Manager server, agent management system, and agent management method

Abstract

This system provides a manager server, agent management system, and agent management method that allow users to set and manage confidential information with minimal effort, while preventing the leakage of confidential information once it has been set for each agent. [Solution] In the agent management system, the manager server manages the commands executed by the agents, receives a request from the user computer 101 to issue first initial authentication information used when an agent makes its first connection to the manager server, generates the first initial authentication information, and sends it to the user computer. Each agent, using the first initial authentication target information obtained from the user computer, generates unique secret information to be used for subsequent connections when the first connection is made by the agent, and sends it to the agent.

Description

Technical Field

[0001] The present disclosure relates to a manager server, an agent management system, and an agent management method.

Background Art

[0002] Conventionally, there is known an agent management system including a user computer operated by a user (administrator), a plurality of agents that execute commands, and a manager server that manages the command execution schedules of the respective agents, wherein the manager server authenticates the respective agents and manages them.

[0003] In the above agent management system, at the time of user authentication, the IDs and secret information (such as passwords) of the respective agents are registered from the user computer to the manager server. Next, the IDs and secret information registered in the manager server are notified to and set for each agent from the user computer. Then, each agent connects (accesses) to the manager server using the set ID and secret information, and acquires information on the command execution schedule from the manager server.

Prior Art Documents

Patent Documents

[0004]

Patent Document 1

Summary of the Invention

Problems to be Solved by the Invention

[0005] However, in the current system described above, the administrator manages the confidential information of each agent on the user computer. As the number of agents increases, the effort required to register the ID and confidential information of each agent on the manager server, as well as the effort required to configure the ID and confidential information for each agent, increases. Furthermore, because confidential information is managed on user computers connected to an external network, this confidential information is exposed to the risk of leakage. If such confidential information is leaked, the administrator will need to re-register the confidential information of each agent on the manager server and reconfigure each agent. As described above, the current system has the problem of being cumbersome to operate.

[0006] In light of these circumstances, this disclosure proposes a technology that enables users (administrators) to set and manage confidential information with minimal effort, and prevents the leakage of confidential information once it has been set on each agent. [Means for solving the problem]

[0007] To address the above issues, this disclosure provides a manager server for managing commands executed by at least one agent, A storage device that holds at least one program for managing the aforementioned agent, A processor that reads the program from the storage device, generates secret information for uniquely authenticating each of the at least one agent, and authenticates the connection from the at least one agent based on the secret information, The aforementioned processor, A process of receiving a request from a user computer different from the at least one agent to issue first initial authentication information used by the at least one agent when it first connects to the manager server, A process for generating the first initial authentication information in response to the request for issuance of the first initial authentication information, The process of transmitting the aforementioned first initial authentication information to the user computer as the first initial authentication target information, When each of the at least one agent makes its first connection using the first initial authentication target information obtained from the user computer, the process of each of the at least one agent generating the secret information to be used for subsequent connections and sending it to each of the at least one agent, I propose a manager server to execute this.

[0008] Further features relating to this disclosure will become apparent from the description herein and the accompanying drawings. Furthermore, aspects of this disclosure are achieved and realized by elements and various combinations of elements and the aspects of the hereafter detailed description and the accompanying claims. It should be understood that the descriptions herein are merely typical examples and do not limit the scope of the claims or applications in any way. [Effects of the Invention]

[0009] According to the technology disclosed herein, the possibility of leakage of confidential information once it has been set for each agent can be eliminated, and users (administrators) can set and manage confidential information with minimal effort. [Brief explanation of the drawing]

[0010] [Figure 1] This figure shows an example of the schematic configuration of the agent management system 100 according to the embodiment of this disclosure. [Figure 2A] This figure shows an example configuration of authentication information 10211 used during the initial connection. [Figure 2B] This figure shows an example configuration of the agent information list 10212. [Figure 3] This flowchart explains the authentication information registration process used during the initial connection. [Figure 4]This flowchart explains the process of generating and registering authentication information used during the initial connection on manager server 102. [Figure 5] This flowchart explains the process of registering authentication information 10211 used during the initial connection for each agent 103_k. [Figure 6] This flowchart explains the process by which each agent 103_k requests agent information generation / transmission from the manager server 102 and registers the agent information obtained from the manager server 102. [Figure 7] This flowchart illustrates the contents of the agent information generation and registration process that the manager server 102 performs in response to requests from each agent 103_k. [Figure 8] This flowchart explains the process that each agent 103_k executes: requesting the use of manager functions from the manager server 102 and obtaining the results of the manager functions from the manager server 102. [Figure 9] This is a flowchart illustrating the manager function processing performed by manager server 102. [Figure 10] This flowchart explains the process of re-registering the authentication information used for the initial connection after the initial authentication information used for the initial connection from user computer 101 has been leaked. [Figure 11] This flowchart explains the process performed by manager server 102 to regenerate and register new authentication information for the initial connection after the leakage of the old authentication information used during the initial connection. [Figure 12] This flowchart explains the process of re-registering the authentication information (new) used during the initial connection, which is performed by each target agent 103_k. [Figure 13]It is a diagram showing a configuration example of a GUI (Graphical User Interface) 1300 used when issuing authentication information for use at the time of the first connection, which is displayed on the display screen of the user computer 101. [Figure 14] It is a diagram showing a configuration example of a GUI 1400 when registering authentication information for use at the time of the first connection to each agent 103_k, which is displayed on the display screen of the user computer 101. [Figure 15] It is a diagram showing a configuration example of list information 1500 of agent names for which agent information has been registered.

Embodiments for Carrying Out the Invention

[0011] Hereinafter, this embodiment will be described with reference to the accompanying drawings. In the accompanying drawings, functionally identical elements may be denoted by the same numbers in some cases, and duplicate explanations will be omitted. Note that the accompanying drawings show specific embodiments and examples in accordance with the principles of the present disclosure, but these are for the purpose of understanding the present disclosure and are not used to limit the interpretation of the present disclosure in any way.

[0012] In this embodiment, although the description is made in sufficient detail for those skilled in the art to implement the present disclosure, other implementations and forms are also possible, and it is necessary to understand that changes in configuration and structure and replacement of various elements can be made without departing from the scope and spirit of the technical idea of the present disclosure. Therefore, the following description should not be construed as being limited thereto.

[0013] <Configuration Example of Agent Management System 100> FIG. 1 is a diagram showing a schematic configuration example of an agent management system 100 according to an embodiment of the present disclosure.

[0014] The agent management system 100 includes a user computer 101 operated by a user (administrator), a manager server 102, at least one agent 103_1 to 10 _3n, and a network 104 connecting these.

[0015] The manager server 102 includes an authentication information management unit 1021 and a manager function unit 1022. The authentication information management unit 1021 holds authentication information 10211 used during the initial connection and a list of agent information 10212. The manager function unit 1022 includes a schedule management unit 10221 and an agent request processing unit 10222. The schedule management unit 10221 manages the schedule of commands to be executed by each agent. The agent request processing unit 10222 receives requests from each agent 103_k (k=1,2,···,n), and if authentication is OK (if it is determined that the connection is appropriate), it obtains the schedule for executing commands from the schedule management unit 10221 and notifies (provides) each agent 103_k of the authentication result and schedule.

[0016] Each agent 103_k has an authentication information processing unit 1031 and an agent function unit 1032. The authentication information processing unit 1031 holds authentication information 10311 used during the initial connection, and agent information 10312 including the agent ID and secret information, which are received from the user computer 101. The agent function unit 1032 includes a manager notification processing unit 10321 and a command execution processing unit 10322. The manager notification processing unit 10321 notifies the manager server 102 that the manager function (manager function unit 1022) will be used, receives the authentication result and schedule information from the manager server 102, and if authentication is OK, passes the schedule information to the command execution processing unit 10322. The command execution processing unit 10322 executes a command (for example, a command to execute the process of the agent 103_k acquiring its performance information and sending it to the manager server 102) according to the acquired schedule information.

[0017] Furthermore, the specific functions of the manager function unit 1022 and the agent function unit 1032 are not limited to those described above, and may be configured to perform other functions.

[0018] <Example configuration of authentication information 10211 and agent information list 10212 used during the initial connection> Figure 2A shows an example configuration of authentication information 10211 used during the initial connection. Figure 2B shows an example configuration of agent information list 10212.

[0019] In Figure 2A, the authentication information 10211 used during the initial connection is generated by the manager server 102 in response to a request from the user computer 101. This authentication information is used by each agent 103_k when connecting to the manager server 102 for the first time. When the initial authentication is successful (when the initial connection is appropriate), agent information (including secret information unique to each agent 103_k and used for subsequent connections) is generated for each agent_k to use the manager function (function of the manager function unit 1022). The authentication information 10211 can be generated, for example, using a GU_ID (Globally Unique ID).

[0020] In Figure 2B, the agent information list 10212 includes the following components: an agent ID 102121 for uniquely identifying each agent, secret information 102122 used for authentication when using the manager function, and an agent name 102123. The agent ID 102121 and secret information 102122 can also be generated using the GU_ID, similar to the authentication information 10211 used during the initial connection. The manager server 102 manages the agent ID 102121 and secret information 102122 in association with the agent name 102123.

[0021] <Contents of the authentication information registration process used during the initial connection> Figure 3 is a flowchart illustrating the authentication information registration process used during the initial connection.

[0022] (i) Step S301 In response to user (administrator) input, the processor of user computer 101 (not shown; hereinafter simply referred to as "user computer 101") requests manager server 102 to generate and send authentication information to user computer 101, which each agent will use when connecting to manager server 102 for the first time.

[0023] (ii) Step S302 When the manager server 102 receives a request for authentication information issuance, it executes the process of generating and registering authentication information to be used during the initial connection (see Figure 4), and sends the generated authentication information 10211 to the user computer 101.

[0024] (iii) Step S303 The user computer 101 obtains authentication information 10211 from the manager server 102 to be used during the initial connection.

[0025] (iv) Step S304 The user computer 101 sends authentication information 10211 to each agent 103_k to be used during the initial connection, and requests (instructs) them to register.

[0026] (v) Step S305 Each agent performs the registration process for authentication information 10211, which will be used during the initial connection (see Figure 5).

[0027] <Contents of the process for generating and registering authentication information used during the initial connection> Figure 4 is a flowchart illustrating the process of generating and registering authentication information used during the initial connection on the manager server 102.

[0028] (i) Step S401 The authentication information management unit 1021 receives requests from the user computer 101 to generate and send authentication information to the user computer 101 for use during the initial connection.

[0029] (ii) Step S402 The authentication information management unit 1021 generates authentication information 10211 to be used during the initial connection, for example, using the GU_ID.

[0030] (iii) Step S403 The authentication information management unit 1021 registers the authentication information 10211, which was generated in step S402 and will be used during the initial connection, in the DB (storage device).

[0031] (iv) Step S404 The authentication information management unit 1021 issues (transmits) the authentication information 10211 to the user computer 101 to be used during the initial connection.

[0032] <Details of the registration process for authentication information 10211 used during the initial connection> Figure 5 is a flowchart illustrating the process of registering authentication information 10211 used during the initial connection for each agent 103_k.

[0033] (i) Step S501 Each agent 103_k's authentication information processing unit 1031 receives the authentication information 10211 to be used during the initial connection and its registration request from the user computer 101.

[0034] (ii) Step S502 The authentication information processing unit 1031 of each agent 103_k registers the authentication information 10211 to be used during the initial connection, which was obtained in step S501, in the DB (storage device).

[0035] <Contents of Agent Information Generation / Sending Request and Registration Process> Figure 6 is a flowchart illustrating the process by which each agent 103_k requests agent information generation / transmission from the manager server 102 and registers the agent information obtained from the manager server 102.

[0036] (i) Step S601 The authentication information processing unit 1031 of each agent 103_k determines whether the authentication information 10211 to be used during the initial connection is registered in the DB (storage device). If the authentication information 10211 to be used during the initial connection is registered (Yes in step S601), the process proceeds to step S602. If the authentication information 10211 to be used during the initial connection is not registered (No in step S601), the agent information registration process ends. In this case, each agent 103_k waits until it receives the authentication information 10211 to be used during the initial connection from the user computer 101.

[0037] (ii) Step S602 The authentication information processing unit 1031 obtains the authentication information 10211 to be used during the initial connection from the DB (storage device).

[0038] (iii) Step S603 The authentication information processing unit 1031 notifies (sends) the manager server 102 of the authentication information 10211 and agent name to be used during the initial connection.

[0039] (iv) Step S604 The manager server 102 executes the agent registration process (see Figure 7) and notifies the initial authentication result (initial authentication failed or initial authentication successful + agent information).

[0040] (v) Step S605 The authentication information processing unit 1031 obtains the initial authentication result from the manager server 102.

[0041] (vi) Step S606 The authentication information processing unit 1031 determines whether the initial authentication was successful based on the initial authentication result obtained from the manager server 102. If the initial authentication is successful (Yes in step S606), the process proceeds to step S607. If the initial authentication is unsuccessful (No in step S606), the agent information registration process by each agent is terminated.

[0042] Initial authentication fails, for example, when the authentication information 10211 registered in the manager server 102 does not match the authentication information 10211 obtained by each agent 103_k from the user computer 101. In this case, each agent 103_k may notify the user computer 101 that the initial authentication failed and request that the previously sent initial authentication information 10211 be resent, or request that the registration process for the correct initial connection information be re-executed.

[0043] (vii) Step S607 The authentication information processing unit 1031 registers the agent information (agent ID 102121 and secret information 102122) obtained from the manager server 102 in the DB (storage device).

[0044] <Contents of agent information generation and registration process by the manager server> Figure 7 is a flowchart illustrating the contents of the agent information generation and registration process that the manager server 102 performs in response to requests from each agent 103_k.

[0045] (i) Step S701 The authentication information management unit 1021 of the manager server 102 receives the authentication information 10211 and agent name to be used during the initial connection from each agent 103_k.

[0046] (ii) Step S702 The authentication information management unit 1021 determines whether the authentication information 10211 to be used during the initial connection, received from each agent 103_k, is registered in the DB (authentication using the authentication information to be used during the initial connection). If the authentication information 10211 to be used during the initial connection is registered in the DB (Yes in S702), the process proceeds to step S703. If the authentication information 10211 to be used during the initial connection is not registered in the DB (No in step S702), the process proceeds to step S706.

[0047] (iii) Step S703 The authentication information management unit 1021 generates agent information (agent ID 102121 and secret information 102122) using, for example, the GU_ID.

[0048] (iv) Step S704 The authentication information management unit 1021 registers agent information in the DB (storage device) by associating it with agent name 102123 (see Figure 2B).

[0049] (v) Step S705 The authentication information management unit 1021 notifies each agent 103_k that the initial authentication was successful and that the generated agent information has been generated.

[0050] (vi) Step S706 The authentication information management unit 1021 notifies each agent 103_k that the initial authentication failed.

[0051] <Details of manager function usage requests and result retrieval processes by each agent> Figure 8 is a flowchart illustrating the process performed by each agent 103_k to request manager functionality from the manager server 102 and to obtain the results of the manager functionality from the manager server 102.

[0052] (i) Step S801 The authentication information processing unit 1031 of each agent 103_k determines whether or not agent information 10312 is registered in the DB (storage device). If agent information 10312 is registered in the DB (storage device) (Yes in step S801), the process proceeds to step S802. If agent information 10312 is not registered in the DB (storage device) (No in step S801), the manager function usage request and result acquisition process by each agent is terminated. The case where agent information 10312 is not registered in the DB (storage device) includes, for example, cases where each agent 103_k intended to register agent information 10312 through the agent information generation / transmission request and registration process (Figure 6) but was not, or cases where each agent 103_k attempts to use the manager function without obtaining agent information 10312.

[0053] (ii) Step S802 The authentication information processing unit 1031 obtains agent information 10312 from the DB (storage device).

[0054] (iii) Step S803 The authentication information processing unit 1031 passes agent information 10312 to the agent function unit (hereinafter simply referred to as the "agent function unit") 1032, which uses the manager function.

[0055] (iv) Step S804 The manager notification processing unit 10321 of the agent function unit 1032 sends agent information 10312 and a request to use the manager function to the manager server 102.

[0056] (v) Step S805 The manager server 102 executes manager function processing (Figure 9) and sends the results (authentication result and, if authentication is OK, command execution schedule information) to each agent 103_k.

[0057] (vi) Step S806 The manager notification processing unit 10321 obtains the processing results of the manager function from the manager server 102.

[0058] (vii) Step S807 The manager notification processing unit 10321 checks whether the authentication result based on the agent information 10312 was OK or not. If the authentication result is OK (Yes in step S807), the process proceeds to step S808. If the authentication result is NG (No in step S807), the manager function usage request and result acquisition process by each agent is terminated.

[0059] (viii) Step S808 The command execution processing unit 10322 of the agent function unit 1032 executes commands according to the commands and command schedule information included in the processing results of the manager function.

[0060] <Contents of manager function processing by the manager server> Figure 9 is a flowchart illustrating the manager function processing performed by the manager server 102.

[0061] (i) Step S901 The manager function unit 1022 (hereinafter simply referred to as the "manager function unit") used by the agents of the manager server 102 receives agent information 10312 and requests to use the manager function from each agent 103_k.

[0062] (ii) Step S902 The manager function unit 1022 passes the agent information 10312 obtained in step S901 to the authentication information management unit 1021.

[0063] (iii) Step S903 The authentication information management unit 1021 receives information from each agent 103_k and checks whether the agent information 10312 received in step S902 is registered in the agent information list 10212. If the agent information 10312 is registered in the agent information list 10212 (Yes in step S903), the process proceeds to step S904. If the agent information 10312 is not registered in the agent information list 10212 (No in step S903), the process proceeds to step S907.

[0064] (iv) Step S904 The authentication information management unit 1021 notifies the manager function unit 1022 that authentication is OK.

[0065] (v) Step S905 The manager function unit 1022 processes requests for the use of manager functions from each agent 103_k. Specifically, the manager function unit 1022 generates manager function processing results that include the commands to be executed by each agent 103_k and command execution schedule information.

[0066] (vi) Step S906 The manager function unit 1022 sends (notifies) the authentication result (authentication OK) and the manager function processing result to each agent 103_k.

[0067] (vii) Step S907 The authentication information management unit 1021 notifies the manager function unit 1022 of the authentication result (authentication failed).

[0068] (viii) Step S908 The manager function unit 1022 sends (notifies) each agent 103_k that authentication failed.

[0069] <Details of the authentication information re-registration process for the first connection after an authentication information leak> Figure 10 is a flowchart illustrating the process of re-registering the authentication information used during the initial connection after the authentication information used during the initial connection has been leaked from the user computer 101. While this example uses the case where the authentication information used during the initial connection has been leaked, it is not limited to this scenario. The authentication information used during the initial connection may be re-registered periodically, or for reasons other than leakage (such as when the user decides to change it).

[0070] (i) Step S1001 In response to instructions from the user (administrator), the user computer 101 sends a request to the manager server 102 to reissue the authentication information used during the initial connection. The reissued authentication information used during the initial connection is the information used when agent 103_k, which had not acquired agent information at the time of the leak, acquires and registers agent information.

[0071] (ii) Step S1002 The manager server 102 executes a process (Figure 11) to regenerate and register the authentication information (new) to be used for the first connection after the leakage of the authentication information (old) used for the initial connection, and sends (notifies) the authentication information (new) to be used for the initial connection to the user computer 101.

[0072] (iii) Step S1003 User computer 101 receives authentication information (new) to be used during the initial connection from manager server 102.

[0073] (iv) Step S1004 User computer 101 obtains a list of agent names for which agent information has been registered (see Figure 15).

[0074] (v) Step S1005 User computer 101 instructs each agent 103_k that is not included in the list of agent names (Figure 15) to register the authentication information (new) to be used during the initial connection (authentication information registration instruction).

[0075] (vi) Step S1006 Upon receiving the instruction to register authentication information, each agent 103_k executes the re-registration process (Figure 12) for the authentication information (new) to be used during the initial connection.

[0076] <Details of the process by the manager server to regenerate and register new authentication information for the initial connection after the leakage of the old authentication information used during the initial connection.> Figure 11 is a flowchart illustrating the process performed by the manager server 102 to regenerate and register the new authentication information to be used for the first connection after the leakage of the old authentication information used for the initial connection.

[0077] (i) Step S1101 The authentication information management unit 1021 of the manager server 102 receives a request from the user computer 101 to regenerate and register the authentication information (new) to be used during the initial connection.

[0078] (ii) Step S1102 The authentication information management unit 1021 generates new authentication information to be used during the initial connection, for example, using the GU_ID.

[0079] (iii) Step S1103 The authentication information management unit 1021 registers the authentication information (new) to be used during the initial connection, which was generated in step S1102, in the DB (storage device). At this time, it may overwrite the authentication information 10211 (Figure 2A) used during the initial connection, or it may append the authentication information (new) to be used during the initial connection along with the history (leaving the authentication information (old) used during the initial connection).

[0080] (iv) Step S1104 The authentication information management unit 1021 notifies (sends) the user computer 101 of the authentication information (new) to be used during the initial connection.

[0081] <Details of the re-registration process for authentication information (new) used during the initial connection by the target agent> Figure 12 is a flowchart illustrating the process of re-registering the authentication information (new) used during the initial connection, which is performed by each target agent 103_k.

[0082] (i) Step S1201 The authentication information processing unit 1031 of each target agent 103_k receives the authentication information (new) to be used during the initial connection from the user computer 101.

[0083] (ii) Step S1202 The authentication information processing unit 1031 registers the authentication information (new) to be used during the initial connection in the DB (storage device) (authentication information 10311 to be used during the initial connection). For each agent 103_k that was added after the authentication information (old) to be used during the initial connection was leaked, the authentication information (new) to be used during the initial connection is simply registered in the DB. For each agent 103_k that had not acquired agent information 10312 at the time the authentication information (old) to be used during the initial connection was leaked, the authentication information (old) to be used during the initial connection may be overwritten with the authentication information (new) to be used during the initial connection, or, as described above, the authentication information (new) to be used during the initial connection may be appended along with the history.

[0084] <GUI used when issuing authentication information during the initial connection> Figure 13 shows an example configuration of the GUI (Graphical User Interface) 1300 used when issuing authentication information during the initial connection, as displayed on the screen of the user computer 101.

[0085] The GUI 1300 used when issuing authentication information during the initial connection includes the following components: an authentication information display field 1301 and an issue button 1302.

[0086] The authentication information display field 1301 used during the initial connection is blank before the authentication information used during the initial connection is issued. When the issue button 1302 is pressed, a request for the generation and registration of the authentication information used during the initial connection is sent to the manager server 102. When the user computer 101 receives the authentication information used during the initial connection from the manager server 102, the authentication information display field 1301 used during the initial connection is populated with the authentication information 10211 obtained from the manager server 102, and the authentication information 10211 used during the initial connection is registered in the DB (storage device) (authentication information 10311 used during the initial connection).

[0087] <GUI used when registering authentication information during the initial connection> Figure 14 shows an example of the GUI 1400 configuration when registering authentication information to be used for the initial connection to each agent 103_k, as displayed on the user computer 101's screen.

[0088] The GUI 1400 used to register authentication information for each agent 103_k during the initial connection includes the agent name 1401, agent information 1402, authentication information 1403, and a registration button 1404 as configuration items.

[0089] Agent Name 1401 is the area that indicates the name of the agent to which authentication information to be registered for use during the initial connection. Agent Information 1402 is the area that indicates whether or not agent information has been registered. Authentication Information 1403 is the area that indicates the authentication information to be registered for use during the initial connection for each agent 103_k. Registration Button 1404 is a button that, when pressed, sends a registration instruction to each agent 103_k for the authentication information to be used during the initial connection, as displayed in the Authentication Information 1403 area.

[0090] <Example of the structure of the list of registered agent names held by the manager server> Figure 15 shows an example of the configuration of the list of agent names 1500 for which agent information has been registered. This information is maintained by the manager server 102 and is the information that the user computer 101 obtains from the manager server 102 if the authentication information 10311 used during the initial connection is leaked from the user computer 101. More specifically, the list of agent names 1500 for which agent information has been registered is the information that the user computer 101 obtains from the manager server 102 in step 1004 of the process shown in Figure 10 (the process of re-registering the authentication information used during the initial connection after the authentication information used during the initial connection has been leaked).

[0091] The list of agent names with registered agent information (1500) includes the agent name (1501) and whether or not the agent information is registered (1502) as constituent items.

[0092] The manager server 102 extracts agent name 102123 from the agent information list 10212 (Figure 2B) and assigns it agent name 1501. The manager server 102 also determines whether agent information has been registered based on whether agent ID 102121 and secret information 102122 have been assigned, and determines whether agent information registration status 1502 is complete.

[0093] <Other> The functions of this embodiment can also be realized by software program code. In this case, a storage medium containing the program code is provided to a system or device, and the computer (or CPU or MPU) of that system or device reads the program code stored on the storage medium. In this case, the program code read from the storage medium itself realizes the functions of the embodiment described above, and the program code itself and the storage medium that stores it constitute the present disclosure. Examples of storage media used to supply such program code include flexible disks, CD-ROMs, DVD-ROMs, hard disks, optical disks, magneto-optical disks, CD-Rs, magnetic tapes, non-volatile memory cards, ROMs, and the like.

[0094] Furthermore, based on the instructions in the program code, the operating system (OS) running on the computer may perform some or all of the actual processing, thereby realizing the functions of the embodiment described above. In addition, after the program code read from the storage medium is written to the computer's memory, the computer's CPU may perform some or all of the actual processing based on the instructions in the program code, thereby realizing the functions of the embodiment described above.

[0095] Furthermore, the program code for the software that realizes the functions of the embodiment may be distributed via a network and stored in a storage means such as a hard disk or memory of the system or device, or in a storage medium such as a CD-RW or CD-R, so that when in use the system or device's computer (or CPU or MPU) reads and executes the program code stored in the storage means or storage medium.

[0096] The processes and technologies described herein are not inherently related to any specific device and can be implemented by combining the components. Various types of general-purpose devices can also be added. Dedicated devices may be constructed to perform the functions of this embodiment. Furthermore, various functions can be formed by appropriately combining the multiple components disclosed in this embodiment. For example, some components may be removed from all the components shown in the embodiment, or components from different configurations may be appropriately combined.

[0097] This disclosure provides specific examples, which are for illustrative purposes (to understand the technology of this disclosure) and not for limitation in any respect. A person with ordinary skill in the art will likely understand that there are many combinations of hardware, software, and firmware suitable for implementing the technology of this disclosure. For example, the described software can be implemented in a wide range of programming or scripting languages, such as assembler, C / C++, Perl, Shell, PHP, and Java®.

[0098] Furthermore, in the embodiments described above, the control lines and information lines shown are those deemed necessary for illustrative purposes, and not all control lines and information lines are necessarily shown in the actual product. All components may be interconnected.

[0099] In addition, any person with ordinary skill in the art can see from the consideration of this embodiment that other implementations of this disclosure may be apparent. The specification and examples are typical, and the scope and spirit of the art of this disclosure are shown in the subsequent claims. [Explanation of symbols]

[0100] 100 Agent Management System 101 User Computers 102 Manager Server 103_k (k=1 to n) Agent 104 Network 1021 Authentication Information Management Department 1022 Manager Function Unit Used by Agents (Manager Function Unit) 1031 Authentication Information Processing Unit 1032 Agent function unit utilizing manager function (Agent function unit)

Claims

1. A manager server that manages commands executed by at least one agent, A storage device that holds at least one program for managing the aforementioned agent, The system includes a processor that reads the program from the storage device, generates secret information for uniquely authenticating each of the at least one agent, and authenticates the connection from the at least one agent based on the secret information, The aforementioned processor, A process of receiving a request from a user computer different from the at least one agent to issue first initial authentication information used by the at least one agent when it first connects to the manager server, A process for generating the first initial authentication information in response to the request for issuance of the first initial authentication information, The process of transmitting the first initial authentication information to the user computer as the first initial authentication target information, When each of the at least one agent makes its first connection using the first initial authentication target information obtained from the user computer, the process involves each of the at least one agent generating the secret information to be used for subsequent connections and sending it to each of the at least one agent. The manager server that executes this.

2. In claim 1, The aforementioned processor, Furthermore, the process of storing the generated first initial authentication information as the first initial authentication source information in the storage device is executed. A manager server that compares the first initial authentication target information received from each of the at least one agents at the time of the initial connection of each of the at least one agents with the first initial authentication source information held in the storage device, and generates the secret information for each of the at least one agent if the comparison results in a match.

3. In claim 1, The aforementioned processor further, When the at least one agent makes a second or subsequent connection using the aforementioned secret information, the process involves authenticating the at least one agent based on the aforementioned secret information. When authentication based on the aforementioned confidential information determines that the second and subsequent connections are appropriate, the process involves sending a command to be executed and a command execution schedule to at least one agent. The manager server that executes this.

4. In claim 1, The aforementioned processor, The process of receiving a request from the user computer to issue a second set of initial authentication information, which differs from the first set of initial authentication information and is used by at least one agent when it first connects to the manager server, A process for generating the second initial authentication information in response to the request for issuance of the second initial authentication information, The process of transmitting the second initial authentication information to the user computer as the second initial authentication target information, When each of the at least one agent makes its first connection using the second initial authentication target information obtained from the user computer, the process of generating the secret information to be used by each of the at least one agent for subsequent connections and sending it to each of the at least one agent is executed. The manager server is one of the agents that utilizes the second initial authentication information, where the agent is the one from among the at least one agents for which the secret information has not been generated at the time of the request for issuance of the second initial authentication information.

5. In claim 4, The processor is a manager server that receives a request from the user computer to issue the second initial authentication information when the first initial authentication information is leaked on the user computer.

6. In claim 4, The processor, upon receiving a request to issue the second initial authentication information, transmits to the user computer, along with the second initial authentication target information, information about an agent for which the secret information has already been set, as a manager server.

7. An agent management system comprising at least one agent, a manager server that manages commands executed by the at least one agent, and a user computer that is a different computer from the at least one agent and operated by a system administrator, wherein these are connected so as to be able to communicate with each other via a network, The aforementioned user computer is The process includes sending a request to the manager server for the issuance of first initial authentication information to be used when at least one agent makes its first connection to the manager server, The process of receiving the first initial authentication information as the first initial authentication target information from the manager server, The process of sending the first initial authentication target information to the at least one agent is performed, The aforementioned at least one agent, The process of receiving the first initial authentication target information from the user computer, Using the aforementioned first initial authentication target information, the process for the initial connection to the manager server is executed, The aforementioned manager server, A process for generating the first initial authentication information in response to the request for issuance of the first initial authentication information, A process of transmitting the first initial authentication information to the user computer as the first initial authentication target information, When the first connection is made from each of the at least one agents using the first initial authentication target information, each of the at least one agents generates unique secret information for authentication to be used for subsequent connections. An agent management system that performs the process of transmitting the aforementioned confidential information to each of the at least one of the agents.

8. In claim 7, The aforementioned manager server, Furthermore, the process of storing the generated first initial authentication information in the storage device as the first initial authentication source information is executed. A manager server that compares the first initial authentication target information with the first initial authentication source information held in the storage device, and generates the secret information for each of at least one agent if the comparison results in a match.

9. In claim 7, The at least one agent further uses the secret information to perform the process of making a second or subsequent connection to the manager server. The manager server further, When the aforementioned at least one agent makes the aforementioned second or subsequent connection, the process involves authenticating the aforementioned at least one agent based on the aforementioned secret information, An agent management system that, when it determines that the second and subsequent connections are appropriate based on authentication using the aforementioned confidential information, performs the process of sending a command to be executed and a command execution schedule to at least one agent.

10. In claim 7, The aforementioned user computer is The process includes sending a request to the manager server for the issuance of a second set of initial authentication information, which is used by at least one agent when it first connects to the manager server, in contrast to the first set of initial authentication information. The process of receiving the second initial authentication information as second initial authentication target information from the manager server, The process of sending the second initial authentication target information to the at least one agent is performed, The aforementioned at least one agent, The process of receiving the second initial authentication target information from the user computer, Using the aforementioned second initial authentication target information, the process for the initial connection to the manager server is executed, The aforementioned manager server, A process for generating the second initial authentication information in response to the request for issuance of the second initial authentication information, The process of transmitting the second initial authentication information to the user computer as the second initial authentication target information, When the first connection is made using the second initial authentication target information from each of the at least one agents, the process of generating unique secret information for authentication to be used for subsequent connections by each of the at least one agents is performed. The process of transmitting the confidential information to each of the at least one agent is performed. An agent management system in which the agents that utilize the second initial authentication information are only those agents among the at least one agent for which the secret information has not been generated at the time of the request for issuance of the second initial authentication information.

11. In claim 10, The user computer, triggered by the leakage of the first initial authentication information, sends a request to the manager server for the issuance of the second initial authentication information, according to the agent management system.

12. In claim 10, The agent management system, when the manager server receives a request from the user computer to issue the second initial authentication information, transmits to the user computer the second initial authentication target information along with information about agents for which the secret information has already been set.

13. An agent management method in which at least one agent is managed by a manager server, The issuance of first initial authentication information used by the at least one agent when it first connects to the manager server is received from a user computer different from the at least one agent, In response to the request for issuance of the first initial authentication information, the first initial authentication information is generated, The first initial authentication information is transmitted to the user computer as the first initial authentication target information, When each of the at least one agent makes its first connection using the first initial authentication target information obtained from the user computer, each of the at least one agent generates unique secret information to be used for authentication during subsequent connections. Transmitting the unique confidential information to each of the at least one of the agents, Agent management methods, including those mentioned above.

14. In claim 13, The generated first initial authentication information is stored in the storage device as the first initial authentication source information, At the time of the initial connection by each of the at least one agent, the first initial authentication target information received from each of the at least one agent is compared with the first initial authentication source information held in the storage device, and if the comparison results in a match, the secret information is generated for each of the at least one agent. Agent management methods, including those mentioned above.

15. In claim 13, When the at least one agent makes a second or subsequent connection using the aforementioned confidential information, the at least one agent is authenticated based on the aforementioned confidential information. When authentication based on the aforementioned confidential information determines that the second and subsequent connections are appropriate, the system sends a command to be executed and a command execution schedule to at least one agent. Agent management methods, including those mentioned above.

16. In claim 13, further, The user computer receives a request to issue a second set of initial authentication information, which differs from the first set of initial authentication information, and which the at least one agent uses when it first connects to the manager server. In response to the request for issuance of the second initial authentication information, the second initial authentication information is generated, The second initial authentication information is transmitted to the user computer as the second initial authentication target information, When each of the at least one agent makes its first connection using the second initial authentication target information obtained from the user computer, each of the at least one agent generates the unique secret information to be used for authentication during subsequent connections. This includes transmitting the confidential information to each of the at least one agents, An agent management method in which the agents that utilize the second initial authentication information are only those agents among the at least one agent for which the secret information has not been generated at the time of the request for issuance of the second initial authentication information.

17. In claim 16, An agent management method that includes receiving a request from the user computer to issue the second initial authentication information in the event that the first initial authentication information is leaked on the user computer.

Images