JP4890372B2 - Portable information processing device, electronic device, operation control method, and operation control program - Google Patents

Description

  The present invention relates to a portable information processing device, an electronic device, an operation control method, and an operation control program.

  In a computer system, an access right is generally defined for each resource in order to prevent unauthorized use of the resource. Data in which such access rights are defined is generally called an ACL (Access Control List).

  On the other hand, by managing the access control information held for each of various conventional systems together with various security information in a specific server (hereinafter referred to as “security server”), resources for multiple systems can be managed. Regarding access control, a system form capable of applying a common security rule has begun to be adopted. Here, information managed in the security server is generally called a security policy (for example, Patent Document 1).

  Taking a document as an example of a resource, in a security policy, the document classification according to the main document attributes (management department, document type, confidential level, etc.) representing the characteristics of the document, and the main user attributes (parts belonging to the department) representing the characteristics of the user. Appropriate access rules are defined for each type of operation according to the combination with the user classification according to the job title.

  Conventionally, two types of access control systems using a security policy have been generally used.

  FIG. 1 is a diagram showing a first example of a conventional access control system based on a security policy. In FIG. 1, a security server 510 is a computer that executes access control for various resources based on a security policy. In the form of FIG. 1, the security policy is centrally managed by the security server 510, and when an access to a resource occurs in each system or device, the system or the like inquires of the security server 510 whether access is permitted ( Policy confirmation). For example, the document management system 520 checks the policy with respect to the security server 510 when access to the managed document occurs. The multifunction device 530 checks the policy with respect to the security server 510 when an instruction to execute copying or printing is given. The PC 540 checks the policy with respect to the security server 510 when an access to a file or the like stored in the PC 540 occurs. The system configuration shown in FIG. 1 is hereinafter referred to as “policy confirmation type”.

FIG. 2 is a diagram showing a second example of a conventional access control system based on a security policy. In FIG. 2, the same parts as those in FIG. In the form of FIG. 2, the security policy managed by the security server 510 is distributed to each system or the like at a predetermined timing (for example, when the security policy is updated). In this case, when an access to a resource occurs, each system or the like makes an access permission determination based on a security policy stored in the system or the like. The system form shown in FIG. 2 is hereinafter referred to as “policy distribution type”.
JP 2005-38372 A

  However, in the policy confirmation type, each system or apparatus needs to be connected to the security server via a network. Therefore, when a failure occurs in the network, there is a problem that the system cannot be used because access control cannot be performed even if the function of each system itself operates normally.

  In the case of a policy distribution type, it is necessary to maintain security policy consistency in each system. Therefore, every time a change occurs in the security policy, it is necessary to distribute the security policy to each system at the same time, and there is a problem that the burden on maintenance work is large.

  The present invention has been made in view of the above points, and provides a portable information processing device, an electronic device, an operation control method, and an operation control program capable of providing a new form of access control method. With the goal.

  Accordingly, in order to solve the above-described problem, the present invention is a portable information processing apparatus that can communicate with an electronic device that is an operation target, and operation identification information that identifies an permitted operation, and the operation is permitted. Storage means for storing data including resource identification information for identifying a resource, the operation identification information and the resource identification information related to the operation request transmitted from the electronic device in response to an input of the operation request, And determining means for determining whether or not the operation request is permitted based on the data and transmitting the determination result to the electronic device.

  Such an operation control system can provide a new form of access control.

  According to the present invention, it is possible to provide a portable information processing device, an electronic device, an operation control method, and an operation control program that can provide a new form of access control.

  Hereinafter, embodiments of the present invention will be described with reference to the drawings. FIG. 3 is a diagram for explaining the outline of the embodiment of the present invention. As shown in FIG. 3A, in the present embodiment, an access permit 50 is generated and issued in advance by the permit issuing server 20 and downloaded to the portable information processing apparatus 10.

  The access permit 50 is access control information (for example, an ACL (Access Control List), a policy, etc.) indicating whether or not a certain subject (user or program, etc.) is allowed to perform certain operations on a certain resource (software, hardware, etc.). (Information corresponding to) is recorded data. In the present embodiment, an access permit 50 is issued for combinations of permitted operations, subjects, and resources.

  The portable information processing apparatus 10 is a portable information processing apparatus, and corresponds to, for example, an IC card, a mobile phone, a PDA (Personal Digital Assistance), or a notebook PC (Personal Computer). Therefore, the access permit information 50 is recorded in the portable information processing apparatus 10 so that the access control information can be carried.

  When the portable information processing device 10 is assigned (distributed) for each person, an access permit in which only access control information related to the user (owner) to which the portable information processing device 10 is assigned is recorded. 50 may be downloaded to the portable information processing apparatus 10. On the other hand, when the portable information processing apparatus 10 is shared by a plurality of users, an access permit 50 in which access control information related to the plurality of users to be shared is recorded may be downloaded to the portable information processing apparatus 10. . In the present embodiment, the portable information processing apparatus 10 is taken as an example when it is assigned to each person.

  Subsequently, as shown in FIG. 3B, when using a service provided by the device 30 which is an electronic device such as an image forming apparatus (for example, a copier or a multifunction device), the device 30 The portable information processing device 10 is presented (the device 30 and the portable information processing device 10 are in a communicable state). When the user inputs an operation request to the device 30, the device 30 inquires the portable information processing apparatus 10 about whether or not the operation is permitted by the user. The portable information processing device 10 determines whether the operation is permitted based on the recorded access permit 50 and notifies the device 30 of the determination result. The device 30 executes the requested operation when the operation is permitted. In this embodiment, the device 30 is a service providing entity, but software on a computer system may be considered as a service providing entity.

  According to the form shown in FIG. 3, the device 30 does not necessarily have to be connected to the network as in the policy confirmation type described in FIG. This is because it is possible to determine whether the operation is permitted or not based on the access permit 50 as long as communication with the portable information terminal 10 is possible. In addition, since it is not necessary to distribute access control information in advance to the system or apparatus that is the target of the operation as in the policy distribution type described in FIG. 2, the consistency of the access control information between the systems or apparatuses is ensured. There is no need to be conscious. Therefore, maintenance work can be reduced.

  More specific description will be given below. In the following description, the stage shown in FIG. 3A is called an “access permit issuance stage”, and the stage shown in FIG. 3B is called an “access permit use stage”.

  FIG. 4 is a diagram illustrating a functional configuration example of the system according to the embodiment of the present invention. In FIG. 4, the same parts as those in FIG.

  The permit issuing server 20 includes a permit issuing unit 21 and a permit repository 22. The permit issuing unit 21 controls the issuing process of the access permit 50. The permit repository 22 manages an access permit 50 registered in advance by an administrator or the like.

  The portable information processing apparatus 10 includes a permit download unit 11 and an operation permission / rejection determination unit 12. The permit download unit 11 controls the process of downloading the access permit 50 from the permit issuing server 20. The downloaded access permit 50 is stored (recorded) in the storage device of the portable information processing apparatus 10. The operation permission determination unit 12 responds to the operation request based on the access permit 50 stored in the storage device of the portable information processing device 10 in response to an inquiry from the device 30 to which the operation request is input by the user. The presence / absence of authority for the operation is determined, and the determination result is notified to the device 30.

  The device 30 includes a service unit 31, an access control unit 32, and the like. The service unit 31 controls processing for realizing a service (operation) according to an operation request input by the user. The access control unit 32 inquires the operation permission determination unit 12 of the portable information processing apparatus 10 about the authority for the operation according to the operation request input by the user, and determines whether the authority is returned as a response to the inquiry. Depending on the result, provision of services by the service unit 31 is limited.

  Each unit (function) in FIG. 4 is software realized by processing a program by a CPU in each device.

  FIG. 5 is a diagram illustrating a hardware configuration example of the portable information processing device according to the embodiment of the present invention. In FIG. 5, the portable information processing apparatus 10 includes a ROM 101, a RAM 102, a storage device 103, a CPU 104, a communication interface 105, and the like that are mutually connected by a bus B.

  A program for realizing processing in the portable information processing apparatus 10 is recorded in the ROM 101 or the storage device 103. When a program activation instruction is input, the program is read from the ROM 101 or the storage device 103 and stored in the RAM 102. The CPU 104 executes functions related to the portable information processing apparatus 10 according to a program stored in the RAM 102. The storage device 103 is a non-volatile storage device such as a non-volatile RAM or HDD, and is used, for example, for storing the access permit 50. The communication interface 105 is an interface for communicating with the permit issuing server 20 and the device 30.

  Note that the permit issuing server 20 and the device 30 also include various hardware shown in FIG.

  Hereinafter, a processing procedure of the system in the present embodiment will be described. FIG. 6 is a sequence diagram for explaining a processing procedure in the access permit issuance stage.

  First, the permit download unit 11 of the portable information processing apparatus 10 requests the issuance of an access permit by transmitting request information to the permit issuing unit 21 of the permit issuing server 20 (S101). The request information is composed of the following information.

  FIG. 7 is a diagram illustrating an example of request information for issuing an access permit. In FIG. 7, the request information 210 includes subject information 211, resource information 212, and operation information 213. The subject information 211 is identification information of a subject whose operation is permitted by the access permit 50 when the access permit 50 is issued. The resource information 212 is identification information of a resource whose operation is permitted by the access permit 50 when the access permit 50 is issued. The operation information 213 is identification information of an operation permitted by the access permit 50 when an access permit is issued. A plurality of request information may be specified in one issue request.

  When the request information 210 is received, the permit issuing unit 21 generates an access permit set based on the request information 210 (S102). Here, the access permit set refers to data having a structure capable of storing one or more access permits.

  FIG. 8 shows an example of the structure of an access permit set. In FIG. 8, the access permit set 60 includes a permit number 61 as header information and an array of access permit 50.

  The number of permits 61 indicates the number of elements in the array of access permits 50 included in the access permit set 60. In the figure, permits 50-1 to 50-n correspond to an array of access permits 50. Each access permit 50 corresponds to each request information. That is, when there is one request information, one access permit 50 is stored in the access permit set 60.

  Each access permit 50 includes subject information, resource information, operation information, and responsibility information. The subject information is identification information of the subject of the operation permitted by the access permit 50. The resource information is identification information of a resource whose operation is permitted by the access permit 50. The operation information is identification information of an operation permitted by the access permit 50. The duty information is a duty imposed when executing a permitted operation (a process that is required to be performed when a permitted operation is performed. For example, acquisition of a log is given as a representative example. ) Identification information. A plurality of pieces of responsibility information can be set for one operation.

  Subsequently, the permit issuing unit 21 issues the generated access permit set 60 (access permit 50) (S103). Subsequently, upon receiving the access permit set 60, the permit download unit 11 stores the received access permit set 60 in the storage device 103 (S104).

  Next, the process in step S102 will be described in detail. FIG. 9 is a flowchart for explaining an access permit set generation process by the permit issuing unit.

  In step S201, one access permit 50 registered in the permit repository 22 is taken out.

  FIG. 10 is a diagram showing a configuration example of a permit repository. As shown in FIG. 10, the permit repository 22 is a table that assigns and manages a permit number for each access permit 50 configured by subject information, resource information, operation information, and responsibility information. The permit number is a unique number for each permit. Note that the access permit 50 managed in the permit repository 22 is registered in advance by an administrator or the like for a permitted combination of subject, resource, and operation.

  If the access permit 50 is successfully extracted (Yes in S202), the subject information 211, resource information 212, and operation information 213 in the request information 210, and the subject information, resource information, and operation in the retrieved access permit 50 are displayed. The information is compared (collated) (S203). If all items match (“match” in S203), the access permit 50 is added to the access permit set 60 (S204).

  On the other hand, when at least one of the items does not match (“mismatch” in S203), the addition of the access permit 50 to the access permit set 60 is not executed.

  When the above processing is completed for all the access permits 50 registered in the permit repository 22 (No in S202), the number of access permits 50 added to the access permit set 60 is calculated. It is set as the value of the permit number of 60 (S205).

  When a plurality of pieces of request information are designated, the process of FIG. 9 is repeated for each piece of request information.

  Note that the processing in FIG. 9 determines whether or not the access permit 50 corresponding to the request information can be issued (that is, whether or not the operation related to the operation information 213 on the resource related to the resource information 212 by the entity related to the entity information 211 is permitted. ). That is, when there is no access permit 50 that matches the request information, the access permit 50 corresponding to the request information is not added to the access permit set 60. This means that issuance of the access permit 50, that is, permission of the operation requested in the request information is denied.

  Next, the access permit utilization stage will be described. FIG. 11 is a sequence diagram for explaining the processing procedure in the access permit utilization stage.

  When an operation request is input to the device 30 by an operator (user) of the device 30 (S301), the access control unit 32 of the device 30 sends the determination request information to the operation permission / inhibition determination unit 12 of the portable information processing device 10. To request the permission / inhibition of the operation corresponding to the operation request (S302).

  FIG. 12 is a diagram illustrating an example of determination request information. In FIG. 12, the determination request information 310 includes resource information 311 and operation information 312. The resource information 311 is identification information of a resource that is an operation target in the operation request. The operation information 312 is identification information of an operation according to the operation request.

  In the figure, the identification information of the operator (the subject of the operation) is not included. This is because the present embodiment assumes that the portable information processing apparatus 10 is assigned to each person. In other words, it is assumed that each portable information processing apparatus 10 stores identification information of the assigned operator. Therefore, if the assumption is not satisfied, the determination request information 310 may include identification information (subject information) of the subject of the operation request. In this case, the device 30 needs to specify the subject information. For example, the subject information may be acquired through an operator authentication process.

  In response to the reception of the determination request information 310, the operation permission / rejection determination unit 12 reads the access permit 50 stored in the storage device 103 onto the RAM 102 (S 303), and based on the access permit 50, the determination request information 310 The operation permission / inhibition is determined (S304). Subsequently, the operation permission / rejection determination unit 12 notifies the access control unit 32 of information (determination result information) indicating a determination result of permission / rejection determination (S305).

  FIG. 13 is a diagram illustrating an example of determination result information. In FIG. 13, the determination result information 110 includes permission / rejection information 111, responsibility information 112, and the like. The permission information 111 is information indicating whether or not the operation is permitted. The responsibility information 112 is identification information of the responsibility when the operation is permitted and the responsibility is set for the operation in the access permit 50.

  When the permission information 111 indicates that the operation is permitted, the access control unit 32 causes the service unit 31 to perform an operation related to the operation request (S306). When the determination result information 110 includes the responsibility information 112, the access control unit 32 causes the service unit 31 to execute the responsibility related to the responsibility information 112 (S307). On the other hand, when the permission information 111 indicates that the operation is not permitted, the access control unit 32 does not cause the service unit 31 to perform the operation.

  Next, details of the processing in step S304 will be described. FIG. 14 is a flowchart for explaining the operation permission / rejection determination process by the operation permission / rejection determination unit.

  In step S 401, the access permit 50 having resource information and operation information that match the resource information 311 and the operation information 312 included in the determination request information 310 is searched from the access permit set 60. If the determination request information 310 also includes subject information, the subject information is also determined to match or not match.

  When the access permit 50 matching the determination request information 310 is found (exists) (Yes in S402), it is determined that the operation related to the determination request information 310 is permitted (S404). Subsequently, the duty related to the duty information included in the retrieved access permit 50 is set as the duty for the permitted operation (S404). On the other hand, when the access permit 50 matching the determination request information 310 is not searched (No in S402), it is determined that the operation related to the determination request information 310 is not permitted (S405).

  Subsequent to step S404 or S405, determination result information 110 is generated. That is, the information indicating the determination result in step S403 or S405 is the permission information 111, and in the case of permission determination, the information indicating the responsibility determined in step S404 is the responsibility information 112.

  Next, the contents described above will be explained by applying them to more specific scenes. FIG. 15 is a sequence diagram for explaining a processing procedure in a specific example of the access permit issuance stage. FIG. 16 is a diagram showing an example of a display screen in a specific example of the access permit issuance stage. In FIG. 15, the IC card 10 a is a specific example of the portable information processing apparatus 10. That is, FIG. 15 illustrates an example in which the access permit 50 is downloaded to the IC card 10a. The user I / F control unit 41 is software realized by processing a program in a PC (Personal Computer) 40 to which an IC card reader is connected.

  In step S501, the user I / F control unit 41 causes the display device of the PC 40 to display a screen requesting insertion of the IC card 10a into the IC card reader / writer (screen 411 in FIG. 16). When the user A inserts the IC card 10a into the IC card reader / writer (S502), the user I / F control unit 41 detects the insertion of the IC card 10a and requests a password (screen shown in FIG. 16). 412) is displayed on the display device of the PC 40 (S503). When the password is input by the user A, the user I / F control unit 41 requests authentication of the user A by transmitting the password to the permit download unit 11 of the IC card 10a (S505).

  The permit download unit 11 authenticates the user A by comparing the received password with the password of the user A recorded in the storage device 103, and returns an authentication result to the user I / F control unit 41 ( S506). Note that the user name and password of the user A are recorded in advance as user information in the storage device 103 of the IC card 10a distributed to the user A.

  When the user A is authenticated, the user I / F control unit 41 is a screen for inputting information for identifying an operation for which permission is requested by the access permit 50 and information for identifying a resource that is a target of the operation. (Screen 413 in FIG. 16) is displayed on the display device of the PC 40 (S507). When information and resources for identifying an operation are input by the user on the screen 413 (S508), the user I / F control unit 41 notifies the permit download unit 11 of the input information (S509). Note that the screen 413 of FIG. 16 includes input columns for a used device ID and a used operation. “Copying machine B” is input as the use device ID, and this corresponds to information for identifying the resource. In addition, “copy” is input as the use operation, which corresponds to information for identifying the operation. That is, the screen 413 shows an example in which the user A requests the issuance of the access permit 50 for obtaining the copy operation authority for the copying machine B.

  Subsequently, the permit download unit 11 uses FIG. 7 based on the identification information (user) of the user A stored in the storage device of the IC card 10a and the information input by the user A via the screen 413. Request information 210 as shown is generated, and the request information 210 is transmitted to the permit issuing unit 21 of the permit issuing server 20 to request the issuance of the access permit 50 (S510). In the request information 210, the identification information of the user A is specified in the subject information 211. In the resource information 212, identification information of the copier B is designated. The operation information 213 specifies copy operation identification information. In the request information 210, the user A is requested to issue an access permit 50 for obtaining a copy operation authority for the copying machine B.

  Upon receipt of the request information 210, the permit issuing unit 21 generates an access permit set 60 based on the request information 210 (S511). Details of this processing are as described in FIG. Subsequently, the permit issuing unit 21 transmits the generated access permit set 60 (access permit 50) to the permit download unit 11 (S512). Upon receiving the access permit set 60, the permit download unit 11 stores the received access permit set 60 in the storage device 103 (S513).

  As described above, the access permit 50 that permits the user A to perform the copy operation on the copier B is recorded on the IC card 10a of the user A.

  In FIG. 15, it is assumed that wireless communication is possible between the permit download unit 11 (IC card 10a) and the permit issuance unit 21 (permit issuance server 20). That is, steps S510 and S512 are realized by the wireless communication. However, the user I / F control unit 41 of the PC 40 may be configured to transmit the request information 210 to the permit issuing server 20 and receive the access permit set 60 from the permit issuing server 20. The user I / F control unit 41 transmits the received access permit set 60 to the permit download unit 11. As a result, the access permit 50 is stored in the IC card 10a. In this case, it is only necessary that network communication (whether wired or wireless) is possible between the PC 40 and the permit issuing server 20.

  Next, a processing procedure when the user A executes copying of the copying machine B using the access permit 50 recorded on the IC card 10a will be described. FIG. 17 is a sequence diagram for explaining a processing procedure in a specific example of the access permit utilization stage. FIG. 18 is a diagram showing a display screen example in a specific example of the access permit use stage.

  In step S601, the access control unit 32 of the copier B30a displays a screen requesting insertion of the IC card 10a into the IC card reader (screen 421 in FIG. 18) on the operation panel of the copier B30a. The copier B30a is a specific example of the device 30 in FIG.

  When the user A inserts the IC card 10a into the IC card reader (S602), the access control unit 32 detects the insertion of the IC card 10a and copies the screen for requesting the password (screen 422 in FIG. 18). It is displayed on the operation panel of the machine B 30a (S603). When the password is input by the user A, the access control unit 32 requests authentication of the user A by transmitting the password to the operation permission / rejection determination unit 12 of the IC card 10a (S605).

  The operation permission / rejection determination unit 12 authenticates the user A by comparing the received password with the password of the user A recorded in the storage device 103, and returns an authentication result to the access control unit 32 (S606).

  When the user A is authenticated, the service unit 31 of the copier B30a displays a screen for selecting a function (operation) available in the copier B30a on the operation panel (S607). When the execution of the copy operation is instructed on the displayed screen (S608), the access control unit 32 transmits the determination request information 310 as shown in FIG. A request for permission / inhibition of the copy operation in B30a is requested (S609). That is, here, the identification information of the copying machine B 30 a is specified in the resource information 311 of the determination request information 310, and the identification information of the copy operation is specified in the operation information 312.

  In response to the reception of the determination request information 310, the operation permission / rejection determination unit 12 reads the access permit 50 stored in the storage device 103 onto the RAM 102 (S 610, S 611), and makes a determination request based on the access permit 50. It is determined whether or not the operation relating to the information 310 is permitted (S612). Subsequently, the operation permission / rejection determination unit 12 notifies the access control unit 32 of information indicating the determination result of the permission / rejection determination (determination result information 110 in FIG. 13) (S613). Details of this processing are as described in FIG.

  When the permission information 111 of the determination result information 110 indicates that the copy operation is permitted (Yes in S614), the access control unit 32 causes the service unit 31 to execute the copy operation (S615). When the determination result information 110 includes the responsibility information 112, the access control unit 32 causes the service unit 31 to execute the responsibility (for example, log recording) related to the responsibility information 112 (S616). When the execution of the copy operation or responsibility is completed, the access control unit 32 displays on the operation panel a screen (screen 424 in FIG. 18) notifying that the copy operation or responsibility has been completed (S617).

  On the other hand, if the permission information 111 indicates that the copy operation is not permitted (No in S614), the access control unit 32 displays a screen (screen 423 in FIG. 18) for notifying that the copy operation cannot be used on the operation panel. (S618).

  As described above, according to the computer system of the present embodiment, the access permit 50 is recorded in the portable information processing apparatus 10 that is portable, and the operation permission / inhibition determination is executed based on the access permit 50. Therefore, access control can be appropriately performed even when the device 30 is not connected to the network. Also, it is not necessary to distribute access control information to each system.

  As mentioned above, although the Example of this invention was explained in full detail, this invention is not limited to such specific embodiment, In the range of the summary of this invention described in the claim, various deformation | transformation・ Change is possible.

It is a figure which shows the 1st example of the conventional access control system based on a security policy. It is a figure which shows the 2nd example of the conventional access control system based on a security policy. It is a figure for demonstrating the outline | summary of embodiment of this invention. It is a figure which shows the function structural example of the system in embodiment of this invention. It is a figure which shows the hardware structural example of the portable information processing apparatus in embodiment of this invention. It is a sequence diagram for demonstrating the process sequence in the access permit issue stage. It is a figure which shows the example of the request information of access permit issue. It is a figure which shows the structural example of an access permit set. It is a flowchart for demonstrating the production | generation process of an access permit set. It is a figure which shows the structural example of a permit repository. It is a sequence diagram for demonstrating the process sequence in the access permit utilization stage. It is a figure which shows the example of determination request information. It is a figure which shows the example of determination result information. It is a flowchart for demonstrating the operation permission determination processing by an operation permission determination part. It is a sequence diagram for demonstrating the process sequence in the specific example of an access permit issue stage. It is a figure which shows the example of a display screen in the specific example of an access permit issue stage. It is a sequence diagram for demonstrating the process sequence in the specific example of an access permit utilization stage. It is a figure which shows the example of a display screen in the specific example of an access permit utilization stage.

Explanation of symbols

DESCRIPTION OF SYMBOLS 10 Portable information processing apparatus 11 Permit download part 12 Operation permission determination part 20 Permit issue server 21 Permit issue part 22 Permit repository 30 Equipment 31 Service part 32 Access control part 101 ROM
102 RAM
103 storage device 104 CPU
105 Communication Interface 510 Security Server 520 Document Management System 530 Multifunction Device 540 PC
B bus

Claims (9)

A portable information processing device capable of communicating with an electronic device to be operated,
Storage means for storing data including operation identification information for identifying permitted operations and resource identification information for identifying resources for which the operations are permitted;
Based on the operation identification information and the resource identification information related to the operation request transmitted from the electronic device in response to an input of the operation request, and the data, whether or not the operation request is permitted is determined, and the determination result is determined by the electronic device. A portable information processing apparatus comprising: determination means for transmitting to the apparatus. The data also includes operator identification information for identifying an operator who is permitted to perform the operation ,
Said determination means, said operation identification information relating to the operation request sent from the previous SL electronic device, wherein the resource identification information, and the determined and the operator identification information, the permission of the operation request on the basis of said data The portable information processing apparatus according to claim 1. An electronic device capable of communicating with a portable information processing device,
In response to the input of the operation request, the identification information of the operation related to the operation request, the identification information of the resource to be operated , and the identification information of the operator are transmitted to the portable information processing apparatus, and the identification information An electronic apparatus comprising: control means for controlling an operation in response to the operation request according to a determination result of whether or not the operation request is determined based on the portable information processing apparatus. An operation control method executed by a portable information processing device capable of communicating with an electronic device to be operated,
Data including operation identification information for identifying the permitted operation and resource identification information for identifying the resource for which the operation is permitted is recorded in the storage device,
Based on the operation identification information and the resource identification information related to the operation request transmitted from the electronic device in response to an input of the operation request, and the data, whether or not the operation request is permitted is determined, and the determination result is determined by the electronic device. An operation control method comprising a determination procedure for transmission to an apparatus. The data also includes operator identification information for identifying an operator who is permitted to perform the operation ,
Said determination means, said operation identification information relating to the operation request sent from the previous SL electronic device, wherein the resource identification information, and the determined and the operator identification information, the permission of the operation request on the basis of said data The operation control method according to claim 4. An operation control method executed by an electronic device capable of communicating with a portable information processing device,
Depending on the input of the operation request, a transmission step of transmitting identification information of the operation according to the operation request, the identification information of the resource that is the target of the operation, and the identity of the operator to the portable information processing apparatus,
And a control procedure for controlling an operation in response to the operation request in accordance with a determination result of whether or not the operation request is determined by the portable information processing device based on the identification information. A portable information processing device capable of communicating with an electronic device to be operated,
Storage means for storing data including operation identification information for identifying permitted operations and resource identification information for identifying resources for which the operations are permitted;
Based on the operation identification information and the resource identification information related to the operation request transmitted from the electronic device in response to an input of the operation request, and the data, whether or not the operation request is permitted is determined, and the determination result is determined by the electronic device. An operation control program for functioning as a determination unit that transmits to a device. The data also includes operator identification information for identifying an operator who is permitted to perform the operation ,
Said determination means, said operation identification information relating to the operation request sent from the previous SL electronic device, wherein the resource identification information, and the determined and the operator identification information, the permission of the operation request on the basis of said data The operation control program according to claim 7. An electronic device capable of communicating with a portable information processing device
In response to the input of the operation request, the identification information of the operation related to the operation request, the identification information of the resource to be operated , and the identification information of the operator are transmitted to the portable information processing apparatus, and the identification information The operation control program for functioning as a control means which controls the operation | movement with respect to the said operation request | requirement according to the determination result of the permission / prohibition of the said operation request | requirement determined based on the said portable information processing apparatus.

Images