TWI714159B - User authentication management system and method - Google Patents

Abstract

A user authentication management system and a method thereof are provided, which are suitable for allocating authorities to one or more user devices. The system includes one or more docking stations and a management information device. Each user device is connected to the docking station. Each docking station is configured to transmit user identification information obtained from the user devices. The management information device is connected to the one or more docking stations and stores a user authentication database. The management information device is configured to look up a user identity corresponding to the user identification information of each user device and authentication granted to the user identity from the user authentication database. The management information device allows each user device to use resources in accordance with the granted authentications.

Description

User authority management system and method

The invention relates to a management system and method, in particular to a user authority management system and method.

With the development of Internet technology, Internet users have gradually increased. The Internet has become an indispensable factor in people’s lives and work. There are local networks in our homes and companies, such as corporate networks and home networks. Wait. In a local area network, how to distinguish between different network users and assign corresponding permissions according to different users has become an important topic. For example, in a company network, it is hoped to distinguish between different users such as bosses, administrators, and employees. These users are assigned different permissions.

The technical problem to be solved by the present invention is to provide a user authority management system in view of the shortcomings of the prior art, which is suitable for allocating the authority of one or more client devices. This user authority management system includes one or more expansion devices and management information devices. One or more expansion devices provide the connection between the client device and the expansion device. The expansion device is configured to transmit user identification information obtained from the connected client device. The management information device is connected to one or more expansion devices. The management information device stores the user authority database. The management information device configuration is used to find the user identity corresponding to the user identification information of the client device and the permission to use the user identity from the user permission database to control the resources within the permission of the client device to be used by the expansion device.

In addition, the present invention provides a user authority management method, which is suitable for allocating the authority of one or more client devices, including the following steps: configure one or more expansion devices, provide the client device to connect with one of the expansion devices, and expand The client device connected to the device obtains user identification information and transmits user identification information; configures the management information device to store the user authority database; uses the management information device to find the user identity and permission corresponding to the user identification information from the user authority database The authority used by the user as a user; and using the management information device to control the expansion device to allow the client device to use the resources within the authority.

As described above, the present invention provides a user authority management system and method, which can connect multiple client devices with a management information device through an expansion device, and use the expansion device to transmit identification information of the client device connected to the expansion device to the management information device , The management information device matches the identification information of the client device with the identification information stored in the user authority database. If the matching is successful, the client device is allowed to use the network within the network authority corresponding to the identification information in the user authority database Resources, to effectively manage and control the access rights of pre-launched users and the usage rights of network resources.

In order to further understand the features and technical content of the present invention, please refer to the following detailed description and drawings about the present invention. However, the provided drawings are only for reference and description, and are not used to limit the present invention.

The following are specific specific examples to illustrate the implementation of the "light emitting device" disclosed in the present invention. Those skilled in the art can understand the advantages and effects of the present invention from the content disclosed in this specification. The present invention can be implemented or applied through other different specific embodiments, and the item details in this specification can also be modified and changed based on different viewpoints and applications without departing from the concept of the present invention. In addition, the drawings of the present invention are merely schematic illustrations, and are not drawn according to actual dimensions, and are stated in advance. The following embodiments will further describe the related technical content of the present invention in detail, but the disclosed content is not intended to limit the protection scope of the present invention.

It should be understood that although terms such as "first", "second", and "third" may be used herein to describe various elements or signals, these elements or signals should not be limited by these terms. These terms are mainly used to distinguish one element from another, or one signal from another signal. In addition, the term "or" used in this article should, depending on the actual situation, possibly include any one or a combination of more of the associated listed items.

[First Embodiment]

Please refer to FIG. 1, which is a block diagram of a user authority management system according to a first embodiment of the present invention. As shown in FIG. 1, the user authority management system 1 of the first embodiment of the present invention includes an expansion device (Docking Station) DOCK and a management information device (Management Information System) MIS, which is suitable for allocating the authority of one or more client devices. For example, the permissions of the two client devices USER1 and USER2 are the permissions to access the network.

The common expansion device DOCK may be installed in a space such as an entire company, or multiple expansion devices DOCK may be respectively installed in multiple sub-spaces divided by the space, such as multiple conference rooms. The expansion device DOCK can have multiple expansion slots.

Both ends of the connector can be respectively inserted into the port of the client device USER1 or USER2 and the expansion slot of the expansion device DOCK to electrically connect the client device USER1 or USER2 and the expansion device DOCK. As shown in Figure 1, in this embodiment, the expansion device DOCK has two USB expansion slots, and the two client devices USER1 and USER2 have USB ports respectively. In practice, they can be replaced with different types of expansion slots and The connection port is only illustrated here, and the present invention is not limited thereto.

The management information device MIS can be wirelessly connected to the expansion device DOCK, and configured to control the expansion device DOCK to manage the network permissions of multiple client devices USER1 and USER2. The management information device MIS can pre-store a user authority database, which has the user identities of the client devices USER1, USER2, such as visitors, customers, bosses, supervisors, employees, etc., and different permissions set for different levels of user identities. For example, all web pages can be accessed or only specific web pages can be accessed.

If the client devices USER1 and USER2 attempt to access the network to use network resources, the client devices USER1 and USER2 can be wired to the expansion device DOCK. The expansion device DOCK can obtain the user identification information ID of the connected client devices USER1 and USER2. For example, the user identification information ID is the unique identification code of the client device USER1 or USER2, such as the IP address or MAC address of the client device USER1 or USER2. This is only an example, and the present invention is not limited to this.

Network switches NESW1 and NESW2 can be installed between the expansion device DOCK and the management information device MIS. The expansion device DOCK can transmit the user identification information IDs of the client devices USER1 and USER2 respectively to the management information device MIS through the network switches NESW1 and NESW2.

The management information device MIS can search for the user identity corresponding to the user identification information of the client devices USER1 and USER2 from the user authority database stored in it, and the permissions allowed to use the user identity to control the expansion device DOCK to allow the client device USER1 and USER2 use resources within their authority.

For example, the management information device MIS restricts the client device USER1 to only download the original files in the company's dedicated network shared folder, but does not have the network permissions to modify, delete the content of these original files, and upload new files. In contrast, the client device USER2 has network permissions to upload, download, modify, and delete original or new files.

Please refer to FIG. 2, FIG. 3, and FIG. 4 together. FIG. 2 is a block diagram of a user authority management system according to a second embodiment of the present invention; FIG. 3 is an unconfirmed expansion device of the user authority management system according to a second embodiment of the present invention and The schematic diagram of the client device; FIG. 4 is a schematic diagram of the authenticated expansion device and the identification information of the client device of the user authority management system according to the second embodiment of the present invention.

As shown in FIG. 2, the user authority management system of the second embodiment of the present invention includes a plurality of, for example, five expansion devices DOCK1, DOCK2, DOCK3, DOCK4, DOCK5, and a management information device MIS, which is suitable for distributing multiple, for example, five client terminals. Device USER1, USER2, USER3, USER4, USER5 permissions. The client devices USER1 to USER5 can be notebook computers, mobile devices, or other electronic devices, which are only examples for illustration, and the present invention is not limited thereto.

The client devices USER1~USER5 can be electrically connected with the expansion devices DOCK1~DOCK5, respectively. Each expansion device DOCK1~DOCK5 can have a detection module to detect the connection status of the client device USER1~USER5 and the expansion device DOCK1~DOCK5 respectively.

In this embodiment, each expansion device DOCK1 to DOCK5 is only connected to a single client device USER1. However, in practice, each expansion device DOCK1~DOCK5 can have multiple expansion slots, and some or all of the client devices USER1~USER5 can share the same expansion device.

The network switch NESW1 is arranged between the expansion devices DOCK1, DOCK2 and the management information device MIS. In addition, the network switch NESW2 and the network switch NESW1 are installed between the client devices USER3, USER4, USER5 and the management information device MIS.

As shown in Figure 3, before the expansion devices DOCK1~DOCK5 are not wirelessly connected to the management information device MIS, the management information device MIS cannot identify the expansion devices DOCK1~DOCK5 and the client devices USER1~USER5 connected to the expansion devices DOCK1~DOCK5. At this time, the management information device MIS can receive a permission setting request from an external electronic device such as a cloud server, and pre-set multiple client devices USER1~USER5 that may be connected to the expansion device DOCK1~DOCK5 or other unexpected clients based on it. Permission for devices such as temporary visitors.

When the user position of the client device USER1~USER5 is changed or another user is used, the management information device MIS can update the permissions of the client device USER1~USER5 in the stored user permission database. When a new client device is added or a new client device replaces the original client device USER1~USER5, the management information device MIS can increase the user identification information of the new client device in the user authority database, such as IP address or MAC address To set the permissions allowed by the user identity of the new client device.

Optionally, in order to facilitate the confirmation of whether the identities of the users of the client devices USER1~USER5 are changed, an authentication procedure can be added. For example, when the client device USER1~USER5 is wired to the expansion device DOCK1~DOCK5, and the expansion device DOCK1~DOCK5 is wirelessly connected to the management information device MIS, the management information device MIS can request the client device connected to the expansion device DOCK1~DOCK5 The users of USER1~USER5 respond to their identification information such as personal information (including name, job class, etc.) or a set of identification codes representing personal information.

The management information device MIS can authenticate personal information and identification codes, and determine the permissions of the client devices USER1~USER5. When the personal information and ID codes obtained by the management information device MIS are different from the original personal information and ID codes of the client devices USER1~USER5, it is determined that the users of the client devices USER1~USER5 have been replaced or the position level has been adjusted. In this case, the management information device MIS can update the user identity data of the client devices USER1~USER5 stored in the user permission database, and reset the permissions for the new user identity data.

In addition to the authority of the client devices USER1~USER5 depending on the user identity corresponding to the user identification information of the client devices USER1~USER5, it can also depend on the extended identification of the expansion devices DOCK1~DOCK5 connected to the client devices USER1~USER5 The expansion device information corresponding to the information, such as its set location.

For example, the management information device MIS can store the extended identification information of the expansion devices DOCK1~DOCK5 and the corresponding permissions in the user permissions database. When the client device USER1~USER5 is connected to the expansion device DOCK1~DOCK5, the management information device MIS can identify the expansion device DOCK1~DOCK5 according to the expansion identification information, and then according to the expansion identification information of the expansion device DOCK1~DOCK5 and the client device USER1~USER5 The user identification information determines the permissions of the client devices USER1~USER5 connected to the expansion devices DOCK1~DOCK5.

Please refer to FIG. 5, which is a flowchart of the steps of a user authority management method according to a third embodiment of the present invention. As shown in FIG. 5, the user authority management method of the third embodiment of the present invention includes the following steps S501 to S517.

In step S501, the information management device may set network permissions of one or more client devices, store user identification information of one or more client devices and their corresponding network permissions, and create a user permission database. This embodiment takes the network authority as an example, but it should be understood that the information management device can also manage the use authority of the client device for other resources, such as displaying the screen of the client device synchronously through the display device. This is only an example for illustration. Not limited to this.

In step S503, the client device can be selectively connected to any one of the multiple expansion devices. For example, the client device determines which expansion device to connect to according to its location. It should be understood that the position of the client device can be changed, so the connector can be pulled out from the expansion slot of one expansion device and inserted into the expansion slot of another expansion device.

In step S505, when the detection module of the expansion device detects that the client device is connected to it, the processing module of the expansion device can open the authentication authority to the connected client device, and output a user identity authentication request to the client device to request The client device provides user identification information.

In step S507, when the client device receives the identity authentication request, it can respond to the user identification information to the expansion device to request identity verification.

In step S509, the expansion device wirelessly transmits the user identification information of the client device to the management information device via the network, and requests the management information device to verify the client device.

In step S511, the information management device may compare the user identification information provided by the client device with the user identification information stored in the user authority database, search for the user identity corresponding to the user identification information stored in the user authority database, and allow processing The network permissions of the module.

In step S513, the information management device searches for the network permissions permitted by the user identity of the client device in the user permission database, and issues the network permissions of the client device.

In step S515, the expansion device notifies the client device that the identity verification has been completed.

In step S517, the expansion device allows the client device to use network resources within the network permissions allowed by the information management device, such as accessing specific web pages and accessing data in specifications.

[Beneficial effects of the embodiment]

In summary, the present invention provides a user authority management system and method, which can connect multiple client devices and management information devices through an expansion device, and use the expansion device to transmit the identification information of the client device connected to the expansion device to the management information Device, the management information device matches the identification information of the client device with the identification information stored in the user authority database. If the matching is successful, the client device is allowed to use the network within the network authority corresponding to the identification information in the user authority database. Route resources to effectively manage and control the access rights of pre-launched users and network resource usage rights.

The content disclosed above is only a preferred and feasible embodiment of the present invention, and does not limit the scope of the patent application of the present invention. Therefore, all equivalent technical changes made using the description and schematic content of the present invention are included in the application of the present invention. Within the scope of the patent.

DOCK, DOCK1~DOCK5: Expansion device

MIS: Management Information Device

USER1~USER5: client device

NESW1, NESW2: network switch

S501~S517: steps

Fig. 1 is a block diagram of a user authority management system according to a first embodiment of the present invention.

Fig. 2 is a block diagram of a user authority management system according to a second embodiment of the present invention.

3 is a schematic diagram of an unconfirmed expansion device and a client device of the user authority management system according to the second embodiment of the present invention.

4 is a schematic diagram of the identification information of the authenticated expansion device and the client device of the user authority management system according to the second embodiment of the present invention.

Fig. 5 is a flow chart of the steps of a user authority management method according to a third embodiment of the present invention.

DOCK1~DOCK5: Expansion device

MIS: Management Information Device

USER1~USER5: client device

NESW1, NESW2: network switch

Claims (10)

A user authority management system is suitable for allocating the authority of one or more client devices. The user authority management system includes: an expansion device for connecting the client device to the expansion device and configured to transmit the connected user A user identification information obtained by the end device; and a management information device connected to the expansion device, and the expansion device is connected between the management information device and the client device, the management information device stores a user authority database, wherein When the client device is wired to the expansion device, and the expansion device is wirelessly connected to the management information device, the management information device is configured to request the expansion device to respond to the user contained in the user identification information of the user of the expansion device A name and a position level of the user of the end device are used to search for a user identity corresponding to the user identification information of the client device and a permission for the user identity from the user authority database to control The expansion device allows the client device to use the resources within the authority; wherein when the management information device compares the user authority database with the user identification information, it determines the position and rank of the name currently obtained from the client device The original user of the client device has a different job level, to determine that the user’s job level of the client device has been adjusted, the management information device updates the user of the client device stored in the user authority database Identity data, and reset the user’s authority for the new user’s identity data. For example, in the user authority management system described in item 1 of the scope of patent application, the management information device determines the use authority of the client device based on the user identification information of the client device and an extended identification information of the expansion device. For example, the user authority management system described in item 1 of the scope of patent application further includes a first network switch connected between the management information device and at least one expansion device; the first network switch is configured to allow The management information device and the at least one extension Transfer network resources between charging devices through the network. For example, the user authority management system described in item 3 of the scope of patent application further includes a second network switch connected between the first network switch and the other one or more expansion devices; the first network The channel switch and the second network switch are configured to allow the management information device and the one or more expansion devices to transmit network resources through the network. For the user authority management system described in item 1 of the scope of the patent application, the user identification information includes an IP address or a MAC address of the client device. A network user authority management method is suitable for allocating the authority of one or more client devices. The user authority management method includes the following steps: configuring an expansion device, providing the client device to connect with the expansion device, and then connecting with the expansion device. The client device connected to the device obtains user identification information and transmits the user identification information; configures a management information device to store a user authority database; uses the management information device to request the expansion device to respond to the user of the expansion device The user identification information contains a name and a position level of the user of the client device, based on which a user identity corresponding to the user identification information is searched from the user authority database and the user identity is allowed to use Use the management information device to control the expansion device to allow the client device to use the network resources within the permission; and use the management information device to compare the user authority database with the user identification information to determine the current Whether the job rank of the name obtained from the client device is the same as the job rank of the original user of the client device, if so, continue to perform the previous step, if not, determine the job rank of the user of the client device When adjusted, update the user ID data of the client device stored in the user authority database, and reset the user ID data for the new user ID The user's authority. For example, the network user authority management method described in item 6 of the scope of the patent application further includes the following steps: using the management information device, based on the user identification information of the client device and an extended identification information of the expansion device to determine The permission to use the client device. For example, the network user authority management method described in item 6 of the scope of patent application further includes the following steps: configuring a first network switch, which is connected between the management information device and at least one expansion device; and using the first network switch A network switch allows network resources to be transmitted between the management information device and the at least one expansion device through the network. The network user authority management method described in item 8 of the scope of patent application further includes the following steps: configure a second network switch, which is connected to the first network switch and the other one or more expansion devices And using the first network switch and a second network switch to allow the management information device and the other one or more expansion devices to transmit network resources through the network. In the method for managing network user rights as described in item 6 of the scope of patent application, the user identification information includes an IP address or a MAC address of the client device.

Images