Access authority management system, access authority management method, information processing apparatus, and recording medium

Abstract

An access authority management system, an access authority management method, an information processing apparatus, and a recording medium. Provided is a technique that facilitates the maintenance and management of the provision of access rights for a user to access a management area divided within a facility in an appropriate state. The access authority management system includes: an authority imparting unit that imparts access authority; an information storage unit that stores first information in which information on an organization to which the user belongs is associated for each user identification information, and second information in which information on a management area is associated for each organization information; a first acquisition unit that acquires a correspondence relationship between the user and the management area on the basis of the first information and the second information; a permission derivation unit that derives access permissions to be given for each management area and each user on the basis of the correspondence relationship acquired by the first acquisition unit; and a notification unit that notifies a manager when the access authority derived by the authority deriving unit does not match the access authority given by the authority giving unit.

Description

Technical Field

[0001] The present invention relates to a technology for an access authority management system for managing the access authority of users to a management area divided into sections within a facility. Background Art

[0002] Patent document 1 discloses a technology related to a permission granting system capable of setting permission. The system generates a permission granting information management table recording the correspondence between area IDs and personal IDs based on a preset organization information management table, layout information management table, and personal information table.

[0003] Patent Document 1: Japanese Patent Application Publication No. 2011-70373

[0004] In the system of Patent Document 1, when the layout information management table is pre-set, when the scale of the facility increases and the area to be set increases, the amount of work required for the setting increases. In addition, it is sometimes impossible to uniformly grant access rights to the management area divided in the facility to all users according to the organization or layout. For example, a user who is required to perform a specific business within a certain period of time is temporarily granted access rights to the management area for the business. In this case, when the administrator of the access rights manually sets the access rights, it may be difficult to maintain the access rights in an appropriate granting state. Summary of the invention

[0005] The present invention is made to solve the above-mentioned problems, and its purpose is to provide a technology that is conducive to efficiently granting access rights for users to enter and exit a management area divided within a facility, and maintaining the access rights granted to users to enter and exit the management area in an appropriate state.

[0006] The access permission management system of the present invention manages the access permission granted to each user according to each management area divided within a facility, wherein the access permission management system comprises: an permission granting unit, which grants access permission; an information storage unit, which stores first information corresponding to information of an organization to which the user belongs according to identification information of each user and second information corresponding to information of a management area according to information of each organization; a first acquisition unit, which acquires a correspondence between the user and the management area based on the first information and the second information; a permission derivation unit, which derives the access permission to be granted according to each management area and each user based on the correspondence acquired in the first acquisition unit; and a notification unit, which notifies the administrator when the access permission derived in the permission derivation unit is inconsistent with the access permission granted in the permission granting unit.

[0007] In addition, the information processing device of the present invention comprises: an authority granting unit, which grants entry and exit permissions to each user according to each management area divided within the facility; a first acquisition unit, which acquires the correspondence between the user and the management area based on first information in which information on the organization to which the user belongs corresponds to identification information of each user and second information in which information on the management area corresponds to information on each organization; an authority derivation unit, which derives the entry and exit permissions to be granted according to each management area and each user based on the correspondence acquired in the first acquisition unit; and a notification unit, which notifies the administrator when the entry and exit permissions derived in the authority derivation unit are inconsistent with the entry and exit permissions granted in the authority granting unit.

[0008] In addition, the access permission management method of the present invention enables a computer to execute the steps of managing the access permission granted to each user according to each management area divided within the facility, wherein the access permission management method has the following steps: a permission granting step of granting access permission; a first acquisition step of acquiring the correspondence between the user and the management area based on first information corresponding to the information of the organization to which the user belongs according to the identification information of each user and second information corresponding to the information of the management area according to the information of each organization; a permission exporting step of exporting the access permission to be granted according to each management area and each user according to the correspondence obtained in the first acquisition step; and a notification step of notifying the administrator when the access permission exported in the permission exporting step is inconsistent with the access permission granted in the permission granting step.

[0009] Furthermore, a computer-readable recording medium of the present invention records a program, which enables a computer to execute steps for managing the access rights granted to each user according to each management area divided within a facility, wherein the program is configured to obtain first information corresponding to information on the organization to which the user belongs according to identification information of each user and second information corresponding to information on the management area according to information on each organization, obtain a correspondence between the user and the management area based on the first information and the second information, derive access rights to be granted for each management area and each user based on the correspondence between the user and the management area, and notify the administrator when the derived access rights are inconsistent with the granted access rights.

[0010] According to the technology of the present invention, it is possible to efficiently grant access rights to users for accessing a managed area divided within a facility, and to maintain and manage the granting of access rights to users for accessing the managed area in an appropriate state. BRIEF DESCRIPTION OF THE DRAWINGS

[0011] Figure 1This is a diagram showing a configuration example of the access authorization management system and its related devices in the first embodiment.

[0012] Figure 2 This is a diagram showing a specific example of a facility to which the entry and exit authority management system in the first embodiment is applied.

[0013] Figure 3 This is a diagram showing a configuration example of the entry and exit authority management system in the first embodiment.

[0014] Figure 4 This is a diagram showing an example of a personnel information management table.

[0015] Figure 5 This is a diagram showing an example of a space utilization status management table.

[0016] Figure 6 This is a diagram showing an example of a space / device information management table.

[0017] Figure 7 This is a diagram showing an example of a graph structure of information managed in the space / equipment management device.

[0018] Figure 8 This is an example of the route data stored in the route data storage unit 402 .

[0019] Fig. 9 This is a flowchart showing a process in which the entry-exit management device executes the entry-exit authorization derivation process to re-evaluate the entry-exit authorization.

[0020] Fig.10 This is a diagram showing an example of an authentication information management table.

[0021] Fig.11 It is a diagram showing an example of an entry and exit authority information management table.

[0022] Fig.12 This is a flowchart showing the process of the entry and exit management device executing the determination process and the notification process.

[0023] Fig.13 This is a diagram showing an example of hardware resources of the entry and exit management device.

[0024] Fig.14 This is a diagram showing another example of the hardware resources of the access management device.

[0025] Fig.15 This is a block diagram showing the functions of the entry and exit authority management system according to the second embodiment.

[0026] Fig.16 1 is a flowchart showing the procedure of the historical information updating process executed by the entry and exit management device.

[0027] Fig.17 This is a flowchart showing the process of the performance evaluation process executed by the entry and exit management device.

[0028] Fig.18 This is a diagram showing a configuration example of an entry and exit authorization management system and its related devices in Embodiment 3.

[0029] Fig.19 This is a diagram showing a specific example of a facility to which the entry and exit authority management system in the third embodiment is applied.

[0030] Fig. 20 This is a diagram showing an example of a space / equipment information management table of the space / equipment management device in the third embodiment.

[0031] Fig.21 This is a diagram showing an example of a graph structure of information managed in the space / equipment management device according to the third embodiment.

[0032] Fig. 22 This is an example of route data stored in the route data storage unit of the third embodiment.

[0033] Fig.23 This is a flowchart showing the procedure of the determination process and the notification process executed by the entry and exit management device according to the third embodiment.

[0034] Description of symbols

[0035] 8: Network; 10: Access authority management system; 100: Access management device; 101: First acquisition unit; 102: Second acquisition unit; 103: Authority derivation unit; 104: Authority granting unit; 105: Authority determination unit; 106: Notification unit; 107: Performance evaluation unit; 110: Access authority information management table; 111: Authentication information management table; 112: History information management table; 200: Personnel management device; 201: Personnel information management table; 202 : Space utilization status management table; 300: Space / equipment management device; 301: Space / equipment information management table; 400: Path search device; 401: Path search unit; 402: Path data storage unit; 500: Authentication device; 510: Authentication device; 600: Door; 700: Communication terminal; 800: Operation terminal; 900: Key library; 1002: Processor; 1004: Memory; 1006: Processing circuit; 1008: Dedicated hardware. DETAILED DESCRIPTION

[0036] Hereinafter, the embodiments will be described with reference to the drawings. In addition, the same reference numerals are given to the common elements in each figure, and the repeated description is omitted.

[0037] 1. Implementation Method 1

[0038] 1-1. Overall Overview of Access Permission Management System in Implementation Example 1

[0039] Figure 1 1 is a diagram showing a configuration example of an access authorization management system and its associated devices in Embodiment 1. The access authorization management system 10 is a system for managing the access authorization of each user according to each management area divided in a facility such as a building. The access authorization management system 10 is configured to be able to communicate with one or more authentication devices 500, one or more communication terminals 700, and one or more operation terminals 800 as associated devices via a network 8 such as the Internet. Access to the management area is restricted by, for example, a door 600. The door 600 receives a command from the authentication device 500 and is controlled to be unlocked and locked.

[0040] The authentication device 500 is a device for authenticating a user who enters and exits a management area through a door 600. The authentication device 500 is, for example, installed near the door 600 of each management area, and performs an authentication process of reading the inherent information of the user. The authentication process can apply a known authentication process such as object authentication using an ID card or a two-dimensional code, or a liveness authentication such as a face authentication or a fingerprint authentication. The authentication device 500 receives authentication information for determining a user with access authority from the access authority management system 10, and uses the received authentication information to confirm whether the user corresponding to the user's identification information has access authority. If the user has access authority, the authentication device 500 sends a command to unlock the corresponding door 600 to the door 600. Then, when it is detected that the user has completed access, when a predetermined time has passed, when the opened door is closed, etc., the authentication device 500 sends a command to lock the corresponding door 600.

[0041] The communication terminal 700 is a terminal device owned by the access authority manager. The communication terminal 700 receives and outputs notifications sent from the access authority management system 10. The communication terminal 700 may be exemplified by a PC (personal computer), a smartphone, a tablet, etc. The notification method may be exemplified by email, SNS (social network service), screen display, voice output, etc.

[0042] The operation terminal 800 is a terminal device used by the access authority manager to input information to the access authority management system 10. Examples of the operation terminal 800 include a PC (personal computer), a smartphone, a tablet, etc. The operation terminal 800 may be configured as a common terminal with the communication terminal 700.

[0043] Figure 2 FIG. 2 is a diagram showing a specific example of a facility to which the access authorization management system in Implementation Example 1 is applied. Figure 2In the example shown, space AR100 indicates a space other than the entrance and exit of the facility. Spaces AR101, AR102, AR110, and AR703 indicate a common space or a mobile space within the facility. AR103 and AR702 indicate a space used by a department. AR712 indicates a space used for a specific purpose such as a library within a department. DR100, DR101, DR102, DR103, DR702, DR703, and DR712 indicate doors 600 for entering and exiting the space. CR1011, CR1012, CR1031, CR1032, CR7021, CR7022, and CR7021 indicate authentication devices 500 provided corresponding to doors 600.

[0044] For example, users belonging to Section I move along the dotted line path in the figure between the entrance and exit of the facility and the space AR702 used by Section I. Therefore, the access authority manager grants access authority to users of Section I to authentication devices CR1011, CR1012, CR7021, and CR7022 corresponding to doors DR101 and DR702 located in the middle of the path.

[0045] Here, for example, if the user belonging to Section I is changed due to organizational changes, the set access authority may become inappropriate. The access authority management system 10 of this embodiment is characterized by the following actions: determining whether the set access authority is appropriate and notifying the access authority manager. Figure 2 The configuration of the access authority management system will be described by taking the case where the access authority of users is managed in the illustrated facility as an example.

[0046] 1-2. Example of the structure of access authority management system

[0047] Figure 3 This is a diagram showing a configuration example of the access authorization management system in the first embodiment. Figure 1 The internal structure and functions of the access authorization management system are described. The access authorization management system 10 is implemented, for example, by one or more server devices. The access authorization management system 10 is set in the facility to be managed. Alternatively, the access authorization management system 10 may also be set in a place different from the facility. As another example, the access authorization management system 10 may also be implemented by a server on the cloud.

[0048] The access authorization management system 10 includes an access management device 100, a personnel management device 200, a space / equipment management device 300, and a path search device 400. The access management device 100, the personnel management device 200, the space / equipment management device 300, and the path search device 400 can be implemented by different server devices, respectively. In this case, the access management device 100 is configured to be able to communicate with the personnel management device 200, the space / equipment management device 300, and the path search device 400 via the network 8.

[0049] The entry and exit management device 100 is an information processing device that manages the entry and exit authority of each user for each management area. The functions of the entry and exit management device 100 will be described in detail later.

[0050] The personnel management device 200 manages the personnel information of facility users and the space utilization information of organizations. The personnel management device 200 may be configured as a plurality of independent personnel management devices 200 for each organization utilizing the facility. In this case, different organizations may not interfere with each other's settings.

[0051] The personnel management device 200 functions as an information storage unit that stores a personnel information management table 201 as first information and a space utilization status management table 202 as second information. Figure 4 201 is a diagram showing an example of a personnel information management table. In the example shown in the figure, the personnel information management table 201 associates personnel information such as affiliation and position with a name as inherent identification information of a user of a facility. The identification information of a user is not limited to a name, but may be other inherent identification information.

[0052] Figure 5 201 is a diagram showing an example of a space utilization status management table. In the example shown in the figure, the space utilization status management table 202 associates the area ID identifying the management area with the name of the identification information of the organization using the facility. When the personnel information or the space utilization status is changed, the personnel management device 200 updates the setting content of the personnel information management table 201 or the space utilization status management table 202.

[0053] The space / equipment management device 300 is a device for managing information related to space and equipment in a facility. Typically, the space / equipment management device 300 functions as a storage device that stores a space / equipment information management table 301 as third information. Figure 6301 is a diagram showing an example of a space / equipment information management table. In the example shown in the figure, the space / equipment information management table 301 corresponds to a node ID representing a location, a category of the space or equipment, a unique ID, and an authentication machine ID of the corresponding authentication device 500 for each space or equipment in the facility. In addition, the space / equipment information management table 301 associates a space with a door for entering and exiting the space. When the status of a space or equipment changes, the space / equipment management device 300 updates the space / equipment information management table 301 to the latest status.

[0054] Figure 7 This is a diagram showing an example of a graph structure of information managed in a space / equipment management device. The circular symbols shown in the figure represent nodes, which represent the locations where spaces or equipment are installed, and the lines represent edges, which represent the connections between the nodes from the perspective of user movement. Doors DR100, DR101, DR102, DR103, DR702, DR703, and DR712 are basically composed of two nodes representing the positions of the entrance side and the exit side. When an authentication device is installed for passing from each direction, "1" is marked in the node, and when no authentication device is installed, "0" is marked in the node.

[0055] Authentication devices CR1011, CR1012, CR1031, CR1032, CR7021, CR7022, and CR7021 are arranged at corresponding nodes to unlock and lock the doors surrounded by dotted lines in the figure.

[0056] The route search device 400 is a device for searching for a movement route from the entrance and exit of a facility to each space. The route search device 400 has a route search unit 401 and a route data storage unit 402 as its functional blocks. The route data storage unit 402 stores route data for managing movement routes within the facility.

[0057] Figure 8 This is an example of the route data stored in the route data storage unit 402. The route data shown in this figure is expressed by nodes and edges, and is processed based on a graph, for example. Figure 8 The circular symbols in the figure represent nodes, and n1000, n1001, n1011, n1012, etc. represent node IDs. Straight lines represent edges. Path data can also be created manually.

[0058] The path search unit 401 searches for paths from the entrance and exit of the facility to each space and gates, authentication devices, etc., on the way based on the path data. In addition, the path search unit 401 may also analyze the map data and structure data of the facility using a known analysis method to search for paths.

[0059] 1-3. Functions of access control device

[0060] The entry and exit management device 100 includes a first acquisition unit 101 , a second acquisition unit 102 , an authority derivation unit 103 , an authority granting unit 104 , an authority determination unit 105 , an entry and exit authority information management table 110 , and an authentication information management table 111 as its functional blocks.

[0061] The first acquisition unit 101 is a functional block for executing a first acquisition process for acquiring area information of a management area used by a user. In the first acquisition process, the first acquisition unit 101 identifies the organization corresponding to the identification information of the target user to be managed using the personnel information management table 201. Then, the first acquisition unit 101 uses the space utilization status management table 202 to acquire the area ID corresponding to the identified organization as the area information of the management area of ​​the target user.

[0062] The second acquisition unit 102 is a functional block for executing a second acquisition process for acquiring door information and authentication machine information associated with the management area. In the second acquisition process, the second acquisition unit 102 uses the space / equipment information management table 301 to acquire the type of door associated with the area ID of the target user acquired in the first acquisition process and the authentication machine ID associated with the door as the door information and authentication machine information associated with the target user.

[0063] The authority deriving unit 103 derives the access authority to be granted for each management area and each user based on the correspondence between the user and the management area acquired by the first acquisition unit 101. Typically, the authority deriving unit 103 derives the access authority to be granted to the target user for the authenticator of the acquired authenticator ID based on the door information and authenticator information acquired by the second acquisition unit 102. This process is hereinafter referred to as "access authority deriving process".

[0064] For example, when the access authorization management system 10 is newly introduced, the authorization export unit 103 executes access authorization export processing for all users of the facility. Furthermore, when the setting items associated with the access authorization are changed, the authorization export unit 103 executes access authorization export processing for re-evaluating the access authorization associated with the changed setting items.

[0065] Fig. 9 This is a flowchart showing the process of the entry and exit management device executing the entry and exit authority derivation process and re-evaluating the entry and exit authority. Fig. 9 The processing of the flowchart shown also represents a part of the access authority management method for causing a computer to execute the steps of managing the access authority granted to each user for each management area divided within the facility.

[0066] In step S100, it is determined whether a setting change is detected in the personnel information management table 201, the space utilization status management table 202, or the space / equipment information management table 301. If the result is that the disapproval determination is established, the process returns to step S100 again. On the other hand, if the approval determination is established, the process proceeds to step S102.

[0067] In step S102, it is determined whether the item whose setting has been changed is an item related to access authority. Here, in the case where the setting of the personnel information management table 201 is changed due to a change in affiliation of a certain user, it is determined that the item whose setting has been changed is an item related to access authority. In addition, in the case where the setting of the space utilization status management table 202 is changed due to the movement of a certain organization in the room, it is determined that the item whose setting has been changed is an item related to access authority. In addition, in the case where the setting of the space / equipment information management table 301 is changed due to the installation of a new authentication device 500, it is determined that the item whose setting has been changed is an item related to access authority. Furthermore, in the case where the setting of the access authority of a certain user is changed by the access authority manager, it is determined that the item whose setting has been changed is an item related to access authority.

[0068] If the result of the processing in step S102 is that the disapproval judgment is established, the processing returns to step S100, and if the approval judgment is established, the processing proceeds to step S104. In step S104, the access authority export processing for re-evaluation is performed on the access authority associated with the project whose settings have been changed. Here, in the case where the setting of the personnel information management table 201 is changed due to a change of a certain user, the access authority of the user is re-evaluated. In addition, in the case where the setting of the space utilization status management table 202 is changed due to the movement of a certain organization in the room, the access authority of all users belonging to the organization is re-evaluated. In addition, in the case where the setting of the space / equipment information management table 301 is changed due to the installation of a new authentication device 500, the access authority of all users passing through the node where the authentication device 500 is installed is re-evaluated. Furthermore, in the case where the setting of the access authority of a certain user is changed by the access authority manager, the access authority of the user is re-evaluated.

[0069] In addition, in the access authority derivation process of step S104, the path search unit 401 searches for the movement path from the entrance and exit of the facility to the management area and the authentication device between the movement path. Then, the authority derivation unit 103 derives the access authority that should be granted to the user having a corresponding relationship with the management area for the authentication device between the movement path searched by the path search unit 401. After the processing in step S104 is completed, the processing proceeds to step S106.

[0070] In step S106 , the entry and exit authority is updated using the result of the re-evaluation in step S104 .

[0071] The authority granting unit 104 is a functional block for registering the entry and exit authority information set by the entry and exit authority manager in the authentication information management table 111 . Fig.10 1 is a diagram showing an example of an authentication information management table. In the example shown in the figure, the authentication information management table 111 associates the authentication type and the authentication information ID with the name as the identification information of the user. The authentication type here is the type of user authentication, and examples include card, fingerprint, face, etc. The authentication information ID is information associated with the authentication machine ID of the corresponding authentication device. Fig.11 The corresponding relationship between the authentication information ID and the authentication machine ID is shown in FIG. Fig.11 The access permission information management table 110 illustrated in FIG. 1 is defined by the access permission information management table 110 illustrated in FIG. The access permission manager inputs the access permission information to the permission granting unit 104 from the operation terminal 800 or the communication terminal 700. Alternatively, the access permission information is input from the permission exporting unit 103 to the permission granting unit 104. The access permission information input here is the access permission information that is exported by the above-mentioned access permission exporting process and is granted to each authentication machine and each user. In this way, access permission can be granted only to the user's moving path, so access permission can be granted to the corresponding area and door more appropriately. In addition, the access permission information is automatically input to the permission granting unit 104, so the labor and time of the access permission manager are reduced.

[0072] The authority determination unit 105 is a functional block for executing a determination process for determining whether the entry and exit authority information set in the entry and exit authority information management table 110 is appropriate. The notification unit 106 is a functional block for executing a notification process for notifying the communication terminal 700 of the determination result in the authority determination unit 105 .

[0073] Fig.12 1 is a flowchart showing the process of the entry and exit management device executing the determination process and the notification process. Fig.12 The processing of the flowchart shown also represents a part of the access authority management method for causing a computer to execute the steps of managing the access authority granted to each user for each management area divided within the facility.

[0074] In step S110, the authority determination unit 105 performs determination processing to determine whether the access authority information derived by the authority derivation unit 103 is consistent with the access authority information set in the access authority information management table 110. If the result is that the approval determination is established, it is determined that the access authority information set in the access authority information management table 110 is appropriate, and this process ends.

[0075] On the other hand, if the non-recognition determination is established, it is determined that the access permission information set in the access permission information management table 110 is inappropriate, and the process proceeds to step S112. In step S112, the notification unit 106 performs notification processing. Specifically, the notification unit 106 notifies the communication terminal 700 of inconsistency information including inconsistency content between the access permission information set in the access permission information management table 110 and the access permission information derived by the permission deriving unit 103.

[0076] According to the access authorization management system 10 described above, it is possible to determine whether the access authorization set by the access authorization manager for each user is appropriate under the current facility utilization status, and notify the access authorization manager, thereby providing an opportunity to correct the inappropriate access authorization status.

[0077] 1-4. Modifications

[0078] The access authorization management system 10 of the present embodiment may also adopt the following modified forms.

[0079] 1-4-1. Hardware resources of the access authority management system 10

[0080] Fig.13 1 is a diagram showing an example of hardware resources of the entry and exit management device. As hardware resources, the entry and exit management device 100 has a processing circuit 1006 including a processor 1002 and a memory 1004. The processing circuit 1006 may include a plurality of processors 1002. The processing circuit 1006 may include a plurality of memories 1004.

[0081] In this embodiment, the parts indicated by reference numerals 101 to 106, reference numerals 110, and reference numerals 111 represent the functions of the access management device 100. The functions of the access authority information management table 110 and the authentication information management table 111 as the storage unit are realized by the memory 1004. The functions of the parts indicated by reference numerals 101 to 106, reference numerals 110, and reference numerals 111 can be realized by software, firmware, or a combination of software and firmware described as a program. The program is stored in the memory 1004. Alternatively, the program can also be recorded in a recording medium that can be read by a computer. The access management device 100 realizes the functions of the parts indicated by reference numerals 101 to 106, reference numerals 110, and reference numerals 111 by the processor 1002 (computer) executing the program stored in the memory 1004.

[0082] The processor 1002 is also called a CPU (Central Processing Unit), a central processing device, a processing device, an arithmetic device, a microprocessor, a microcomputer or a DSP. As the memory 1004, a semiconductor memory, a magnetic disk, a floppy disk, an optical disk, a high-density disk, a mini disk or a DVD may also be used. The semiconductor memory that can be used includes RAM, ROM, flash memory, EPROM and EEPROM.

[0083] Fig.14 FIG. 2 is a diagram showing another example of hardware resources of the access management device. Fig.14 In the example shown, the access management device 100 has a processing circuit 1006 including a processor 1002 , a memory 1004 , and dedicated hardware 1008 . Fig.14 The example in which a part of the functions of the access management device 100 is implemented by the dedicated hardware 1008 is shown. All the functions of the access management device 100 may be implemented by the dedicated hardware 1008. As the dedicated hardware 1008, a single circuit, a complex circuit, a programmed processor, a parallel programmed processor, an ASIC, an FPGA, or a combination thereof can be used.

[0084] The hardware resources of the personnel management device 200 and Fig.13 or Fig.14 The example shown is the same. As a hardware resource, the personnel management device 200 has a processing circuit including a processor and a memory. The personnel management device 200 implements the functions of each unit by executing the program stored in the memory through the processor. The functions of the personnel information management table 201 and the space utilization status management table 202 as the storage unit are implemented by the memory 1004. As a hardware resource, the personnel management device 200 may also have a processing circuit including a processor, a memory and dedicated hardware. It is also possible to implement part or all of the functions of the personnel management device 200 through dedicated hardware.

[0085] The hardware resources of the space / equipment management device 300 and Fig.13 or Fig.14 The example shown is the same. As a hardware resource, the space / equipment management device 300 has a processing circuit including a processor and a memory. The space / equipment management device 300 executes the program stored in the memory through the processor, thereby realizing the functions of each part. The function of the space / equipment information management table 301 as a storage part is realized by the memory 1004. As a hardware resource, the space / equipment management device 300 may also have a processing circuit including a processor, a memory and dedicated hardware. It is also possible to realize part or all of the functions of the space / equipment management device 300 through dedicated hardware.

[0086] The hardware resources of the route search device 400 are Fig.13 or Fig.14 The example shown is the same. As hardware resources, the path search device 400 has a processing circuit including a processor and a memory. The path search device 400 executes the program stored in the memory through the processor, thereby realizing the functions shown in each part. The function of the path data storage unit 402 as a storage unit is realized by the memory 1004. As hardware resources, the path search device 400 may also have a processing circuit including a processor, a memory and dedicated hardware. It is also possible to realize part or all of the functions of the path search device 400 by dedicated hardware.

[0087] In addition, the entry and exit authorization management system 10 may also mount all or part of the functions of the entry and exit management device 100 on the personnel management device 200 , the space / equipment management device 300 , or the route search device 400 .

[0088] 2. Implementation Method 2

[0089] The access permission management system of the second embodiment is characterized by the function of evaluating the usage performance of users who are granted access permission. In the access permission management system of the second embodiment, the differences from the example disclosed in the first embodiment are described in detail. With respect to the features not described in the second embodiment, any features of the example disclosed in the first embodiment may be adopted.

[0090] 2-1. Functions of access authority management system according to implementation method 2

[0091] Fig.15 1 is a block diagram showing the functions of the entry and exit authority management system according to Embodiment 2. The entry and exit management device 100 according to Embodiment 2 further includes a performance evaluation unit 107 and a history information management table 112 in addition to the functions of the entry and exit management device 100 according to Embodiment 1.

[0092] The performance evaluation unit 107 has a function of evaluating the entry and exit performance of each user and each management area to which entry and exit rights are granted. The historical information management table 112 stores historical information that associates the authentication machine ID and the final use date and time with the user's identification information. When a user is authenticated in the authentication process in the authentication device 500, the performance evaluation unit 107 updates the final use date and time of the corresponding historical information. Hereinafter, this process is referred to as "historical information update processing". In addition, in the historical information update processing, there is no distinction between the authentication types of the users. That is, if the user's identification information is the same, even if the authentication types such as card, fingerprint, face, etc. are different, the historical information management table 112 is updated as common historical information.

[0093] In addition, the performance evaluation unit 107 evaluates the entry and exit performance of each management area for each user based on the historical information stored in the historical information management table 112. Hereinafter, this process is referred to as "performance evaluation processing". The performance evaluation process can be uniformly executed at a predetermined frequency or time period, or can be executed at a dedicated timing according to the affiliation of each authentication device or each user. In this way, in the case where the security level is different according to the affiliation of each authentication device or each user, the performance evaluation process can be executed at an appropriate timing for each authentication device or user.

[0094] 2-2. Specific Processing of Access Authority Management System in Implementation Method 2

[0095] Fig.16 1 is a flowchart showing the process of the access management device executing the historical information update process. Fig.16 The processing of the flowchart shown also represents a part of the access authority management method for causing a computer to execute the steps of managing the access authority granted to each user for each management area divided within the facility.

[0096] In step S200, the performance evaluation unit 107 determines whether a user is detected passing through the facility. Here, the performance evaluation unit 107 determines whether a user who is granted access authority is authenticated in the authentication process executed in each authentication device 500. If the result is that the disapproval determination is established, the processing of this process ends, and if the approval determination is established, the processing proceeds to step S202.

[0097] In step S202, the performance evaluation unit 107 updates the last date and time of use of the authentication device 500 by the user whose access was approved in the process of step S200, in the history information management table 112. After the process of step S202 is performed, this routine ends.

[0098] Fig.17 This is a flowchart showing the process of the performance evaluation process performed by the access management device. Fig.17 The processing of the flowchart shown also represents a part of the access authority management method for causing a computer to execute the steps of managing the access authority granted to each user for each management area divided within the facility.

[0099] In step S210, the performance evaluation unit 107 calculates the elapsed time from the last date of use of each authentication device for all users who are granted access rights to the facility management area. In step S212, the performance evaluation unit 107 determines whether each calculated elapsed time exceeds the reference time. The reference time here uses a value preset as the elapsed time for which access rights should be re-evaluated. In addition, the reference time can be set to a different value for each authentication device or each user. If the result is that the disapproval judgment is established, it is determined that the set user rights are appropriate, and this process ends.

[0100] On the other hand, if the authentication is successful in the determination of step S212, the process proceeds to step S214. In step S214, the performance evaluation unit 107 adds the authentication device ID and the user's identification information to the notification list in correspondence with each other for the authentication device and the user that are successful in the determination of step S212. After the process of step S214 is completed, the process proceeds to step S216. In step S216, the notification unit 106 notifies the access authority manager of the notification list.

[0101] According to the above performance evaluation process, when the authentication device that has no entry and exit performance of the user for a period exceeding the reference time grants the user access rights, the access right manager is notified. Thus, confirmation and correction of access rights can be prompted, so that the access right granting status can be appropriately maintained from the perspective of access performance.

[0102] 3. Implementation Method 3

[0103] The access authorization management system of the third embodiment is characterized by the following function: in a facility where a safe such as a safe or a key vault with set unlocking authorization is provided, it is evaluated whether the unlocking authorization is appropriate. In the access authorization management system of the third embodiment, the differences from the example disclosed in the first embodiment are particularly described in detail. With respect to the features not described in the third embodiment, any features of the example disclosed in the first embodiment may be adopted.

[0104] 3-1. Overall Overview of Access Permission Management System in Implementation Method 3

[0105] Fig.18 1 is a diagram showing a configuration example of an access authorization management system and its associated devices in Embodiment 3. The access authorization management system 10 of Embodiment 3 is configured to be able to communicate with an authentication device 510 as an associated device via a network 8, based on the configuration of the access authorization management system 10 of Embodiment 1. The key vault 900 is an example of a safe, and receives instructions from the authentication device 510 to control unlocking and locking.

[0106] Fig.19 FIG. 2 is a diagram showing a specific example of a facility to which the access authorization management system in Implementation Example 3 is applied. Fig.19 In the example shown, the space AR103 indicates the space used by the J department. KB1100 indicates the key vault 900 installed in the space AR103. CR1100 indicates the authentication device 510 installed corresponding to the key vault 900. The access management device 100 manages the unlocking authority of the key vault 900 through the access authority information management table 110, similarly to the access authority to the management area.

[0107] The key vault 900 is set in the space AR103 of the J Department. Therefore, in the case where a user who is not granted access rights to the path from the entrance and exit of the facility to the space AR103 is granted access rights to the key vault 900, it may be necessary to re-evaluate the access rights of the user or the access rights to the key vault 900. The access permission management system 10 of this embodiment is characterized by the following actions: determining whether the set access permission or unlocking permission is appropriate, and notifying the access permission manager. Fig.19 The configuration of the access authority management system will be described by taking the case where the access authority and unlocking authority of users are managed in the illustrated facility as an example.

[0108] The access authorization management system 10 of the third embodiment has the same configuration as the access authorization management system 10 of the first embodiment. The equipment managed by the space / equipment management device 300 includes a key vault 900 . Fig. 20 3 is a diagram showing an example of a space / equipment information management table of a space / equipment management device in Implementation Example 3. In the example shown in the figure, a space / equipment information management table 301 corresponds to a node ID representing a location, a category of the space or equipment, a unique ID, and an authentication machine ID of a corresponding authentication device 500, respectively, with respect to a space or equipment in a facility. The category of equipment here includes a key library. When the status of a space or equipment changes, the space / equipment management device 300 updates the space / equipment information management table 301 to the latest status.

[0109] Fig.21 This is a diagram showing an example of a graph structure of information managed in a space / equipment management device in Implementation Example 3. Compared to the graph structure of information managed in a space / equipment management device in Implementation Example 1, the graph structure shown in this figure is further configured with a key library KB1100 and an authentication device CR1100. The authentication device CR1100 is configured at a node of the space AR103, and performs unlocking and locking of the connected key library KB1100. The key library KB1100 is set in the space AR1100. The key library KB1100 receives unlocking instructions and locking instructions from the authentication device CR1100 and acts.

[0110] Fig. 22 This is an example of the path data stored in the path data storage unit 402 of the embodiment 3. Compared with the path data of the embodiment 1, the path data shown in this figure further includes a node n1100.

[0111] 3-2. Characteristic Operations of the Access Management Device of Embodiment 3

[0112] In the determination process, the authority determination unit 105 determines whether the unlocking authority information and the entry / exit authority information set in the entry / exit authority information management table 110 are appropriate. Fig.23 1 is a flowchart showing the process of executing the determination process and the notification process by the entry and exit management device 100 according to the third embodiment. Fig.23 The processing of the flowchart shown also represents a part of the access authority management method for causing a computer to execute the steps of managing the access authority granted to each user for each management area divided within the facility.

[0113] In step S300, the route search unit 401 searches for a movement route from the entrance of the facility to the key vault 900 and an authentication device corresponding to a door located in the middle of the route based on the route data. After the process of step S300 is completed, the process proceeds to step S302.

[0114] In step S302, the authority determination unit 105 performs determination processing to determine whether the user who is granted the unlocking authority of the key vault 900 in the access authority information management table 110 is granted the access authority to the authentication device in the middle of the moving path searched in step S300. If the result is that the approval determination is established, it is determined that the unlocking authority information and the access authority information set in the access authority information management table 110 are appropriate, and this process ends.

[0115] On the other hand, if the disapproval judgment is established, it is determined that the unlocking authority information or the access authority information set in the access authority information management table 110 is inappropriate, and the process proceeds to step S304. In step S304, the notification unit 106 performs notification processing. Specifically, the notification unit 106 notifies the access authority manager from the communication terminal 700 to re-evaluate the authority granting status.

[0116] According to the access authorization management system 10 of the third embodiment described above, it is possible to determine whether the access authorization and unlocking authorization set by the access authorization manager for each user are appropriate, and notify the access authorization manager, thereby providing an opportunity to correct the status of inappropriate access authorization and unlocking authorization.

[0117] 3-3. Modification

[0118] The access authorization management system 10 of the present embodiment may also adopt the following modified forms.

[0119] The access authority management system of the third embodiment may also have a function of evaluating the unlocking authority based on the unlocking performance of the user who is granted the unlocking authority of the key vault 900. In this case, when the performance evaluation unit 107 authenticates the user in the authentication process in the authentication device 510, it performs a historical information update process to update the final use date and time of the corresponding historical information. Then, the performance evaluation unit 107 performs a performance evaluation process to evaluate the unlocking performance of each key vault according to each user based on the historical information stored in the historical information management table 112. In the performance evaluation process, the performance evaluation unit 107 determines whether the elapsed time from the final use date and time exceeds the reference time. If the result is that the approval judgment is established, it is determined that the set unlocking authority is inappropriate, and a notification process can be performed. According to this action, the manager can be prompted to re-evaluate the unlocking authority related to the user who has no use performance of the key vault 900 beyond the reference time.

[0120] 4. Others

[0121] Although preferred embodiments and the like have been described in detail above, the present invention is not limited to the above embodiments and the like, and various modifications and substitutions can be made to the above embodiments and the like without departing from the scope described in the claims.

[0122] Hereinafter, various aspects of the present invention will be collectively described as supplementary notes.

[0123] (Note 1)

[0124] An access authority management system manages the access authority of each user granted to each management area divided in a facility, wherein the access authority management system comprises:

[0125] An authority granting unit, which grants the access authority;

[0126] An information storage unit storing first information in which information about an organization to which the user belongs is associated with identification information of each user, and second information in which information about a management area is associated with information about each organization;

[0127] a first acquisition unit that acquires a correspondence relationship between the user and the management area based on the first information and the second information;

[0128] an authority deriving unit for deriving, based on the correspondence relationship acquired by the first acquiring unit, an entry and exit authority to be granted for each of the management areas and each of the users; and

[0129] A notification unit notifies a manager when the entry / exit authority derived by the authority deriving unit and the entry / exit authority granted by the authority granting unit do not match.

[0130] (Note 2)

[0131] According to the access authority management system described in Supplement 1,

[0132] The access authorization management system includes a performance evaluation unit that updates access performance including the last date and time of use of the management area by each user.

[0133] The notification unit is configured to notify a manager when the elapsed time from the last use date exceeds a reference time.

[0134] (Note 3)

[0135] The access authority management system according to Appendix 1 or 2, wherein:

[0136] The information storage unit further stores third information that associates information of an authentication device used to authenticate entry and exit of the management area with information of each management area.

[0137] The access authorization management system includes a second acquisition unit that acquires information of the authentication device corresponding to each management area based on the third information.

[0138] The authority deriving unit is configured to derive, as the entry / exit authority, an authority for performing authentication in the authentication device corresponding to the management area.

[0139] (Note 4)

[0140] According to the access authority management system described in Supplement 3,

[0141] The access authorization management system includes a route search unit that searches for a movement route from an entrance of the facility to the management area.

[0142] The authority deriving unit is configured to derive the entry and exit authority to be granted to a user having a corresponding relationship with the management area, with respect to the authentication device interposed in the movement path.

[0143] (Note 5)

[0144] The access authority management system according to any one of Supplement 1 to Supplement 3, wherein:

[0145] The authority granting unit is configured to grant the entry / exit authority in response to an input from a manager or an input from the authority deriving unit.

[0146] (Note 6)

[0147] The access authority management system according to any one of Supplement 1 to Supplement 5, wherein:

[0148] The authority granting unit is configured to further grant each user unlocking authority to the safe disposed in the management area.

[0149] The access authorization management system includes a route search unit that searches for a movement route from an entrance of the facility to the management area.

[0150] The notification unit is configured to notify a manager when the entry / exit authority required for passing through the movement route is not granted to the user to whom the unlocking authority is granted.

[0151] (Note 7)

[0152] According to the access authority management system described in Appendix 6,

[0153] The access authorization management system includes a performance evaluation unit that updates unlocking performance including the last date and time of use of the safe by each user.

[0154] The notification unit is configured to notify a manager when the elapsed time from the last use date exceeds a reference time.

[0155] (Note 8)

[0156] An information processing device, comprising:

[0157] The authority granting department grants access rights to each user according to each management area divided within the facility;

[0158] a first acquisition unit for acquiring a correspondence relationship between the user and the management area based on first information in which information on the organization to which the user belongs is associated with identification information of each user and second information in which information on the management area is associated with information on each organization;

[0159] an authority deriving unit for deriving, based on the correspondence relationship acquired by the first acquiring unit, an entry and exit authority to be granted for each of the management areas and each of the users; and

[0160] A notification unit notifies a manager when the entry / exit authority derived by the authority deriving unit and the entry / exit authority granted by the authority granting unit do not match.

[0161] (Note 9)

[0162] A method for managing access rights enables a computer to manage the access rights of each user assigned to each management area divided in a facility, wherein the method for managing access rights comprises the following steps:

[0163] The permission granting step is to grant the access permission;

[0164] A first acquisition step of acquiring a correspondence between the user and the management area based on first information in which information on the organization to which the user belongs is associated with identification information of each user and second information in which information on the management area is associated with information on each organization;

[0165] an authority deriving step of deriving the access authority to be granted for each of the management areas and each of the users based on the correspondence relationship obtained in the first obtaining step; and

[0166] A notification step of notifying the administrator when the entry / exit authority derived in the authority deriving step is inconsistent with the entry / exit authority granted in the authority granting step.

[0167] (Note 10)

[0168] A computer-readable recording medium having a program recorded thereon, the program causing the computer to manage the access rights granted to each user for each management area divided within a facility, wherein:

[0169] The program is composed of:

[0170] acquiring first information in which information on the organization to which the user belongs is associated with identification information of each user, and second information in which information on the management area is associated with information on the organization,

[0171] Acquire the correspondence between the user and the management area based on the first information and the second information,

[0172] Based on the correspondence between the user and the management area, the access authority to be granted is derived for each management area and each user.

[0173] When the exported access authority does not match the granted access authority, the administrator is notified.

Claims

1. An access authority management system that manages the access authority of each user assigned to each management area divided within a facility, wherein: The access authority management system has: An authority granting unit, which grants the access authority; An information storage unit storing first information in which information about an organization to which the user belongs is associated with identification information of each user, and second information in which information about a management area is associated with information about each organization; a first acquisition unit that acquires a correspondence relationship between the user and the management area based on the first information and the second information; an authority deriving unit for deriving, based on the correspondence relationship acquired by the first acquiring unit, an entry and exit authority to be granted for each of the management areas and each of the users; as well as A notification unit notifies a manager when the entry / exit authority derived by the authority deriving unit and the entry / exit authority granted by the authority granting unit do not match.

2. The access authority management system according to claim 1, wherein: The access authorization management system includes a performance evaluation unit that updates access performance including the last date and time of use of the management area by each user. The notification unit is configured to notify a manager when the elapsed time from the last use date exceeds a reference time.

3. The access authority management system according to claim 1 or 2, wherein: The information storage unit further stores third information that associates information of an authentication device used to authenticate entry and exit of the management area with information of each management area. The access authorization management system includes a second acquisition unit that acquires information of the authentication device corresponding to each management area based on the third information. The authority deriving unit is configured to derive, as the entry / exit authority, an authority for performing authentication in the authentication device corresponding to the management area.

4. The access authority management system according to claim 3, wherein: The access authorization management system includes a route search unit that searches for a movement route from an entrance of the facility to the management area. The authority deriving unit is configured to derive the entry and exit authority to be granted to a user having a corresponding relationship with the management area, with respect to the authentication device interposed in the movement path.

5. The access authority management system according to claim 1 or 2, wherein: The authority granting unit is configured to grant the entry / exit authority in response to an input from a manager or an input from the authority deriving unit.

6. The access authority management system according to claim 1 or 2, wherein: The authority granting unit is configured to further grant each user unlocking authority for the safe disposed in the management area. The access authorization management system includes a route search unit that searches for a movement route from an entrance of the facility to the management area. The notification unit is configured to notify a manager when the entry / exit authority required for passing through the movement route is not granted to the user to whom the unlocking authority is granted.

7. The access authority management system according to claim 6, wherein: The access authorization management system includes a performance evaluation unit that updates unlocking performance including the last date and time of use of the safe by each user. The notification unit is configured to notify a manager when the elapsed time from the last use date exceeds a reference time.

8. An information processing device, comprising: The authority granting department grants access rights to each user according to each management area divided within the facility; a first acquisition unit for acquiring a correspondence relationship between the user and the management area based on first information in which information on the organization to which the user belongs is associated with identification information of each user and second information in which information on the management area is associated with information on each organization; an authority deriving unit for deriving, based on the correspondence relationship acquired by the first acquiring unit, an entry and exit authority to be granted for each of the management areas and each of the users; as well as A notification unit notifies a manager when the entry / exit authority derived by the authority deriving unit and the entry / exit authority granted by the authority granting unit do not match.

9. A method for managing access rights, wherein a computer manages the access rights granted to each user according to each management area divided in a facility, wherein: The access authority management method comprises the following steps: The permission granting step is to grant the access permission; A first acquisition step of acquiring a correspondence between the user and the management area based on first information in which information on the organization to which the user belongs is associated with identification information of each user and second information in which information on the management area is associated with information on each organization; a permission exporting step of exporting the access permission to be granted to each of the management areas and each of the users based on the correspondence relationship obtained in the first obtaining step; as well as A notification step of notifying the administrator when the entry / exit authority derived in the authority deriving step is inconsistent with the entry / exit authority granted in the authority granting step.

10. A computer-readable recording medium having a program recorded thereon, the program causing the computer to manage the access rights granted to each user for each management area divided within a facility, wherein: The program is composed of: acquiring first information in which information on the organization to which the user belongs is associated with identification information of each user, and second information in which information on the management area is associated with information on the organization, Acquire the correspondence between the user and the management area based on the first information and the second information, Based on the correspondence between the user and the management area, the access authority to be granted is derived for each management area and each user. When the exported access authority does not match the granted access authority, the administrator is notified.

Images