JP4420966B2 - Computer system and access right setting method thereof - Google Patents

Description

  The present invention relates to a computer system and an access right setting method thereof, and more particularly to a technique for ensuring security when a client computer accesses a server computer via a network.

  Currently, computers are generally connected to each other using a network, and network networks incorporating hubs, LAN switches, routers, etc. are built not only in companies but also in general households. It has become like this. In general, a company generally constructs a dedicated network such as an in-house LAN or WAN, and uses a server computer having various functions connected to the network according to the business form of each division. It is. Each employee connects a client computer such as a personal computer to this network, and performs business while exchanging data with the server computer.

  In operating such a computer system using a network, security management is very important. In other words, each computer connected to the network is not only protected from unauthorized access by external hackers, but even if it belongs to the same company, each computer has its own access depending on its affiliation and responsibility. Operations that impose restrictions are essential.

Accordingly, various security management techniques in computer systems using a network have been proposed. For example, Patent Documents 1 and 2 listed below disclose techniques for managing access rights unique to each individual user in a computer system in which a client computer and a server computer are network-connected. .
JP 2000-10930 A JP 2003-122635 A

  The conventional security management methods, including the technology disclosed in the above-mentioned patent publications, are all based on the basic idea that a predetermined access right is set for each individual user. In other words, a predetermined account (user name) and password are assigned to each user, a predetermined access right is set for each account, and if there is a login procedure for a specific account, Generally, after confirming that the login procedure is authorized by verification, an operation of permitting access within the scope of the access right set for the account is generally performed.

  In this way, the basic policy of setting specific access rights for each individual user is a very rational method from a global perspective, but the contents of business forms using computer systems are becoming increasingly complex. In recent years, there are many cases where such basic policies cannot always be met. In particular, companies with a large number of employees cannot completely deny the existence of employees who engage in fraudulent activities. It is dangerous to give access rights.

  Therefore, an object of the present invention is to provide a computer system that can set different access rights to individual users according to the situation (according to the computer to be used and the network environment).

(1) A first aspect of the present invention is to use a network, a server computer connected to the network, a plurality of client computers connectable to the network, and the client computer In a computer system comprising a portable information recording medium issued to an individual user,
In each portable information recording medium, environmental information indicating a specific network environment obtained when a client computer is connected to a specific part of the network is recorded.
Each client computer has an interface means for connecting a portable information recording medium, a network environment indicated by environmental information recorded on the currently connected portable information recording medium, and its own current network environment. An environment verification means for verifying, an access right setting means for selectively setting one of a plurality of access rights whose scope of access rights is determined in advance based on the verification result, and Server access means for accessing the server computer within the range is provided.

(2) According to a second aspect of the present invention, a network, a server computer connected to the network, a plurality of client computers connectable to the network, and a connection to the client computer are used. In a computer system comprising a portable information processing device issued to an individual user,
Each portable information processing device records environment information indicating a specific network environment obtained when a client computer is connected to a specific location of a network network,
Interface means for connecting a portable information processing device to each client computer, and server access means for accessing the server computer within the scope of access rights transmitted from the currently connected portable information processing device , And
The portable information processing apparatus includes an environment verification means for verifying the network environment of the currently connected client computer and the network environment indicated by the environment information recorded in itself, and an access right based on the verification result. An access right setting means for selectively setting any one of a plurality of access rights with a range defined, and an access right transmission means for transmitting the set access right to the currently connected client computer It is what I did.

(3) According to a third aspect of the present invention, in the computer system according to the first or second aspect described above,
The IP address assigned to the client computer, the default gateway address set for the client computer, the proxy server address set for the client computer, or the domain name that can be queried by the DNS server used by the client computer This is used as environment information indicating the network environment.

(4) According to a fourth aspect of the present invention, a network, a server computer connected to the network, a plurality of client computers connectable to the network, and a connection to the client computer are used. In a computer system comprising a portable information recording medium issued to an individual user,
Each client computer is recorded with a unique identification code that can be distinguished from other client computers.
Each portable information recording medium includes an identification code corresponding to a specific identification code recorded on a specific client computer, and a specific network environment obtained when the client computer is connected to a specific location on the network. Record environmental information indicating
Each client computer is collated with an interface means for connecting a portable information recording medium, an identification code recorded on the currently connected portable information recording medium, and an identification code recorded on itself. Based on these verification results, an identification code verification means, an environment verification means for verifying the network environment indicated by the environmental information recorded on the currently connected portable information recording medium and the current network environment of itself. Access right setting means for selectively setting one of a plurality of access rights whose access right range is determined in advance, and server access means for accessing the server computer within the set access right range, Are provided.

(5) According to a fifth aspect of the present invention, a network, a server computer connected to the network, a plurality of client computers connectable to the network, and a connection to the client computer are used. In a computer system comprising a portable information processing device issued to an individual user,
Each client computer is recorded with a unique identification code that can be distinguished from other client computers.
Each portable information processing device includes an identification code corresponding to a specific identification code recorded in a specific client computer, and a specific network environment obtained when the client computer is connected to a specific location on the network. Record environmental information indicating
Interface means for connecting a portable information processing device to each client computer, and server access means for accessing the server computer within the scope of access rights transmitted from the currently connected portable information processing device , And
The portable information processing apparatus includes an identification code collating means for collating an identification code recorded on a currently connected client computer with an identification code recorded on itself, and a network environment of the currently connected client computer And an environment collation means for collating the network environment indicated by the environment information recorded in itself, and any one of a plurality of access rights whose access rights are defined in advance based on the collation result Access right setting means for selectively setting and access right transmitting means for transmitting the set access right to the currently connected client computer are provided.

(6) According to a sixth aspect of the present invention, a network network, a server computer connected to the network network, a plurality of client computers connectable to the network network, and a connection to the client computer are used. In a method of setting an access right when an individual user accesses a server computer using a client computer, for a computer system comprising a portable information recording medium issued to the individual user,
A preparatory stage in which the portable information recording medium internally records environmental information indicating a specific network environment obtained when the client computer is connected to a specific part of the network;
When a user connects a predetermined portable information recording medium issued to the user to a predetermined client computer and performs a use start procedure for the predetermined client computer, the predetermined client computer A plurality of client computers whose current access rights are determined in advance and the network environment indicated by the environment information recorded in the predetermined portable information recording medium is collated. An access rights setting phase that selectively sets one of the access rights for
In the access right setting stage, if the predetermined client computer does not match the matching result, the access right is set with more restrictions than when the matching result matches. Is.

(7) According to a seventh aspect of the present invention, a network network, a server computer connected to the network, a plurality of client computers connectable to the network, and a connection to the client computer are used. In a method for setting an access right when an individual user accesses a server computer using a client computer, for a computer system comprising a portable information processing apparatus issued to the individual user,
A preparatory stage in which the portable information processing device internally records environmental information indicating a specific network environment obtained when the client computer is connected to a specific location of the network;
When a user connects a predetermined portable information processing apparatus issued to the user to a predetermined client computer and performs a use start procedure for the predetermined client computer, the predetermined portable information processing apparatus The current network environment of the predetermined client computer is collated with the network environment indicated by the environment information recorded in the predetermined portable information processing apparatus, and the range of access rights is determined in advance based on the collation result. An access right setting stage for selectively setting one of a plurality of access rights ,
In the access right setting step, if the predetermined portable information processing device does not match the collation result, it sets the access right with more restrictions than when the collation result matches. It is what I do.

(8) According to an eighth aspect of the present invention, a network network, a server computer connected to the network network, a plurality of client computers connectable to the network network, and a connection to the client computer are used. In a method of setting an access right when an individual user accesses a server computer using a client computer, for a computer system comprising a portable information recording medium issued to the individual user,
The portable information recording medium includes an identification code corresponding to a unique identification code recorded on a specific client computer and capable of identifying the specific client computer from other client computers, and the client A preparatory stage for internally recording environmental information indicating a specific network environment obtained when the computer is connected to a specific part of the network;
When a user connects a predetermined portable information recording medium issued to the user to a predetermined client computer and performs a use start procedure for the predetermined client computer, the predetermined client computer The identification code recorded on the client computer and the identification code recorded on the predetermined portable information recording medium, and the current network environment of the predetermined client computer and the predetermined portable information recording Access that collates with the network environment indicated by the environment information recorded on the medium, and selectively sets one of a plurality of access rights whose scope of access rights is determined in advance based on these collation results Right setting stage,
In the access right setting step, the predetermined client computer sets the first access right if the identification code verification result matches, and the identification code verification result does not match, but the network environment verification result If the two match, the second access right having more restrictions than the first access right is set, and if any of the collation results do not match, there are more restrictions than the second access right. A third access right is set.

(9) According to a ninth aspect of the present invention, a network, a server computer connected to the network, a plurality of client computers connectable to the network, and a connection to the client computer are used. In a method for setting an access right when an individual user accesses a server computer using a client computer, for a computer system comprising a portable information processing apparatus issued to the individual user,
An identification code corresponding to a unique identification code recorded in a specific client computer and capable of identifying the specific client computer from other client computers, and the portable information processing apparatus, A preparatory stage for internally recording environmental information indicating a specific network environment obtained when the computer is connected to a specific part of the network;
When a user connects a predetermined portable information processing apparatus issued to the user to a predetermined client computer and performs a use start procedure for the predetermined client computer, the predetermined portable information processing apparatus The identification code recorded in the predetermined client computer is collated with the identification code recorded in the predetermined portable information processing apparatus, and the current network environment of the predetermined client computer and the predetermined portable The network environment indicated by the environment information recorded in the information processing apparatus is collated, and one of a plurality of access rights whose access rights are defined in advance is selectively selected based on the collation result The access right setting stage to be set,
In the access right setting stage, the predetermined portable information processing apparatus sets the first access right when the verification result of the identification code matches, and the verification result of the identification code does not match, but the network environment If the collation results match, the second access right with more restrictions than the first access right is set, and if any collation results do not match, further restrictions than the second access right are set. The third access right with a large amount is set.

(10) According to a tenth aspect of the present invention, a network, a server computer connected to the network, a plurality of client computers connectable to the network, and a connection to the client computer are used. In a method of setting an access right when an individual user accesses a server computer using a client computer, for a computer system comprising a portable information recording medium issued to the individual user,
The portable information recording medium includes an identification code corresponding to a unique identification code recorded on a specific client computer and capable of identifying the specific client computer from other client computers, and the client A preparatory stage for internally recording environmental information indicating a specific network environment obtained when the computer is connected to a specific part of the network;
When a user connects a predetermined portable information recording medium issued to the user to a predetermined client computer and performs a use start procedure for the predetermined client computer, the predetermined client computer The identification code recorded on the client computer and the identification code recorded on the predetermined portable information recording medium, and the current network environment of the predetermined client computer and the predetermined portable information recording Access that collates with the network environment indicated by the environment information recorded on the medium, and selectively sets one of a plurality of access rights whose scope of access rights is determined in advance based on these collation results Right setting stage,
In the access right setting step, the predetermined client computer sets a first access right when both the collation result by the identification code collating means and the collation result by the environment collating means match, and the identification code If the collation results by the collation means match but the collation results by the environment collation means do not match, the second access right, which has more restrictions than the first access right, is set, and none of the collation results match In this case, the third access right, which is more restrictive than the second access right, is set.

(11) An eleventh aspect of the present invention is to use a network, a server computer connected to the network, a plurality of client computers connectable to the network, and the client computer In a method for setting an access right when an individual user accesses a server computer using a client computer, for a computer system comprising a portable information processing apparatus issued to the individual user,
An identification code corresponding to a unique identification code recorded in a specific client computer and capable of identifying the specific client computer from other client computers, and the portable information processing apparatus, A preparatory stage for internally recording environmental information indicating a specific network environment obtained when the computer is connected to a specific part of the network;
When a user connects a predetermined portable information processing apparatus issued to the user to a predetermined client computer and performs a use start procedure for the predetermined client computer, the predetermined portable information processing apparatus The identification code recorded in the predetermined client computer is collated with the identification code recorded in the predetermined portable information processing apparatus, and the current network environment of the predetermined client computer and the predetermined portable The network environment indicated by the environment information recorded in the information processing apparatus is collated, and one of a plurality of access rights whose access rights are defined in advance is selectively selected based on the collation result The access right setting stage to be set,
In the access right setting stage, the predetermined portable information processing device sets the first access right when both the verification result by the identification code verification unit and the verification result by the environment verification unit match. If the collation result by the identification code collating means matches, but the collation result by the environment collating means does not match, the second access right, which has more restrictions than the first access right, is set. If not, the third access right, which has more restrictions than the second access right, is set.

  According to the computer system of the present invention, whether or not the client computer used by the user is a specific client computer prepared for the user, or the specific computer prepared for the user. Since it is possible to set access rights by recognizing whether or not the network environment is present, it is possible to set different access rights for individual users depending on the situation.

  Hereinafter, the present invention will be described based on the illustrated embodiments.

<<< §0. Background for introducing the present invention >>>
First, the background for introducing the present invention will be described with reference to the example shown in FIG. FIG. 1 shows a computer system configured by connecting two server computers 110, 120 and eight client computers 11, 12, 13, 14, 21, 22, 23, 31 to a network 100. It is a block diagram which shows a model. In a computer system used in a general company, a larger number of server computers and a larger number of client computers are usually used. Here, for the sake of convenience, the illustrated simple model will be described. To do.

  The network 100 is usually composed of a number of routers and various lines connecting between them. In general, there are various forms of networks such as LAN, WAN, and the Internet, but the network 100 may be configured in any form. In the figure, the network 100 and each client computer are connected by lines, but it is not always necessary to connect them by wire, and a wireless LAN may be used.

  Here, for convenience of explanation, it is assumed that this computer system is a system used in a certain company, and the client computers 11, 12, 13, and 14 are installed in the personnel department 10 of this company. Assume that the client computers 21, 22, and 23 are installed in the common room 20 of this company, and the client computer 31 is installed in one room of the employee dormitory 30 of this company. Further, let us say that one employee belonging to the personnel department is called user A, and the client computer 11 is installed on the desk of the user A in the personnel department 10. In other words, the client computer 11 is provided with the client computer 11 from the company, and the user user performs daily work by operating the client computer 11 while facing the user's desk.

  On the other hand, various data related to the business of this company are stored in the server computers 110 and 120, and each employee accesses the server computers 110 and 120 from the client computer as necessary. Processing such as data reading, writing, and modification is performed. Here, for convenience of explanation, general-purpose business data that should be allowed to be accessed by all employees is stored in the server computer 110, and the server computer 120 is accessed only by employees belonging to a specific department. Let's assume that sensitive private business data that should be kept is stored.

  Of course, in managing such a computer system, security management is important. In the conventional general security management method, an operation is performed in which each individual employee is set with a unique access right according to their affiliation and responsibility. In the case of the above-described example, for example, the user who is a personnel department member is permitted to read the general-purpose business data in the server computer 110 and to read / write the personnel-dedicated business data in the server computer 120. Access right to be set.

  As described above, in order to perform access right management for each user, a predetermined account (user name) and a password are usually given to each user, and a predetermined access right is set for each account. If there is a login procedure with a specific account, after confirming that this login procedure is genuine by verifying the password, access is permitted within the scope of the access right set for the account. , Operation is performed. For example, in the above-mentioned example, when the user A who is a personnel department member starts the client computer 11 installed on his / her desk and performs a procedure for starting use, an operation for inputting a predetermined account and password is performed. Will be required. If the account and password entered here are authenticated as authentic, then access to the server computers 110 and 120 is possible within the range of access rights set in advance for the user A.

  A general security management technique conventionally performed is based on a basic policy of setting a specific access right for each individual user as in the above-described example. Of course, security management based on such a basic policy is very reasonable if it is assumed that individual employees (users) will always perform their business in good faith. However, in a company with a large number of employees, it is necessary to perform security management in consideration of the possibility of employee misconduct.

  For example, suppose there is a rule that the personnel department's tacit understanding is that each employee's salary details must not be shown to other departments. In the above example, since the user A who is the personnel department is given the access right to the personnel department-dedicated business data in the server computer 120, the user A is the screen of the client computer 11 on his / her desk. Above, it is possible to display individual employee salary details and view them on the spot. However, in such a situation, it is unlikely that an act that breaks the above implicit understanding will be performed. At least the room where the client computer 11 is installed is packed with other personnel from the Human Resources Department and will be supervised by the boss, so call friends from other departments to the side of your desk. Therefore, it is difficult to think of an act of browsing the pay statement displayed on the client computer 11.

  However, if the user A is resting with a friend in the common room 20, it can be understood that the situation changes. Even if the user A logs in using the client computer 21 installed in the common room 20, if the access right as the user A is given as it is, the client installed in the common room 20 It is also possible to display the salary details of individual employees on the screen of the computer 21. In the common room 20, since the supervisor's eyes do not reach, it is highly possible that a friend will view information on the salary details contrary to the rules. Furthermore, even if this user A returns to his / her own room in the employee dormitory 30 and logs in using the client computer 31 installed in this own room, the access right as the user A can be given as it is. Will be even more likely to be broken.

  There are many other examples where the possibility of violating the rules increases depending on the installation environment of the client computer. For example, suppose there is an in-house rule that HR personnel should not store or print out HR-dedicated business data on an external recording medium without the permission of the HR manager. According to the internal rules, the personnel department member can access the personnel department-dedicated business data in the server computer 120, but this data is stored on a floppy disk or a CD-R without permission or printed. It is forbidden. Therefore, it is unlikely that an action contrary to such rules will be performed using the client computers 11 to 14 arranged in the personnel department 10. The act of saving on a floppy disk and the act of printing out are easy for the boss and other staff to see, so the guilt will discourage the offense. However, the situation is different when the client computers 21 to 23 arranged in the common room 20 and the client computers 31 arranged in the employee dormitory 30 are used.

  In addition, there are cases where a department that values confidentiality installs a surveillance camera at the entrance and exit of the department or requires checking by maintenance personnel when entering and exiting. In such a department, even if confidential data is stored on a floppy disk or CD-R, or printed out, it is difficult to take it out of the department, so there is a possibility that a rule violation will occur. Low. However, even when the client computer 31 installed in the employee dormitory 30 is used, if the same access right is given, even if the entry / exit of the department is made strict, the security meaning is lost.

  Of course, as a technique for solving such a security problem, a method of constructing a firewall is usually employed. For example, in the example shown in FIG. 1, a large number of routers are incorporated in the network 100, a firewall is constructed for each area, and the server computer 120 is accessed via the nodes N2 and N3. In such a case, if an operation such as rejection is performed, it is possible to prevent the illegal acts as described above. However, in order to do so, it is necessary to make complicated settings related to the network such as where and what type of firewall is installed. The present invention solves such a security problem by another approach described below.

<<< §1. First embodiment of the present invention >>>
FIG. 2 is a block diagram for explaining the first embodiment of the present invention, and shows a part of the computer system shown in FIG. The basic concept of the first embodiment is that an original client computer is defined for each user, and when each user accesses using the original client computer, it is set to the user. If access is made using a client computer other than that, only access with access rights with more restrictions than the original access rights set for the user is allowed. It is in operation to avoid.

  As an example, let us consider a case in which three users A, B, and Ai use this computer system. Here, it is assumed that the user A and the user B are both personnel personnel, and the user is a general affairs member who manages the common room. Further, the user A is provided with a computer 11 as an original client computer, the user B is provided with a computer 12 as an original client computer, and the user 21 is provided with a computer 21 as an original client computer. Shall be provided. As shown in FIG. 1, the client computers 11 and 12 supplied to the user A and B are installed in the room of the personnel department 10, and the client computer 21 supplied to the user さ れ is installed in the lounge 20. ing.

  In order to perform security management in the computer system according to the present invention, a portable information recording medium for use by connecting to a client computer is issued to each user. FIG. 2 shows an example in which portable information recording media R11, R12, and R21 are issued to three users A, B, and B, respectively. The portable information recording media R11, R12, and R21 may be any media as long as they can be easily carried by each user and have a function of recording data. However, for practical use, it is preferable to use a medium capable of ensuring sufficient security for recorded data. Specifically, it is optimal to use an IC card as a portable information recording medium. The IC card is excellent in portability and can secure sufficient security for recorded data.

  The portable information recording medium need not be a dedicated medium for use in the present invention, and can also be used for other purposes. For example, recently, an increasing number of companies issue an employee ID card using an IC card to each employee. In such a case, it is sufficient to use the employee ID card as a portable information recording medium. Here, the portable information recording medium R11, R12, R21 shown in FIG. 2 is assumed to be an employee card made up of an IC card issued to the user A, B, B, respectively. To do.

  In the first embodiment, the identification code of a specific client computer is recorded on each portable information recording medium R11, R12, R21. Here, the specific client computer is an original computer to be used by each user. In the case of the example shown in FIG. 2, the identification code ID of the client computer 11 that the user A should originally use is stored in the portable information recording medium R11 issued to the user A (the IC card issued as the employee ID of the user A). (11) is recorded. Similarly, in the portable information recording medium R12 issued to the user B (IC card issued as the user ID of the user B), the identification code ID (12) of the client computer 12 that the user B should originally use is recorded. In the portable information recording medium R21 (IC card issued as the user's employee ID card) issued to the user, the identification code ID (21) of the client computer 21 that should be used by the user is used. It is recorded.

  The client computer identification code is an identification code recorded in any part of the client computer, as long as it is a unique identification code that can identify the client computer from other client computers. Any code can be used.

  For example, a MAC address (Media Access Control Address) assigned to a LAN communication circuit built in a client computer can be used as an identification code in the present invention. Each client computer is provided with a LAN communication circuit for connecting to the network 100. Currently, a unique MAC address set by each manufacturer is given to a LAN communication circuit for Ethernet (registered trademark) which is currently used as a standard. In addition, this MAC address is recorded in an IC chip in the LAN communication circuit, and can be read using the OS function of the client computer if necessary. Therefore, if this MAC address is used as an identification code, all client computers can be mutually identified. In this case, in the portable information recording medium R11 issued as the employee ID of the user A, the MAC address of the LAN communication circuit built in the client computer 11 may be recorded as the identification code ID (11). .

  Of course, the code that can be used as the identification code in the present invention is not limited to the MAC address, and any unique data stored in the storage device of the client computer can be used as the identification code in the same manner as the MAC address. It is possible. For example, if a unique serial number is assigned to each client computer and this serial number is recorded in some form inside each client computer, the serial number may be used as an identification code. Is possible. Alternatively, it is possible to intentionally write a unique serial number in a specific area of the hard disk of each client computer and use it as an identification code.

  Information indicating the configuration of the application program stored in the storage device of each client computer can also be used as a unique identification code for identifying the client computer. Usually, a predetermined application program is installed in each client computer in accordance with the business, and the fact that a specific application program is installed can be used as an identification code. In practice, however, there are often many computers with the same type of application program installed. In this case, the serial number entered when the application program is installed is used as information indicating the configuration of the application program. It can be used as an identification code. That is, in general application programs, it is required to input a predetermined serial number at the time of installation, and the input serial encryption is often recorded on a hard disk device or the like. Therefore, even when the serial number for the application program is used as an identification code, individual client computers can be distinguished from each other.

  Now, as in the example shown in FIG. 2, the preparation stage for recording the identification codes of specific client computers on the portable information recording media R11, R12, and R21 issued to the users A, B, and B is completed. Then, it becomes possible to start operation of this computer system. In this computer system, each user is required to perform an operation of connecting an IC card issued as an employee ID card, that is, a portable information recording medium, to the client computer when using the supplied client computer. Is done. For example, when using the client computer 11 on his / her desk, the user A connects the portable information recording medium R11, which is an IC card issued as an employee ID card, to the client computer 11 for predetermined use. It is necessary to perform a start procedure (generally called a login procedure or a logon procedure). Therefore, in this embodiment, each client computer is equipped with an IC card reader / writer device.

  The basic principle of security management in the computer system according to the present embodiment is that a user connects a predetermined portable information recording medium issued to the user to a predetermined client computer, and starts using the predetermined client computer. The identification code recorded on the predetermined client computer is compared with the identification code recorded on the predetermined portable information recording medium, and a predetermined access right is obtained based on the verification result. The point is to set. More specifically, when the collation results do not match, the access right with many restrictions is set as compared with the case where the collation results match.

  For example, in the example shown in FIG. 2, the user A connects the portable information recording medium R <b> 11 issued as his / her employee ID card to the client computer 11 to be originally used installed in the personnel department 10 and starts the use procedure. Is performed, collation between the identification code ID (11) recorded in the client computer 11 and the identification code ID (11) recorded in the portable information recording medium R11 is performed. Then, the access right is set based on the collation result. In the case of this example, since the matching results match, the original access right set for the user A is given to the user's access action using the client computer 11. For example, the user A is given an access right that permits reading of general-purpose business data in the server computer 110 and an access right that allows reading / writing of personnel-dedicated business data in the server computer 120.

  On the other hand, let us consider a case where the user A accesses using the client computer 21 installed in the common room 20. In this case, the user A connects the portable information recording medium R11 to the client computer 21 to perform the use start procedure, but the identification code ID (21) recorded in the client computer 21 and the portable information are recorded. Since the identification code ID (11) recorded in the recording medium R11 does not match, in this case, access rights with more restrictions are set as compared with the case where the matching results match. For example, access to general-purpose business data in the server computer 110 is permitted, but access to the personnel department-dedicated business data in the server computer 120 is completely prohibited.

  If such an operation is performed, each user is eventually given the original access right when using a predetermined original client computer. When used, the user's access right is limited. In the case of the above-mentioned example, as long as the user A who is a personnel department works with the client computer 11 installed in the personnel department 10, he can access each server computer with the original access right given to the personnel department. However, when a client computer installed in the common room 20 or the employee dormitory 30 is used, the original access right cannot be acquired. Therefore, the security problem described in §0 can be solved.

  By the way, in order to perform identification code collation processing and access right setting processing according to the collation result, it is necessary to prepare appropriate components in the client computer. FIG. 3 is a block diagram showing the configuration of the client computer 11 for carrying out the first embodiment. As shown, the client computer 11 is provided with server access means 11A, access right setting means 11B, identification code collating means 11C, and interface means 11D. Of course, the client computer 11 includes various other components (for example, a CPU, a memory, a hard disk, an input / output device for executing an OS program and an application program, etc.) for performing the function as the client computer. ), But the description is omitted here.

  As described above, the client computer 11 stores a unique identification code ID (11) that can be distinguished from other client computers. For example, if the MAC address is used as the identification code ID (11), the identification code ID (11) is originally incorporated in the client computer 11, so that the identification code is written in the client computer 11. No unnecessary work is required. On the other hand, the identification code ID (11) is also recorded on the portable information recording medium R11. This person needs to be written by the administrator of this computer system. In the example shown here, the portable information recording medium R11 is an IC card issued as the employee ID of the user A, and a large amount of data other than the identification code ID (11) is recorded therein. These descriptions are omitted here.

  Here, the interface unit 11D is a component for connecting the portable information recording medium R11. In this example, the interface unit 11D is configured by a reader / writer device for an IC card. When the user performs the use start procedure for the client computer 11, the portable information recording medium R11 as an IC card is loaded into the interface means 11D as a reader / writer device, so that both can be connected. it can. When the use is terminated, the IC card can be separated from the reader / writer device by pulling it out.

  The identification code collating unit 11C is a component having a function of collating the identification code recorded on the currently connected portable information recording medium with the identification code recorded on itself, and the access right setting unit 11B. Is a component having a function of setting a predetermined access right based on the collation result. The access right setting unit 11B sets the first access right when the collation results match, and the second access with more restrictions than the first access right when the collation results do not match. Set the right. The server access unit 11A is a component that accesses the server computers 110 and 120 within a set access right.

  In the case of the illustrated example, the user A uses the portable information recording medium R11, which is his / her employee ID card, to perform the use start procedure for the client computer 11, so the verification results by the identification code verification unit 11C match. . That is, the identification code collating means 11C uses the identification code ID (11) in the portable information recording medium R11 read out via the interface means 11D and the identification code ID (11) recorded in the client computer 11. Since the comparison / collation processing is performed, in the case of this example, a result of matching the two is obtained, so the access right setting unit 11B sets the first access right.

  If a similar use start procedure is performed for the client computer 21 installed in the common room 20, the identification code ID (11) in the portable information recording medium R11 and the client computer 21 are recorded. Since the identification code ID (21) does not match, the identification code collating means 21C in the client computer 21 indicates a mismatch result, and the access right setting means 21B sets the second access right.

  In the above-described example, as the first access right, the right to permit reading of general-purpose business data in the server computer 110 and the permission to read / write to the personnel department-dedicated business data in the server computer 120 are set. As the second access right, the right to read the general-purpose business data in the server computer 110 is permitted, but the right to prohibit any access to the data in the server computer 120 is set.

  However, it is not always necessary to set the specific contents of such access permission / rejection by the access right setting means in the client computer. In practice, rather, in the access right setting means, only the first access right or the second access right is set, and detailed access permission / rejection setting is performed on the server computer side. Is preferable. For example, for the personnel department-dedicated business data in the server computer 120, if there is an access from the user A having the first access right, the read / write is permitted, but the second access right is granted. If there is an access from the former user, all the access should be rejected. In this case, authentication that the access is from the user A may be performed by comparing the account name given to the user and the password as usual.

  The identification code collation process and the access right setting process according to the collation result are not necessarily performed on the client computer side. That is, when the portable information recording medium has an information processing function, these processes can be executed on the portable information recording medium side. An IC card currently used for an employee ID card has not only a function as a simple information recording medium but also a function as an information processing apparatus with a built-in CPU. If a portable information recording medium having such an information processing function (hereinafter referred to as a portable information processing device) is used, identification code verification processing and access right setting processing can be performed on the portable information processing device side. Is possible.

  FIG. 4 is a block diagram showing a configuration of a modified example in which collation processing and access right setting processing are executed on the portable information processing apparatus side in the first embodiment. As illustrated, a unique identification code ID (11) is recorded in the client computer 11, and an identification code ID corresponding to the identification code recorded in the client computer 11 is stored in the portable information processing apparatus P11. The point (11) is recorded is exactly the same as the example shown in FIG. However, the client computer 11 is connected to the portable information processing apparatus and server access means 11A for accessing the server computer within the range of the access right transmitted from the currently connected portable information processing apparatus. The interface means 11D is provided, but the identification code collating means and the access right setting means are not provided.

  On the other hand, as described above, the portable information processing device P11 is an IC card having an information processing function, and includes an identification code collating unit 11E, an access right setting unit 11F, and an access right transmitting unit 11G as illustrated. Yes. The identification code collating unit 11E is a component that collates the identification code recorded in the currently connected client computer with the identification code recorded in itself, and the access right setting unit 11F receives the collation result. The access right transmitting means 11G is a component for transmitting the set access right to the currently connected client computer.

  As shown in the figure, when the user A uses the portable information processing device P11 (IC card having an information processing function) which is his / her employee ID card, when the use start procedure for the client computer 11 is performed, the identification code verification means 11E performs a process of comparing and collating the identification code ID (11) in the client computer 11 read out through the interface unit 11D with the identification code ID (11) recorded in the portable information processing device P11. It will be. In the case of this example, since a result in which both coincide is obtained, the access right setting unit 11F sets the first access right, and the set access right is sent to the server access unit 11A via the interface unit 11D. It is told. As a result, the server access unit 11A accesses the server computer based on the first access right.

  Of course, if the same use start procedure is performed for the client computer 21 installed in the common room 20, the identification code ID (11) in the portable information processing device P11 and the client computer 21 are recorded. Since the identification code ID (21) does not match, the identification code collating unit 11E obtains a mismatched collation result, and the access right setting unit 11F sets the second access right. As a result, the server access unit 11A accesses the server computer based on the second access right.

<<< §2. Second embodiment of the present invention >>>
FIG. 5 is a block diagram for explaining the second embodiment of the present invention, and shows a part of the computer system shown in FIG. The basic concept of the second embodiment is that, instead of defining an original client computer for each user, an original network environment is defined, and each user is assigned a client computer connected to the original network environment. When accessing using a client computer connected to a network environment other than that, the user is permitted to access with the original access right set for the user. In this operation, only access with an access right that has more restrictions than the original access right set in the above is permitted.

  In other words, in the first embodiment described above, different access rights are set depending on whether or not each user is accessing from a predetermined specific client computer. In the embodiment, different access rights are set depending on whether each user is accessing from a predetermined specific network environment. Here, the network environment means an environment obtained when a client computer is connected to a specific location of the network network 100. For example, in the example shown in FIG. 1, the network environment passes through the node N1 of the network network 100. Client computers 11 to 14 for accessing the server computers 110 and 120, client computers 21 to 23 for accessing the server computers 110 and 120 via the node N2, and the server computer 110 via the node N3. , 120 is a computer with a different network environment.

  However, the network environment merely indicates a connection environment to the network 100 and is not directly related to each client computer. For example, if the client computer 23 installed in the common room 20 shown in FIG. 1 is removed from the LAN in the common room 20, moved to the human resources department 10, and connected to the LAN of the human resources department 10, the same client Although it is the computer 23, the network environment will change. Conversely, since the client computer 11 installed in the personnel department 10 has failed, if it is replaced with a new client computer 15 at the same installation location, the client computer itself will be different, but the network environment will change. There is no.

  In the case of the first embodiment described above, if a MAC address or the like unique to each client computer is used as an identification code, the identification code will also change when the computer is replaced with a new one. In that case, it is necessary to rewrite the identification code recorded on the portable information recording medium with a new one. In the case of the second embodiment described here, the access right is set by determining the identity of the network environment, not the identity of the client computer itself, so long as the identity of the network environment is ensured. Even if the computer is replaced, there is no need to rewrite the contents recorded on the portable information recording medium.

  FIG. 5 shows an example in which the portable information recording media R11, R12, and R21 are issued to the three users A, B, and B based on the second embodiment, respectively. As described above, the portable information recording media R11, R12, and R21 are employee ID cards composed of IC cards issued to the users A, B, and A respectively.

  In the second embodiment, environment information indicating a specific network environment obtained when a client computer is connected to a specific location of the network 100 is recorded on each portable information recording medium R11, R12, R21. I will leave. The environment information recorded here indicates the original network environment to be used by each user. In the example shown in FIG. 5, the portable information recording medium R11 issued to the user A (IC card issued as the user ID of the user A) has environment information ENV indicating the network environment that the user A should originally use. (11) is recorded. Specifically, the environment information ENV (11) indicating the network environment of the client computer 11 used by the user A at his / her desk is recorded in the portable information recording medium R11 as it is. Similarly, the portable information recording medium R12 issued to the user B (IC card issued as the user ID of the user B) records environment information ENV (12) indicating the network environment that the user B should originally use. The portable information recording medium R21 issued to the user (IC card issued as the user ID of the user) has environment information ENV (21) indicating the network environment that the user should originally use. It is recorded.

  The environment information indicating the network environment may be any information as long as it is information indicating a specific network environment obtained when the client computer is connected to a specific location of the network 100. Some examples of specific information that can be used as environmental information are listed below.

  For example, an IP address assigned to a client computer can be used as environment information. Usually, a predetermined IP address is automatically assigned to a computer constituting a company computer system using DHCP (Dynamic Host Configuration Protocol). At this time, when an operation for determining a predetermined address range is performed for each area of each network, the assigned address range differs depending on the connection location to the network 100. For example, in the example shown in FIG. 1, the nodes N1, N2, and N3 of the network 100 are respectively provided with routers, and the client computers 11, 12, 13, and 14 of the personnel department 10 connected to the node N1 are connected. Thus, an IP address belonging to the first address range is assigned, and an IP address belonging to the second address range is assigned to the client computers 21, 22, 23 in the common room 20 connected to the node N 2. When the IP address belonging to the third address range is assigned to the client computer 31 of the employee dormitory 30 connected to the node N3, the IP address currently assigned to the client computer is By checking which address range it belongs to It is possible to recognize the network environment of the client computer.

  For example, if an IP address assigned to a certain client computer belongs to the first address range, it can be recognized that the client computer is a computer of the personnel department 10 connected to the node N1. In the case of IPv4, the IP address is represented by a 32-bit number. For example, a rule that gives a client computer connected to the same node an IP address having the same upper 24 bits but only the lower 8 bits is different. In the case where the IP address is determined, the upper 24 bits of the IP address can be directly used as environment information indicating the network environment. In the case of the example shown in FIG. 1, for example, the upper 24 bits of the IP addresses of the client computers 11, 12, 13, and 14 belonging to the personnel department 10 are the same, and can be used as environmental information as they are. .

  Further, the default gateway address set in the client computer can be used as environment information indicating the network environment. For example, in the example shown in FIG. 1, if a router is installed in each of the nodes N1, N2, and N3, the default gateway address set for each client computer is the IP address of the router installed in each node. . For example, in the client computers 11, 12, 13, and 14 of the personnel department 10, the IP address of the router installed in the node N1 is set as a common default gateway address. On the other hand, the IP address of the router installed at the node N2 is set as a common default gateway address in the client computers 21, 22, and 23 in the common room 20. Therefore, these default gateway addresses can be used as environment information indicating the network environment as they are.

  If a proxy server is installed in each of the nodes N1, N2, and N3 instead of a router, the proxy server address set in the client computer can be used as environment information indicating the network environment. A common proxy server address is set for the client computers 11, 12, 13, and 14 of the personnel department 10, but the client computers 21, 22, and 23 of the common room 20 have a different common server address. The proxy server address will be set.

  In addition, a domain name that can be inquired by a DNS server used by a client computer can be used as environment information indicating the network environment of the client computer. The DNS server is a server computer having a conversion table function for mutually converting a domain name and an IP address. In the example shown in FIG. 1, if the DNS server referred to by each client computer installed in the personnel department 10 is different from the DNS server referred to by each client computer installed in the lounge 20, each conversion is different. When the contents of the tables are different, it is possible to recognize which DNS server is the client computer referring to this difference.

  For example, a DNS server referred to by each client computer installed in the personnel department 10 has a table for converting a domain name “Melon” into an IP address. Each client computer installed in the lounge 20 If the DNS server referred to by does not have a table that converts the domain name “Melon”, an operation is performed to search for the domain name “Melon” from a certain client computer. The client computer can be recognized as a client computer installed in the personnel department 10.

  As described above, various pieces of information indicating a specific network environment obtained when a client computer is connected to a specific location of the network 100 can be used as environment information in the second embodiment. Here, as in the example shown in FIG. 5, the preparation stage for recording specific environmental information on the portable information recording media R11, R12, and R21 issued to each of the users A, B, and B has been completed. Let's do it. For example, the environment information ENV (11) recorded in the portable information recording medium R11, which is the employee ID of the user A, is information indicating the original network environment used by the user A. The upper 24 bits of the IP address assigned to the computer 11, the IP address (default gateway address) of the router installed in the node N1, or the address of the proxy server installed in the node N1 To do.

  In the example shown in FIG. 5, the network environment of the client computer 11 and the network environment of the client computer 12 are the same, and the environment information ENV (11) and the environment information ENV (12) are the same. However, since the network environment of the client computer 21 is different, the environment information ENV (21) is also different.

  The basic principle of security management in the computer system according to the present embodiment is that a user connects a predetermined portable information recording medium issued to the user to a predetermined client computer, and starts using the predetermined client computer. The current network environment of the predetermined client computer is compared with the network environment indicated by the environment information recorded on the predetermined portable information recording medium, and based on the verification result The point is to set a predetermined access right. More specifically, when the collation results do not match, the access right with many restrictions is set as compared with the case where the collation results match. This point is the same as in the first embodiment described above.

  For example, in the example shown in FIG. 5, when the user A connects the portable information recording medium R11 issued as his / her employee ID card to the client computer 11 of the personnel department 10 and performs the use start procedure, the client computer 11 is collated with the environment information ENV (11) indicating the network environment 11 and the environment information ENV (11) recorded on the portable information recording medium R11. Then, the access right is set based on the collation result. In the case of this example, since the matching results match, the original access right set for the user A is given to the user's access action using the client computer 11. For example, the user A is given an access right that permits reading of general-purpose business data in the server computer 110 and an access right that allows reading / writing of personnel-dedicated business data in the server computer 120.

  In the example shown in FIG. 5, since the network environment of the client computer 11 and the network environment of the client computer 12 are the same, the environment information ENV (11) and the environment information ENV (12) are the same. Therefore, when the user A uses the client computer 12, the same access right as in the above case is given. Of course, when the client computer 11 is exchanged for a new client computer 15 and this new client computer 15 is used, the same access right is given. As described above, in the second embodiment described here, an operation with a higher degree of freedom is possible than in the first embodiment described above.

  On the other hand, when the user A accesses using the client computer 21 installed in the common room 20, the situation changes. In this case, the user A connects the portable information recording medium R11 to the client computer 21 to perform the use start procedure, but the environment information ENV (21) indicating the network environment of the client computer 21 and the portable information Since it does not match the environment information ENV (11) recorded on the recording medium R11, in this case, access rights with more restrictions are set as compared with the case where the matching results match. For example, access to general-purpose business data in the server computer 110 is permitted, but access to the personnel department-dedicated business data in the server computer 120 is completely prohibited.

  If such an operation is carried out, each user is eventually given the original access right as long as the user accesses from the predetermined original network environment, but the user is accessed from other network environments. In this case, the access right of the user is limited. In the case of the above-described example, as long as the user A who is the personnel department accesses using the client computers 11 to 14 installed in the personnel department 10, he / she accesses each server computer with the original access right given to the personnel department. However, when a client computer installed in the common room 20 or the employee dormitory 30 is used, the original access right cannot be acquired. Therefore, the security problem described in §0 can be solved.

  Also in the second embodiment, it is necessary to prepare appropriate components in the client computer in order to perform environment information collation processing and access right setting processing according to the collation result. FIG. 6 is a block diagram showing the configuration of the client computer 11 for carrying out the second embodiment. As shown, the client computer 11 is provided with server access means 11A, access right setting means 11B, environment verification means 11H, and interface means 11D. Of course, the client computer 11 includes various other components (for example, a CPU, a memory, a hard disk, an input / output device for executing an OS program and an application program, etc.) for performing the function as the client computer. ), But the description is omitted here.

  The client computer 11 is connected to the network 100 under a specific network environment, and the specific network environment can be indicated by predetermined environment information ENV (11). As described above, as the environment information ENV (11), an IP address, a default gateway address, a proxy server address, or the like set in the client computer 11 can be used.

  The interface means 11D is a component for connecting the portable information recording medium R11 as in the embodiment shown in FIG. 3, and is constituted by a reader / writer device for an IC card. When the user performs the use start procedure for the client computer 11, the portable information recording medium R11 as an IC card is loaded into the interface means 11D as a reader / writer device, so that both can be connected. it can. When the use is terminated, the IC card can be separated from the reader / writer device by pulling it out.

  The environment collating unit 11H is a component having a function of collating the environment information recorded on the currently connected portable information recording medium with the environment information indicating the current network environment of the client computer 11, and setting an access right. The means 11B is a component having a function of setting a predetermined access right based on the collation result. The access right setting unit 11B sets the first access right when the collation results match, and the second access with more restrictions than the first access right when the collation results do not match. Set the right. The server access unit 11A is a component that accesses the server computers 110 and 120 within a set access right.

  In the case of the example shown in FIG. 6, since the user A uses the portable information recording medium R11 that is his / her employee ID card, the use start procedure for the client computer 11 is performed. To do. That is, the environment verification unit 11H uses the environment information ENV (11) in the portable information recording medium R11 read out via the interface unit 11D and the environment information ENV (11) indicating the current network environment of the client computer 11. In this example, the result of matching is obtained, and the access right setting unit 11B sets the first access right.

  If the same usage start procedure is performed for the client computer 21 installed in the common room 20, the environment information ENV (11) in the portable information recording medium R11 and the network environment of the client computer 21 are shown. Since it does not match the environment information ENV (21), the environment verification means 21H in the client computer 21 indicates a mismatch result, and the access right setting means 21B sets the second access right. The difference between the access based on the first access right and the access based on the second access right has already been described in §1.

  FIG. 7 is a block diagram showing a configuration of a modified example in which collation processing and access right setting processing are executed on the portable information processing apparatus side in the second embodiment. As shown in the figure, the client computer 11 is connected to the portable information processing device and server access means 11A for accessing the server computer within the range of the access right transmitted from the currently connected portable information processing device. Interface means 11D for providing an environment verification means and access right setting means.

  On the other hand, the portable information processing device P11 is an IC card having an information processing function, and includes an environment verification unit 11I, an access right setting unit 11F, and an access right transmission unit 11G as illustrated. The environment collating unit 11I is a component that collates the environment information indicating the network environment of the currently connected client computer with the environment information recorded in itself, and the access right setting unit 11F is based on the collation result. The access right transmitting means 11G is a component for transmitting the set access right to the currently connected client computer.

  As shown in the figure, when the user A uses the portable information processing device P11 (IC card having an information processing function) that is his / her employee ID card, when the procedure for starting the use of the client computer 11 is performed, the environment verification unit 11I. Is a process of comparing and collating the environment information ENV (11) indicating the network environment of the client computer 11 read through the interface unit 11D and the environment information ENV (11) recorded in the portable information processing apparatus P11. Will do. In the case of this example, since a result in which both coincide is obtained, the access right setting unit 11F sets the first access right, and the set access right is sent to the server access unit 11A via the interface unit 11D. It is told. As a result, the server access unit 11A accesses the server computer based on the first access right.

  Of course, if a similar use start procedure is performed for the client computer 21 installed in the common room 20, the environment information ENV (11) in the portable information processing device P11 and the network environment of the client computer 21 are shown. Since it does not match with the environment information ENV (21), the environment matching unit 11I obtains a mismatch result, and the access right setting unit 11F sets the second access right. As a result, the server access unit 11A accesses the server computer based on the second access right.

<<< §3. Third embodiment of the present invention >>>
The third embodiment described here corresponds to a combination of the first embodiment described in §1 and the second embodiment described in §2. That is, the feature of the first embodiment is that a specific client computer to be originally used is set for each user, and the access right setting is changed depending on whether or not the access is from the client computer. In particular, the feature of the second embodiment is that a specific network environment to be originally used is set for each user, and the access right is set depending on whether the access is from the network environment. Is to change. The feature of the third embodiment described here is that a specific client computer to be originally used and a specific network environment to be originally used are set for each user, and the client computer can The setting of the access right is changed in consideration of whether the access is made and whether the access is made from the network environment.

  Therefore, in the third embodiment, a specific identification code and environment information indicating a specific network environment are recorded on the portable information recording medium issued to each user. When the user performs the use start procedure for the client computer, the verification process of the identification code recorded on the client computer and the identification code recorded on the portable information recording medium, A collation process is performed between the network environment and the network environment indicated by the environment information recorded on the portable information recording medium, and a predetermined access right is set based on these collation results.

  FIG. 8 is a block diagram for explaining a third embodiment of the present invention, and shows a part of the computer system shown in FIG. Also here, an example is shown in which portable information recording media R11, R12, and R21 are issued to the three users A, B and B, respectively. In each portable information recording medium R11, R12, R21, predetermined environment information is recorded together with a predetermined identification code. For example, in the portable information recording medium R11 issued to the user A (an IC card issued as the user ID of the user A), the identification code ID (11) of the client computer 11 that the user A should originally use, and the user Environment information ENV (11) indicating a network environment that should be originally used by Party A is recorded. Similarly, the portable information recording medium R12 issued to the user B has the identification code ID (12) of the client computer 12 that the user B should use and the environment information indicating the network environment that the user B should use. ENV (12) is recorded, and in the portable information recording medium R21 issued to the user 識別, the identification code ID (21) of the client computer 21 that the user 本来 should use and the user 本来 originally use Environment information ENV (21) indicating a network environment to be recorded is recorded.

  In the example shown in FIG. 8, for example, when the user A connects the portable information recording medium R11 issued as his / her employee ID card to the client computer 11 of the personnel department 10 and performs the use start procedure, the client computer 11 is collated with the identification code ID (11) in the portable information recording medium R11 and environment information ENV (11) indicating the network environment of the client computer 11 And the environment information ENV (11) recorded on the portable information recording medium R11 are collated. An access right is set based on these verification results. In the case of this example, the two collation results both match.

  If the user A performs the use start procedure for the client computer 12 instead of the client computer 11, the identification code ID (12) in the client computer 12 and the portable information recording medium R 11 are recorded. The identification information (11) is collated with the environment information ENV (12) indicating the network environment of the client computer 12 and the environment information ENV (11) recorded on the portable information recording medium R11. Verification work is performed. In this case, ID (11) ≠ ID (12) does not match in the collation work for the identification code, but ENV (11) = ENV (12) coincides in the collation work for the network environment.

  On the other hand, when the user A accesses using the client computer 21 installed in the common room 20, the collation operation for the identification code is inconsistent with ID (11) ≠ ID (21), and the network environment Even in the collation work for, ENV (11) ≠ ENV (21) does not match. Further, when the user A moves the client computer 11 installed in the personnel department 10 to the common room 20 and connects to the LAN of the common room 20 for access, the verification work for the identification code is performed. In this case, ID (11) = ID (11) matches, but in the collation work for the network environment, ENV (11) ≠ ENV (21) does not match.

  In this way, when the collation operation of the identification code and the collation operation of the network environment are combined, a total of four collation results can be obtained, and an access right with four variations can be set.

  FIG. 9 is a block diagram showing the configuration of the client computer 11 for carrying out the third embodiment, which corresponds to a combination of the configuration of FIG. 3 and the configuration of FIG. Since the function of each component is as described in §1 and §2, description of the function of each component is omitted here. As shown in the drawing, both the identification code ID (11) and the environment information ENV (11) are recorded on the portable information recording medium R11. On the client computer 11 side, there are provided both an identification code collating unit 11C for collating identification codes and an environment collating unit 11H for collating the network environment. The access right setting unit 11B Based on the two verification results, a predetermined access right is set.

  FIG. 10 is a block diagram showing a configuration of a modified example in which collation processing and access right setting processing are executed on the portable information processing apparatus side in the third embodiment. This block diagram corresponds to a combination of the configuration of FIG. 4 and the configuration of FIG. Here, the functions of the individual components are the same as described in §1 and §2, respectively, and thus the description of the functions of the respective components is omitted. As shown in the drawing, both the identification code ID (11) and the environment information ENV (11) are recorded in the portable information processing device P11, and the identification code collating means 11E for collating the identification code is provided. Both are provided with environment verification means 11I for network environment verification. The access right setting unit 11F sets a predetermined access right based on these two verification results.

  As described above, in the third embodiment, a total of four verification results can be obtained by combining the verification operation of the identification code and the verification operation of the network environment. Therefore, the access rights with four variations are obtained. However, in practice, it is sufficient to set three access rights. Here, two practical access right setting algorithms that can be applied to computer systems used in many companies will be exemplified.

  First, when the verification result of the identification code matches, the first algorithm sets the first access right regardless of the verification result of the network environment, and the verification result of the identification code does not match, but the verification of the network environment If the results match, the second access right, which has more restrictions than the first access right, is set. If none of the matching results match, the second access right is further restricted. This is a method of setting the third access right with many matters. According to this method, it becomes possible to manage access rights in accordance with the actual operation of the computer system.

  FIG. 11 is a flowchart showing an access right setting method based on such a policy. First, in step S1, if the user performs a procedure for starting use of a predetermined client computer, in step S2, an identification code verification operation is performed. If the identification codes match, the process branches to step S6 via step S3, and the first access right with fewer restrictions is set. In this case, there is no need to perform a network environment verification operation. On the other hand, if the identification codes do not match, the process proceeds to step S4 through step S3, where the network environment verification operation is performed. If the network environments match, the process branches to step S7 via step S5, and the second access right having a medium restriction is set. On the other hand, if the network environments also do not match, the process branches to step S8 via step S5, and the third access right with many restrictions is set.

  After all, if the access right is set based on the algorithm shown in FIG. 11, as long as the user uses the original client computer itself provided to himself / herself, it can be used in any network environment. If so, the first access right having the highest level (the access right that should be given to the user) is given. On the other hand, when the user accesses using another client computer, if the access is from the original network environment, the second access right at the medium level is given. In the case of access from the network environment, the third access right having the lowest level is given.

  On the other hand, the second algorithm sets the first access right when both the collation result by the identification code collating unit and the collation result by the environment collating unit match, and the collation result by the identification code collating unit matches. However, if the collation result by the environment collation means does not match, the second access right with more restrictions than the first access right is set, and if any collation result does not match, the second access right is set. This is a method of setting the third access right with more restrictions than the above. This method also makes it possible to manage access rights according to the actual operation of the computer system.

  FIG. 12 is a flowchart showing an access right setting method based on such a policy. First, in step S1, if the user performs a procedure for starting use of a predetermined client computer, in step S2, an identification code verification operation is performed. If the identification codes match, the process branches to step S4 via step S3, and the network environment verification operation is performed. If the network environments also match, the process branches to step S6 via step S5, and the first access right with fewer restrictions is set. If the network environments do not match, the process branches to step S7 via step S5, and the second access right with a medium restriction is set. On the other hand, if the identification codes do not match, the process branches from step S3 to step S8, and the third access right with many restrictions is set. In this case, there is no need to perform a network environment verification operation.

  After all, if the access right is set based on the algorithm shown in FIG. 12, as long as the user uses the original client computer itself provided to himself / herself in the original network environment, the highest level is obtained. The first access right (the access right that should originally be given to the user) is given. In addition, when the user uses the original client computer provided to himself / herself, but uses from a different network environment other than the original network environment, the second access right at the medium level is given. Will be given. On the other hand, if the user is using from another client computer that is not the original client computer provided to himself / herself, the third access right with the lowest level is given regardless of the network environment. Become.

  The access right setting algorithm that can be used in the third embodiment has been described above in two examples. Of course, the access right setting in the present invention is freely performed so as to be adapted to each computer system. And is not limited to the examples described above. For example, four access rights may be set based on four verification results.

<<< §4. Some variations >>>
As mentioned above, although this invention was demonstrated based on three basic embodiment, this invention is not limited to these embodiment, In addition, it can implement with a various form. Here, finally, some modified examples for carrying out the present invention will be described.

  (1) A feature of the present invention is that a predetermined access right is set based on a verification result of an identification code or a verification result of a network environment. The method can be used in combination with a method of authenticating a user with an account and a password and giving a predetermined access right set in advance for each user.

  (2) In the above-described embodiment, an example in which the identification code and the environment information recorded in the portable information recording medium are single is shown. However, a plurality of identification codes and a plurality of network environments are recorded in advance. , Each may be collated. In this case, different access rights can be set depending on which identification code matches or which network environment matches. For example, two types of identification code ID (11-1) and ID (11-2) are recorded in the portable information recording medium R11 issued to the user A, and the identification code ID (11-1) matches. In this case, it is possible to set the first access right and the second access right when the identification code ID (11-2) matches.

  (3) In the above-described embodiment, as an example in which the identification code and the environment information match, the example in which the character string indicating the code and the address completely matches has been described, but the collation match in the present invention is not necessarily a character string or the like Does not mean a case where one-to-one correspondence completely, but means that information on the client computer side and information on the portable information recording medium side correspond in some way. For example, even if the information on the client computer side is A and the information on the portable information recording medium side is B, the information B is uniquely obtained by performing a specific calculation process on the information A. If this is the case, it can be confirmed that the information A and the information B correspond to each other by performing the specific calculation process.

  (4) The access right in the present invention includes not only the right to permit reading / writing to a file but also the right to various processing such as the right to give permission to print out the contents of a file.

  (5) “Server computer” in the present invention broadly means a computer that provides data and services, and “client computer” broadly means a computer that receives data and services. It is. Therefore, for example, in the configuration shown in FIG. 1, when the client computer 11 executes a process of transferring data stored in the client computer 14 over the network, the client computer 14 functions as a “server computer”.

  (6) In FIG. 3, FIG. 4, FIG. 6, FIG. 7, FIG. 9, and FIG. 10, the individual components of the client computer and the portable information processing device are shown as blocks, respectively. Actually, it is a component realized by a program incorporated in a computer or an IC card. Of course, the program can be recorded and distributed on a computer-readable recording medium such as a CD-ROM.

1 is a block diagram showing a general computer system configured by connecting a server computer and a client computer to a network. FIG. 2 is a block diagram for explaining the first embodiment of the present invention and shows a part of the computer system shown in FIG. 1. It is a block diagram which shows the structure of the client computer for performing 1st Embodiment shown in FIG. FIG. 10 is a block diagram showing a configuration of a modification example in which collation processing and access right setting processing are executed on the portable information processing device side in the first embodiment shown in FIG. 2. It is a block diagram for demonstrating the 2nd Embodiment of this invention, and shows a part of computer system shown in FIG. It is a block diagram which shows the structure of the client computer for performing 2nd Embodiment shown in FIG. FIG. 6 is a block diagram showing a configuration of a modified example in which collation processing and access right setting processing are executed on the portable information processing apparatus side in the second embodiment shown in FIG. 5. It is a block diagram for demonstrating the 3rd Embodiment of this invention, and shows a part of computer system shown in FIG. It is a block diagram which shows the structure of the client computer for performing 3rd Embodiment shown in FIG. FIG. 9 is a block diagram illustrating a configuration of a modified example in which collation processing and access right setting processing are executed on the portable information processing device side in the third embodiment illustrated in FIG. 8. It is a flowchart which shows an example of the setting method of the access right in the 3rd Embodiment of this invention. It is a flowchart which shows another example of the setting method of the access right in the 3rd Embodiment of this invention.

Explanation of symbols

DESCRIPTION OF SYMBOLS 10 ... Personnel department 11-14 Client computer 11A installed in personnel department ... Server access means 11B ... Access right setting means 11C ... Identification code collating means 11D ... Interface means 11E ... Identification code collating means 11F ... Access right setting means 11G ... Access right transmission means 11H ... Environment verification means 11I ... Environment verification means 20 ... Talk room 21-23 ... Client computer 30 installed in the talk room ... Employee dormitory 31 ... Client computer 100 installed in the employee dormitory ... Network 110 ... Server computer 120 ... Server computers ENV (11), ENV (12), ENV (21) ... Environment information ID (11), ID (12), ID (21) indicating network environment ... Identification codes N1, N2, N3 ... Each node P1 in the network ... portable information processing apparatus (IC card)
R11, R12, R21 ... Portable information recording medium (IC card)
S1 to S8: Steps in the flowchart

Claims (11)

Network network, server computer connected to the network, a plurality of client computers connectable to the network, and portable information recording medium issued to individual users for use by connecting to the client computer A computer system comprising:
Each portable information recording medium is recorded with environment information indicating a specific network environment obtained when each client computer is connected to a specific location of the network network,
Each client computer has interface means for connecting a portable information recording medium, a network environment indicated by environmental information recorded on the currently connected portable information recording medium, and its own current network environment. An environment collating unit that collates with each other, an access right setting unit that selectively sets one of a plurality of access rights whose access right range is determined in advance based on the collation result, and the set access right And a server access means for accessing the server computer within the scope of the above. Network network, server computer connected to the network, a plurality of client computers connectable to the network, and portable information processing apparatus issued to individual users for use by connecting to the client computer A computer system comprising:
In each portable information processing device, environment information indicating a specific network environment obtained when a client computer is connected to a specific location of the network network is recorded,
Each client computer has interface means for connecting a portable information processing device and server access for accessing the server computer within the range of access rights transmitted from the currently connected portable information processing device. Means, and
The portable information processing apparatus is preliminarily accessed based on the collation result, and an environment collation unit that collates the network environment of the currently connected client computer with the network environment indicated by the environment information recorded in itself. An access right setting means for selectively setting any one of a plurality of access rights with a range of rights, and an access right transmitting means for transmitting the set access right to the currently connected client computer. A computer system characterized by being provided. The computer system according to claim 1 or 2 ,
The IP address assigned to the client computer, the default gateway address set for the client computer, the proxy server address set for the client computer, or the domain name that can be queried by the DNS server used by the client computer A computer system characterized by being used as environment information indicating a network environment. Network network, server computer connected to the network, a plurality of client computers connectable to the network, and portable information recording medium issued to individual users for use by connecting to the client computer A computer system comprising:
Each client computer is recorded with a unique identification code that can be distinguished from other client computers.
Each portable information recording medium includes an identification code corresponding to a specific identification code recorded on a specific client computer, and a specific code obtained when the client computer is connected to a specific location on the network. Environmental information indicating the network environment is recorded,
Each client computer is collated with an interface means for connecting a portable information recording medium, an identification code recorded on the currently connected portable information recording medium, and an identification code recorded on itself. Identification code collating means, environment collating means for collating the network environment indicated by the environmental information recorded on the currently connected portable information recording medium and the current network environment of the user, and the collation result Access right setting means for selectively setting any one of a plurality of access rights whose range of access rights is determined in advance, and server access for accessing the server computer within the set access rights And a computer system. Network network, server computer connected to the network, a plurality of client computers connectable to the network, and portable information processing apparatus issued to individual users for use by connecting to the client computer A computer system comprising:
Each client computer is recorded with a unique identification code that can be distinguished from other client computers.
Each portable information processing device includes an identification code corresponding to a specific identification code recorded in a specific client computer, and a specific code obtained when the client computer is connected to a specific location of the network. Environmental information indicating the network environment is recorded,
Each client computer has interface means for connecting a portable information processing device and server access for accessing the server computer within the range of access rights transmitted from the currently connected portable information processing device. Means, and
The portable information processing apparatus includes an identification code collating means for collating an identification code recorded on a currently connected client computer with an identification code recorded on itself, and a network of currently connected client computers An environment verification means for verifying the environment and the network environment indicated by the environmental information recorded on itself, and one of a plurality of access rights whose scope of access rights is determined in advance based on these verification results An access right setting means for selectively setting the access right and an access right transmitting means for transmitting the set access right to the currently connected client computer. Network network, server computer connected to the network, a plurality of client computers connectable to the network, and portable information issued to individual users for use by connecting to the client computer A computer system comprising a recording medium, and a method for setting an access right when an individual user accesses a server computer using a client computer,
A preparatory stage in which the portable information recording medium records environment information indicating a specific network environment obtained when a client computer is connected to a specific location of the network network;
When a user connects a predetermined portable information recording medium issued to the user to a predetermined client computer and performs a use start procedure for the predetermined client computer, the predetermined client computer A plurality of client computers whose current access rights are determined in advance and the network environment indicated by the environment information recorded in the predetermined portable information recording medium is collated. An access rights setting phase that selectively sets one of the access rights for
In the access right setting step, when the predetermined client computer does not match the matching result, the access right is set with more restrictions than when the matching result matches. An access right setting method in a computer system. Network network, server computer connected to the network, a plurality of client computers connectable to the network, and portable information issued to individual users for use by connecting to the client computer A computer system comprising a processing device, and a method for setting an access right when an individual user accesses a server computer using a client computer,
A preparatory stage in which the portable information processing apparatus records environment information indicating a specific network environment obtained when a client computer is connected to a specific location of the network network;
When a user connects a predetermined portable information processing apparatus issued to the user to a predetermined client computer and performs a use start procedure for the predetermined client computer, the predetermined portable information processing apparatus The current network environment of the predetermined client computer is collated with the network environment indicated by the environment information recorded in the predetermined portable information processing apparatus, and the range of access rights is determined in advance based on the collation result. An access right setting stage for selectively setting one of a plurality of access rights ,
In the access right setting stage, if the predetermined portable information processing device does not match the collation result, the access right is set with more restrictions than when the collation result is coincident. An access right setting method in a computer system, characterized in that: Network network, server computer connected to the network, a plurality of client computers connectable to the network, and portable information issued to individual users for use by connecting to the client computer A computer system comprising a recording medium, and a method for setting an access right when an individual user accesses a server computer using a client computer,
The portable information recording medium is an identification code recorded in a specific client computer and corresponding to a unique identification code capable of identifying the specific client computer from other client computers; Environmental information indicating a specific network environment obtained when a client computer is connected to a specific part of the network, and a preparation step for recording the information inside
When a user connects a predetermined portable information recording medium issued to the user to a predetermined client computer and performs a use start procedure for the predetermined client computer, the predetermined client computer The identification code recorded on the client computer and the identification code recorded on the predetermined portable information recording medium, and the current network environment of the predetermined client computer and the predetermined portable information recording Access that collates with the network environment indicated by the environment information recorded on the medium, and selectively sets one of a plurality of access rights whose scope of access rights is determined in advance based on these collation results Right setting stage,
In the access right setting step, the predetermined client computer sets the first access right when the identification code verification result matches, and the identification code verification result does not match, but the network environment If the collation results match, the second access right having more restrictions than the first access right is set, and if any collation results do not match, the second access right is further set. An access right setting method in a computer system, characterized in that a third access right with many restrictions is set. Network network, server computer connected to the network, a plurality of client computers connectable to the network, and portable information issued to individual users for use by connecting to the client computer A computer system comprising a processing device, and a method for setting an access right when an individual user accesses a server computer using a client computer,
An identification code corresponding to a unique identification code, which is an identification code recorded in a specific client computer and capable of identifying the specific client computer from other client computers; Environmental information indicating a specific network environment obtained when a client computer is connected to a specific part of the network, and a preparation step for recording the information inside
When a user connects a predetermined portable information processing apparatus issued to the user to a predetermined client computer and performs a use start procedure for the predetermined client computer, the predetermined portable information processing apparatus The identification code recorded in the predetermined client computer is collated with the identification code recorded in the predetermined portable information processing apparatus, and the current network environment of the predetermined client computer and the predetermined portable The network environment indicated by the environment information recorded in the information processing apparatus is collated, and one of a plurality of access rights whose access rights are defined in advance is selectively selected based on the collation result Access right setting stage to set,
In the access right setting step, the predetermined portable information processing device sets the first access right when the verification result of the identification code matches, and the verification result of the identification code does not match If the collation result in the network environment matches, the second access right having more restrictions than the first access right is set, and if any collation result does not match, the second access right is set. An access right setting method in a computer system, characterized in that a third access right with more restrictions than those is set. Network network, server computer connected to the network, a plurality of client computers connectable to the network, and portable information issued to individual users for use by connecting to the client computer A computer system comprising a recording medium, and a method for setting an access right when an individual user accesses a server computer using a client computer,
The portable information recording medium is an identification code recorded in a specific client computer and corresponding to a unique identification code capable of identifying the specific client computer from other client computers; Environmental information indicating a specific network environment obtained when a client computer is connected to a specific part of the network, and a preparation step for recording the information inside
When a user connects a predetermined portable information recording medium issued to the user to a predetermined client computer and performs a use start procedure for the predetermined client computer, the predetermined client computer The identification code recorded on the client computer and the identification code recorded on the predetermined portable information recording medium, and the current network environment of the predetermined client computer and the predetermined portable information recording Access that collates with the network environment indicated by the environment information recorded on the medium, and selectively sets one of a plurality of access rights whose scope of access rights is determined in advance based on these collation results Right setting stage,
In the access right setting step, the predetermined client computer sets a first access right when both the verification result by the identification code verification unit and the verification result by the environment verification unit match, When the collation result by the identification code collating means matches, but the collation result by the environment collating means does not match, the second access right having more restrictions than the first access right is set, and all the collation results are identical. If not, the access right setting method in the computer system is characterized in that the third access right, which has more restrictions than the second access right, is set. Network network, server computer connected to the network, a plurality of client computers connectable to the network, and portable information issued to individual users for use by connecting to the client computer A computer system comprising a processing device, and a method for setting an access right when an individual user accesses a server computer using a client computer,
An identification code corresponding to a unique identification code, which is an identification code recorded in a specific client computer and capable of identifying the specific client computer from other client computers; Environmental information indicating a specific network environment obtained when a client computer is connected to a specific part of the network, and a preparation step for recording the information inside
When a user connects a predetermined portable information processing apparatus issued to the user to a predetermined client computer and performs a use start procedure for the predetermined client computer, the predetermined portable information processing apparatus The identification code recorded in the predetermined client computer is collated with the identification code recorded in the predetermined portable information processing apparatus, and the current network environment of the predetermined client computer and the predetermined portable The network environment indicated by the environment information recorded in the information processing apparatus is collated, and one of a plurality of access rights whose access rights are defined in advance is selectively selected based on the collation result The access right setting stage to be set,
In the access right setting step, when the predetermined portable information processing device matches both the verification result by the identification code verification means and the verification result by the environment verification means, the first access right is set. If the collation result by the identification code collating means matches but the collation result by the environment collating means does not match, the second access right having more restrictions than the first access right is set, and any collation An access right setting method in a computer system, characterized in that, if the result does not match, a third access right having more restrictions than the second access right is set.