work target device 14b may be Linux (registered trademark), and the OS of the work target device 14c may be Windows (registered trademark). Furthermore, there is no restriction on the communication protocol for notifying commands from the operator PC 10 to the work target device 14, and it may be Telnet, SSH, FTP, RDP, etc.

The access management device 16 accepts login requests from the operator for multiple work target devices 14 (work target devices 14a to 14c in FIG. 1) all at once, regardless of the type of work target device 14, and determines whether the operator's login has been approved by the administrator. If approved, the access management device 16 logs into the work target device 14 on behalf of the operator, and relays commands sent from the operator PC 10 to the work target device 14. In other words, by mediating access from the operator PC 10 to the work target device 14, the access management device 16 increases the security strength of the work target device 14 while enabling the operator to perform work on the work target device 14.

Figure 2 is a block diagram showing the functional configuration of the access management device 16 of Figure 1. The access management device 16 includes an internal account storage unit 20, an external account storage unit 22, an account update unit 24, an operation condition storage unit 26, an application information reception unit 28, an application information notification unit 30, an approval information reception unit 32, a connection request reception unit 34, an authentication processing unit 36, a login request reception unit 38, a judgment unit 40, a login processing unit 42, a command reception unit 44, and a command transfer unit 46.

Each block shown in the block diagrams in this specification can be realized in hardware terms by elements and mechanical devices such as a computer CPU, and in software terms by a computer program, etc., but here, functional blocks realized by the cooperation of these are depicted. Therefore, those skilled in the art will understand that these functional blocks can be realized in various ways by combining hardware and software. For example, each functional block in Figure 2 may be stored on a recording medium as an access management program and installed in the storage of the access management device 16. Then, when the access management program is started, the program corresponding to each functional block may be read into the main memory and executed by the CPU.

The internal account storage unit 20 is a storage area that stores a predetermined operator's ID and password in association with an account (hereinafter also referred to as an "internal account") for permitting the operator to connect to the access management device 16 from the operator PC 10.

The external account storage unit 22 is a storage area that stores accounts (specifically, combinations of login IDs and passwords) that are predefined in the work target device 14 as accounts (hereinafter also referred to as "external accounts") for permitting connection to the work target device 14. For example, it stores all the external accounts defined in each of the work target devices 14a to 14c. The external account storage unit 22 also stores the accounts of privileged users of the work target device 14 as external accounts, and stores, for example, the root password and the Administrator password.

When the login account is changed in the work target device 14, the account update unit 24 detects this fact and stores the changed account in the external account storage unit 22. For example, the work target device 14 may periodically change the login account in its own device and notify the access management device 16 of information indicating the changed account, and the work target device 14 may detect the change in the account in the work target device 14 based on the notification. As a variant, the account update unit 24 may periodically access the work target device 14 to change the login account and store the changed account in the external account storage unit 22.

The work condition storage unit 26 is a memory area that stores conditions (hereinafter also referred to as "work conditions") for permitting the operator to log in to the work target device 14, and stores, for example, the work conditions for each of the work target devices 14a to 14c collectively. In this embodiment, the work conditions include the operator's ID, the work start date and time and the work end date and time for the work target device 14, the host name of the work target device 14, the communication protocol to be used, and the login ID (e.g., root) used to log in to the work target device 14.

The application information receiving unit 28 receives information (hereinafter also referred to as "application information") for applying to the administrator for login to the work target device 14 from the operator PC 10. This application information includes the same contents as the work conditions described above. That is, it includes the operator's ID, the work start date and time, the work end date and time, the host name of the work target device 14, the communication protocol to be used, and the login ID to be used for logging in to the work target device 14.

The application information notification unit 30 transmits the application information received from the operator PC 10 to the administrator PC 12, and allows the administrator to decide whether to approve or reject the application content of the operator. The approval information receiving unit 32 receives information from the administrator PC 12 indicating whether the administrator has approved the application content. If the administrator has approved the application content, the approval information receiving unit 32 stores the application content of the operator as a work condition in the work condition storage unit 26.

The connection request reception unit 34 receives a connection request from the operator PC 10 to the access management device 16. In this connection request, the operator's account (i.e., an internal account) defined in the access management device 16 is specified. The communication protocol between the operator PC 10 and the access management device 16 may be appropriately selected by the operator, and may be, for example, Telnet, SSH, FTP, RDP, etc.

The authentication processing unit 36 authenticates the operator. Specifically, it determines whether the operator's account specified in the connection request matches the operator's account stored in the internal account storage unit 20. If they match, it notifies the connection request receiving unit 34 that the authentication of the operator was successful. If the authentication of the operator is successful, the connection request receiving unit 34 establishes a communication session with the operator PC 10 and notifies the operator PC 10 of the success of the authentication. When the operator PC 10 is notified of the success of the authentication, it displays on the display a designated screen of the work target device 14 to be the login destination (in other words, the work target device 14 on which the operator performs work). As a variant, if the authentication of the operator is successful, the connection request receiving unit 34 may send data of the designated login screen to the operator PC 10 and display it on the operator PC 10.

The login request receiving unit 38 receives information (hereinafter also referred to as a "login request") requesting login to a specific work target device 14 from the operator PC 10 via a communication session between the operator PC 10 and the access management device 16 established by the connection request receiving unit 34. This login request includes information indicating the work target device 14 (hereinafter also referred to as a "designated device") that is the login destination specified by the operator on the login destination designation screen displayed on the operator PC 10. On the other hand, the account (e.g., password) of the designated device is not included in the login request.

The determination unit 40 determines whether the login request satisfies the work conditions stored in the work condition storage unit 26. Specifically, if the ID of the operator who sent the login request matches the ID of the operator of the work conditions, the reception date and time of the login request is within the range from the work start time to the work end time of the work conditions, and the specified device in the login request matches the connected device of the work conditions, it is determined that the login request satisfies the work conditions.

When the login processing unit 42 determines that the login request satisfies the work conditions, it logs in to the designated device using the account of the designated device stored in the external account storage unit 22, even if the account of the designated device is not included in the login request, and establishes a communication session between the access management device 16 and the designated device. Specifically, it obtains from the external account storage unit 22 an account (a login ID and a password, for example, root and a root password) that is a predetermined account in the designated device and corresponds to the login ID specified in the work conditions. Then, it transmits a login request specifying the account obtained from the external account storage unit 22 to the designated device using the communication protocol specified in the work conditions.

The command reception unit 44 receives commands for the designated device from the operator PC 10 via the communication session between the operator PC 10 and the access management device 16 established by the connection request reception unit 34. The command transfer unit 46 transfers the command received by the command reception unit 44 to the designated device via the communication session between the access management device 16 and the designated device established by the login processing unit 42.

The operation of the above configuration will now be described.
3 is a flowchart showing the operation of the access management device 16. When the application information receiving unit 28 receives the application information sent from the operator PC 10 (Y in S10), the application information notification unit 30 transmits the application information to the administrator PC 12 (S12). When the approval information receiving unit 32 receives information from the administrator PC 12 indicating that the application contents have been approved (Y in S14), it stores the application contents as work conditions in the work condition storage unit 26 (S16). When the approval information receiving unit 32 does not receive information indicating that the application contents have been approved (N in S14), S16 is skipped. When the application information is not received from the operator PC 10 (N in S10), S12 to S16 are skipped. When the account update unit 24 detects that an account has been changed in the work target device 14 (Y in S18), it acquires the changed account from the work target device 14 and stores it in the external account storage unit 22 (S20). When an account change in the work target device 14 has not been detected (N in S18), S20 is skipped.

Figure 4 is also a flowchart showing the operation of the access management device 16. This figure shows a continuation of the operation of Figure 3. When the connection request receiving unit 34 receives a connection request sent from the operator PC 10 (Y in S30), the authentication processing unit 36 authenticates the operator based on the connection request. If the authentication of the operator is successful (Y in S32), the connection request receiving unit 34 notifies the operator PC 10 of this fact and causes the operator PC 10 to display a login destination designation screen (S34). If the authentication of the operator fails (N in S32), S34 is skipped, and if the connection request from the operator PC 10 is not accepted (N in S30), S32 and S34 are skipped.

When the login request receiving unit 38 receives a login request sent from the operator PC 10 (Y in S36), the determination unit 40 determines whether the login request satisfies the work conditions. If the login request satisfies the work conditions (Y in S38), the login processing unit 42 obtains the account of the specified device in the login request from the external account holding unit 22 (S40), and logs in to the specified device using that account (S42).

The command reception unit 44 waits until it receives a command from the operator PC 10 (N in S44). When the command reception unit 44 receives the command sent from the operator PC 10 (Y in S44), the command transfer unit 46 transmits the command to the work target device 14 (S46). If the command received from the operator PC 10 is an exit command (e.g., an "exit" command) (Y in S48), the command reception unit 44 disconnects the communication session with the operator PC 10 and ends the flow of this figure. If the command received from the operator PC 10 is not an exit command (N in S48), the flow returns to the command waiting state of S44. If the login request does not satisfy the work conditions (N in S38) or if the login request is not received (N in S36), the subsequent processing is skipped and the flow of this figure ends.

According to the information processing system 100 of this embodiment, the access management device 16 logs in to the work target device 14 on behalf of the operator or developer. Therefore, the account (particularly the password) of the work target device 14 can be kept secret from the operator or developer, and the security risk of the work target device 14 can be reduced. For example, it is possible to prevent the account from being leaked by the operator or developer to a malicious third party, and to prevent the operator or developer from accessing the work target device 14 beyond the scope approved by the administrator. According to the information processing system 100, not only can it be discovered after the fact whether or not unauthorized access has occurred based on the access log of the work target device 14, but it can also prevent unauthorized access from occurring in the first place.

The login account for the work target device 14 is also periodically changed and stored in the external account storage unit 22 of the access management device 16. This can further reduce the security risk of the work target device 14. In addition, the impact of changes to the login account for the work target device 14 is absorbed by the access management device 16, and the operator and developer are not affected by this, which can increase convenience for the operator and developer.

In addition, because the access management device 16 centrally controls access to the work target device 14, the work target device 14 does not need to predefine individual accounts for multiple operators and developers. In addition, there is no need to set various access rights for these individual accounts. Therefore, the security risks of the work target device 14 can be reduced without modifying the work target device 14.

The present invention has been described above based on an embodiment. This embodiment is merely an example, and those skilled in the art will understand that various modifications are possible in the combination of each component and each processing process, and that such modifications are also within the scope of the present invention. Modifications are shown below.

A first modified example will be described. Although not mentioned in the above embodiment, the command receiving unit 44 may monitor whether the current date and time has passed the work end date and time specified in the work conditions, and if so, may disconnect the communication session between the operator PC 10 and the access management device 16. Similarly, the command forwarding unit 46 may monitor whether the current date and time has passed the work end date and time specified in the work conditions, and if so, may disconnect the communication session between the access management device 16 and the work target device 14. According to this embodiment, after the work end date and time has passed, commands from the operator are no longer forwarded to the work target device 14, so that the operator can be permitted to perform work within the scope approved by the administrator.

As another variation, the command receiving unit 44 may maintain the communication session between the operator PC 10 and the access management device 16 even if the current date and time has passed the work end date and time of the work conditions. Similarly, the command forwarding unit 46 may maintain the communication session between the access management device 16 and the work target device 14 even if the current date and time has passed the work end date and time of the work conditions. Furthermore, the operator may be able to select whether to disconnect or maintain the communication session when the current date and time has passed the work end date and time of the work conditions, and the result of the selection by the operator may be included in the application information (i.e., the work conditions). In this case, the command receiving unit 44 and the command forwarding unit 46 may determine whether to disconnect or maintain the communication session when the current date and time has passed the work end date and time of the work conditions according to the work conditions.

A second modified example will be described. The access management device 16 may further include a log storage unit, a log output unit, and a log search unit. The log storage unit stores a log that associates the operator's internal account, the host name of the work target device 14 at the login destination, the login account (external account) to the work target device 14, the command issued to the work target device 14, and the command issuance date and time. When login to the work target device 14 is performed in response to a login request, the log output unit stores the operator's internal account, the host name of the work target device 14 at the login destination, and the login account to the work target device 14 as login information. Then, when a command is accepted from the operator PC 10 by the command acceptance unit 44, the command, login information, and the current date and time (i.e., the command issuance date and time) are associated and stored in the log storage unit.

The log search unit receives a search request with a specified search keyword from the administrator PC 12. Then, it searches the logs stored in the log storage unit based on the search keyword, and transmits information on the logs found in the search to the administrator PC 12. According to the second modified example, the access management device 16 collectively manages the access logs across multiple work target devices 14, so that the administrator can easily obtain the access logs across multiple work target devices 14. For example, by making a search request to the access management device 16 using the ID (specific internal account) of a specific operator as a search keyword, it is possible to efficiently obtain the history of accesses made by a specific operator to multiple work target devices 14 without inquiring of each work target device 14.

A third modified example will be described. The access management device 16 may further include a prohibited command storage unit and a command determination unit. The prohibited command storage unit stores information indicating prohibited commands that are predetermined as commands that should be prohibited from being issued to the work target device 14. The prohibited commands may include, for example, a command to change a user's password (such as a passwd command) or a command to switch a user's account (such as a su command). The command determination unit determines whether or not the command accepted from the operator PC 10 matches the prohibited command stored in the prohibited command storage unit. If they do not match, the command determination unit passes the command accepted from the operator PC 10 to the command transfer unit 46. If they match, the command determination unit prevents the command accepted from the operator PC 10 from being passed to the command transfer unit 46 and discards it. In this case, the command determination unit may notify the operator PC 10 that the command is a prohibited command and therefore the transfer to the work target device 14 has been refused.

Note that in the second and third modified examples, a case where encrypted communication is used between the operator PC 10 and the access management device 16 and between the access management device 16 and the work target device 14 (e.g., SSH communication) is used. In this case, the access management device 16 first decrypts the encrypted command received from the operator PC 10, then re-encrypts the decrypted plaintext command and sends it to the work target device 14. Therefore, the log output unit in the second modified example stores a log indicating the plaintext command in the log storage unit, and the command determination unit in the third modified example compares the plaintext command with a prohibited command. In this way, the security strength is maintained on the communication path by encrypted communication, while saving commands and comparing them with prohibited commands can be achieved using plaintext commands.

A fourth modified example will be described. In the above embodiment, the access management device 16 is provided with the external account holding unit 22 and the account update unit 24. As a modified example, an information processing device other than the access management device 16 (also referred to here as an "account management device") may be provided with the external account holding unit 22 and the account update unit 24 in place of the access management device 16, and may further be provided with an external account providing unit. In this case, the login processing unit 42 of the access management device 16 transmits to the account management device a password request that specifies the host name of the work target device 14 to be logged in and the login ID of the work target device 14 to be used for login. The external account providing unit of the account management device provides the access management device 16 with a password associated with the login ID specified in the password request.

Any combination of the above-mentioned embodiments and modifications is also useful as an embodiment of the present invention. A new embodiment resulting from the combination has the combined effects of each of the combined embodiments and modifications.

It will be understood by those skilled in the art that the functions to be performed by each of the constituent elements described in the claims can be realized by each of the constituent elements shown in the embodiments and modifications alone or in combination with each other.

10 Operator PC, 12 Administrator PC, 14, 16 Access management device, 20 Internal account storage unit, 22 External account storage unit, 24 Account update unit, 26 Work condition storage unit, 34 Connection request reception unit, 36 Authentication processing unit, 38 Login request reception unit, 40 Determination unit, 42 Login processing unit, 44 Command reception unit, 46 Command transfer unit, 100 Information processing system.

Claims (1)

The access control device comprises:
a step of storing in a first storage area work conditions for the work target device, the work conditions including a login ID for logging in to the work target device, the work conditions being applied for from a user's terminal and approved by an administrator, in association with the user;
an authentication step of determining that the user authentication has been successful when a user account specified in a connection request to the device received from the user's terminal matches a user account previously stored in the account storage area;
providing a login destination designation screen to a terminal of a user who has been successfully authenticated in the authentication step;
a login request receiving step of receiving, from a user's terminal, a login request including information on a work target device that is a login destination and that is specified on the specification screen;
a login step of enabling a user to work on the work target device of the login destination by logging in to the work target device of the login destination using a login ID and a password for logging in to the work target device of the login destination, which are stored in advance in a second storage area when the login request accepted in the login request acceptance step satisfies the work condition pre-stored in the first storage area, and which correspond to the login ID specified in the work condition satisfied by the login request;
Run
The work conditions can specify a login ID of a privileged user of the work target device,
the login ID for logging in to the work target device of the login destination stored in the second storage area includes the login ID of the privileged user;
An access management method characterized in that the password for logging in to the work target device of the login destination stored in the second memory area includes the password of the privileged user and is kept secret from the user.

Images