Commission processing device, commission processing method and commission processing system

Abstract

To provide a commission processing device, a commission processing method and a commission processing system which allow a commission information registering person to more easily register accurate commission information.SOLUTION: A commission processing device includes: a mandator setting unit 202, a commission content setting unit 203, a mandatory setting unit 204 as a first presentation unit which present a candidate of commission information that can be decided based on user information of a mandator and a mandatory as a first input candidate when performing commission from the mandator to the mandatory; a commission condition setting unit 205 as a second presentation unit which presents a commission condition candidate being a candidate of commission information for a candidate other than the first input candidate and a candidate of a commission condition that is determined as a condition of the mandatory by the mandator as a second input candidate; and a commission information registration unit 206 which registers commission information selected from the first input candidate and the second input candidate and being information for performing commission.SELECTED DRAWING: Figure 4

Description

[Technical field]

[0001] The present invention relates to a delegation processing device, a delegation processing method, and a delegation processing system. In particular, the present invention relates to a delegation processing device, a delegation processing method, and a delegation processing system that can be suitably used when a delegator delegates an act to be performed by a delegator to a delegate. [Background technology]

[0002] Delegation processing, in which a delegator delegates an action to be performed by a delegator to an agent, is performed in actual business. For example, delegation processing requires that a delegator delegates an action to an agent in advance, and that when the agent performs the delegated action, the agent's action is authorized by the system that manages the delegation. When the system that manages the delegation authorizes the agent's action, delegation information including the delegation content is registered in the system before authorization processing is performed, and the system that manages the delegation performs authorization based on the delegation information.

[0003] Patent Document 1 describes that the server is configured to provide a trusted third party with a ticket that authenticates the server, information about the target service that the server is trying to access on behalf of the client, and a service ticket associated with the client. This service ticket can be provided by the client, or it can be an issued service ticket issued to the server on its own behalf in the name of the client. The trusted third party issues a new service ticket to the server in the name of the client to access the target service, if the delegation is permitted according to the delegation constraints associated with the client.

[0004] Patent Document 2 also describes that the entrusting party grants the primary entrustee access rights to documents in a document management system, and sets the client certificate and user attribute conditions that the secondary entrustee must satisfy in a certificate condition table and a user attribute condition table. The primary entrustee is authenticated by the authentication and authorization server to obtain a primary token, and passes the primary token to the secondary entrustee. The secondary entrustee presents the primary token to the authentication and authorization server via the intermediate server, and requests a secondary token. The authentication and authorization server provides the secondary token if the secondary entrustee satisfies the conditions in the certificate condition table and the user attribute condition table. The secondary entrustee presents the secondary token when requesting the document. [Prior art documents] [Patent documents]

[0005] [Patent Document 1] JP 2003-99401 A [Patent Document 2] JP 2016-51451 A Summary of the Invention [Problem to be solved by the invention]

[0006] However, when a delegation information registrant registers delegation information including the delegation contents in a system that manages delegation, for example, the delegation information registrant needs to confirm the attribute information of the agent and the authority regarding the delegation contents. Therefore, the delegation information registrant needs to collect the attribute information of the agent and the delegation contents information, which places a heavy burden on the delegation information registrant. In addition, when registering delegation information, the delegation information registrant often manually inputs the registration items as delegation information, but since there are many condition settings related to the delegation contents and the agent and it is difficult to make them into rules, setting errors are likely to occur. An object of the present invention is to provide a delegation processing device, a delegation processing method, and a delegation processing system that enable a delegation information registrant to register accurate delegation information more easily. [Means for solving the problem]

[0007] In order to solve the above problems, the present invention provides a delegation processing device that can be determined based on user information of the delegator and the agent when delegating from a delegator to an agent, and that includes a first presentation unit that presents candidates for delegation information, which is information for delegating, as first input candidates, a second presentation unit that presents candidates for delegation conditions other than the first input candidates, which are candidates for delegation conditions that the delegator sets as conditions for the agent, as second input candidates, and a delegation information registration unit that registers delegation information selected from the first input candidates and the second input candidates.In this case, a delegation processing device can be provided that allows a delegation information registrant to register accurate delegation information more easily.

[0008] Here, the first input candidate may include a delegator candidate determined based on user information. In this case, the delegation information registrant can more easily set the delegator by selecting the delegator from the delegator candidates. Also, it is possible to prevent mistakes in setting the delegator. Furthermore, the delegator candidate can select a user who satisfies the conditions for becoming a delegator candidate based on the user information, so that a user suitable as a delegator can be selected. Furthermore, the first input candidate may further include delegation content candidates, which are candidates for delegation content required based on the authority held by a delegator selected from the delegator candidates. In this case, the delegation information registrant can set the delegation content more easily by selecting the delegation content from the delegation content candidates. Also, it is possible to prevent mistakes in setting the delegation content. Furthermore, the delegation content candidates can be determined based on the resources owned by the delegator selected from the delegator candidates, making it possible to extract suitable delegation content. The first input candidate may include resource candidates of the delegator, which are derived from the delegation content candidates. In this case, the delegation information registrant may select resources owned by the delegator from the resource candidates, and may more easily set the resources owned by the delegator. Furthermore, the first input candidate may include a candidate agent, which is a candidate agent for a person who is determined based on the authority required for the agent, which is determined from the delegation content selected from the delegation content candidates. In this case, the delegation information registrant can set the agent more easily by selecting the agent from the candidate agents. Also, it is possible to prevent mistakes in setting the agent. Furthermore, the delegation information can include information on the delegator, the delegation contents, the agent, the resources owned by the delegator, and the delegation conditions. In this case, the delegation information can reflect the intention of the delegation information registrant. The second presentation unit can then verify whether the agent satisfies the delegation condition selected from the delegation condition candidates. In this case, the agent suitable for the delegation condition can be selected. In addition, when a delegator further delegates the delegation contents that he / she has been delegated (sub-delegation), the sub-delegation setting unit is further provided for setting the delegator (sub-agent) in the sub-delegation, and the sub-delegation setting unit can present sub-agent candidates who are candidates for the sub-agent. In this case, the delegation information registrant can more easily set the sub-agent by selecting the sub-agent from the sub-agent candidates. Also, mistakes in setting the sub-agent can be suppressed. Furthermore, the sub-delegation setting unit can make the range of conditions set in the delegation information the same or smaller each time sub-delegation is performed. In this case, when sub-delegation is performed, the possibility of delegation to an unintended person is reduced. Furthermore, the conditions set in the delegation information can be at least one of a limit on the number of times re-delegation can be performed and a range within which re-delegation is possible. In this case, re-delegation can be performed according to the intent of the delegator. The sub-delegation setting unit can add conditions to be set in the delegation information. In this case, delegation conditions can be added for each sub-agent.

[0009] The present invention also provides a delegation processing method in which, when delegating from a delegator to a recipient, a candidate for delegation information, which is information for delegating, can be determined based on the user information of the delegator and the recipient by having a processor execute a program recorded in a memory, and a candidate for delegation information other than the first input candidate, which is a candidate for delegation condition that the delegator sets as a condition for the recipient, is presented as a second input candidate, and delegation information selected from the first input candidate and the second input candidate is registered. In this case, a delegation processing method can be provided that allows a delegation information registrant to register accurate delegation information more easily.

[0010] Furthermore, the present invention provides a delegation processing system that includes a delegation processing device that sets delegation information when delegating from a delegator to a recipient, and a delegation management device that allows the recipient to process the delegation content based on the delegation information, and the delegation processing device can be determined based on user information of the delegator and the recipient when delegating from the delegator to the recipient, a first presentation unit that presents candidates of delegation information, which is information for delegating, as first input candidates, a second presentation unit that presents candidates of delegation conditions, which are candidates of delegation information other than the first input candidates and are candidates of delegation conditions set by the delegator as conditions for the recipient, as second input candidates, and a delegation information registration unit that registers delegation information selected from the first input candidates and the second input candidates. In this case, a delegation processing system that allows a delegation information registrant to register accurate delegation information more easily can be provided. Effect of the Invention

[0011] According to the present invention, it is possible to provide a delegation processing device, a delegation processing method, and a delegation processing system that enable a delegation information registrant to register accurate delegation information more easily. [Brief description of the drawings]

[0012] [Figure 1] 1 is a diagram illustrating an example of the overall configuration of a delegation processing system to which an embodiment of the present invention is applied. [Diagram 2]This is a diagram showing the hardware configuration of a delegation information registrant terminal, a delegation information setting system, an authentication / authorization server, a resource server, and an application server. [Diagram 3] 1A and 1B are diagrams illustrating the operation of the delegation processing system. [Figure 4] FIG. 2 is a block diagram showing an example of a functional configuration of a delegation information setting system. [Diagram 5] FIG. 2 is a block diagram showing an example of a functional configuration of an authentication / authorization server. [Figure 6] FIG. 2 is a block diagram illustrating an example of a functional configuration of a resource server. [Figure 7] FIG. 13 is a diagram showing a data structure of a delegation content table. [Figure 8] FIG. 13 is a diagram showing a data structure of a delegation condition table. [Figure 9] FIG. 2 illustrates a data structure of an account management table. [Figure 10] 13 is a diagram showing a data structure of a delegation information management table. FIG. [Figure 11] FIG. 1 is a diagram showing the overall operation of processes 1 to 3. [Figure 12] FIG. 11 is a sequence diagram showing process 1. [Figure 13] 12A is a diagram showing a case where the authority held by the delegator is set as the attribute value of the delegator's attribute information (information acquired from the account management table 311) in S1208 of Fig. 12. FIG. 12B is a diagram showing the process of acquiring delegation content candidates and resource candidates from the authority held by the delegator in S1209 of Fig. 12. [Figure 14] FIG. 14 is a diagram showing the agent candidate condition calculation process in S1212 of FIG. [Figure 15] FIG. 11 is a sequence diagram showing processes 2 and 3. [Figure 16] FIG. 12 shows a screen displayed when a delegation information registrant makes a delegation information setting request in S1201 of FIG. [Figure 17]This figure shows a screen on which delegate candidate candidates are presented in S1206 to S1207 of FIG. 12 and on which the delegation information registrant selects and inputs a delegate from the delegate candidate candidates. [Figure 18] This figure shows a screen on which delegation content candidates are presented on the screen in S1210 to S1211 of FIG. 12 and on which the delegation information registrant selects and inputs delegation content from the delegation content candidates. [Figure 19] FIG. 12 shows a screen on which resource candidates are presented in S1210 to S1211, and on which the delegation information registrant selects and inputs a resource from the resource candidates. [Figure 20] This figure shows a screen on which agent candidates are presented in S1215 to S1216 of FIG. 12 and on which the delegation information registrant selects an agent from the agent candidates and inputs the agent. [Figure 21] FIG. 21 shows a screen for temporarily saving the contents set up to FIG. 20 as basic information. [Figure 22] This figure shows a screen on which delegation condition candidates are presented in S1502 to S1503 of FIG. 15 and on which the delegation information registrant selects and inputs a delegation condition from the delegation condition candidates. [Diagram 23] FIG. 15 shows a screen on which the delegation information registrant checks and approves the delegation information in S1506 of FIG. 15. [Figure 24] FIG. 17 shows a screen presenting delegation information to be registered in S1507 of FIG. [Diagram 25] FIG. 13 is a diagram showing delegation information to be registered. [Figure 26] FIG. 13 is a diagram illustrating sub-delegation. [Figure 27] 13A and 13B are diagrams showing the range of conditions set in delegation information when sub-delegation is performed. [Figure 28] FIG. 13 is a diagram showing the operation of the delegation information setting system when performing sub-delegation. [Figure 29] FIG. 13 is a sequence diagram showing a process when performing re-delegation. [Diagram 30]FIG. 13 is a diagram showing a screen on which a delegation information registrant confirms and approves sub-delegation information. [Diagram 31] FIG. 13 is a diagram showing a screen presenting sub-delegation information to be registered. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0013] Hereinafter, embodiments of the present invention will be described in detail with reference to the accompanying drawings.

[0014] <Overall explanation of delegation processing system 1> FIG. 1 is a diagram showing an example of the overall configuration of a delegation processing system 1 to which this embodiment is applied. As shown in the figure, the delegation processing system 1 includes a delegation information registrant terminal 10, a delegation information setting system 20, an authentication / authorization server 30, a resource server 40, and an application server 50. These are connected via a network 60.

[0015] The delegation information registrant terminal 10 is a terminal device operated by the delegation information registrant to register the delegation. Here, "delegation" means that the delegation information registrant entrusts an agent with performing a certain act. "Delegation" is sometimes called an agent or a proxy. Also, the "delegation information registrant" is a person who sets the delegation using the delegation information registrant terminal 10. The delegation information registrant may be the delegator himself, or may be a person who operates the delegation information registrant terminal 10 on behalf of the delegator to register the delegation. The "delegation content" is the processing content delegated by the delegator to the agent. The delegation content is not particularly limited, but may be, for example, an action required when the delegator performs the business. Examples of such actions include creating and editing electronic documents, signing electronic documents, and settlement processing.

[0016] The delegation information setting system 20 is an example of a delegation processing device, and sets delegation information when a delegator delegates to an agent. The authentication / authorization server 30 is an example of a delegation management device, and gives permission to the agent to process the delegation contents based on the delegation information. In this embodiment, the authentication / authorization server 30 accepts a request for authentication of the agent. After authentication, the authentication / authorization server 30 gives permission to the agent to process the delegation contents. The resource server 40 has resources to process the delegation contents. The resource server 40 grants the authority to process resources when the agent is authenticated and authorized by the authentication and authorization server 30. The resource server 40 accepts a request from the agent to process resources according to the delegation contents, and returns the processing results to the agent.

[0017] The application server 50 executes application software for processing the contents of delegation by the agent. The agent processes the contents of delegation given to the resource server 40 by executing this application software. The network 60 is a communication means used for information communication between the delegation information registrant terminal 10, the delegation information setting system 20, the authentication and authorization server 30, the resource server 40, and the application server 50, and is, for example, the Internet, a LAN (Local Area Network), or a WAN (Wide Area Network). The network 60 may be either wired or wireless, or a combination of these. The network 60 may be connected via multiple communication lines using relay devices such as a gateway device or a router.

[0018] FIG. 2 is a diagram showing the hardware configuration of the delegation information registrant terminal 10, the delegation information setting system 20, the authentication / authorization server 30, the resource server 40, and the application server 50. As shown in FIG. These are computer devices such as PCs (Personal Computers) and server computers. As shown in the figure, these devices include a processor 101 such as a CPU (Central Processing Unit), a main memory device 102 as a storage means, and an auxiliary memory device 103 such as an HDD (Hard Disk Drive) or SSD (Solid State Drive). Here, the processor 101 executes various software such as an OS (operating system software) and an application program (application software). The main memory device 102 is a storage area that stores various software and data used for executing the software. The auxiliary memory device 103 is a storage area that stores input data for the various software and output data from the various software. These also include an input device 104 such as a keyboard, mouse, or touch panel, a display device 105 such as a video memory or display, and a communication interface (communication I / F) 106 for communicating with the outside.

[0019] <Overall description of the operation of the delegation processing system 1> 3(a) and 3(b) are diagrams showing the operation of the delegation processing system 1. FIG. Of these, FIG. 3(a) is a diagram showing delegation information registration in which a delegation information registrant (delegator) registers delegation information as Step 1. Here, it is shown that the delegation information registrant (delegator) registers in advance delegation information including the delegation contents together with user information and policies in the authentication and authorization server 30. This completes the preparation for the agent to process the delegation contents.

[0020] FIG. 3(b) is a diagram showing a delegated process in which the delegate processes the delegated contents in the delegation processing system 1 as Step 2. First, the agent accesses the application server 50 (1. Access) and sends a token requesting authentication and authorization of delegation to the authentication and authorization server 30 (2. Token Request). The authentication and authorization server 30 determines whether to permit delegation to the agent based on the delegation information (3. Delegation Permitted). If permitted, the authentication and authorization server 30 returns a token indicating permission to the application server 50 (4. Token). Next, the agent makes a request to process resources in the resource server 40 via the application server 50 and sends a token to actually perform the processing (5. Processing Request + Token). The resource server 40 then returns the processing result to the application server 50 (6. Processing Result).

[0021] Here, when authorizing a general-purpose system using the resource server 40 to process the delegated content, the authorization process and authentication process are consolidated in the authentication / authorization server 30, and the authorization decision result is returned to the resource server 40. In this case, it is necessary to store in advance in the authentication / authorization server 30 the user information (including user attribute information, etc.) that the authentication / authorization server 30 uses for authorization decision and the policy for authorization decision. The advantages of adopting such a method include convenience for users, who can manage their own information in one place (in this case, the authentication / authorization server 30), as well as convenience for administrators, who do not need to manage personal information / the amount of information to be managed is reduced. Therefore, in systemizing delegation processing, there is expected to be a demand for being able to handle authorization processing including delegation by using a general-purpose authentication / authorization server 30, just like a general-purpose system such as the resource server 40.

[0022] In addition, the following points (1) to (3) can be mentioned as key points in the delegation information registration shown in FIG. (1) The delegation information is registered with the content intended by the delegator. This is because delegation is carried out by the agent under the responsibility of the delegator. (2) The delegator may delegate to the agent only the matters that are based on the authority that the delegator himself / herself possesses. This is because delegation means that the agent processes matters on behalf of the principal. (3) The agent has the authority to handle the matter and meets the conditions imposed by the principal. This is because, in addition to point (1), legal issues may arise.

[0023] On the other hand, as shown in FIG. 3(a), when a delegation information registrant (delegator) registers delegation information, the following problems (4) and (5) arise. (4) When a delegator registers, the burden of registering the delegation information is large. This is mainly because the confirmation in (3) above takes time. In other words, the delegator needs to confirm the attribute information of the agent and the authority regarding the delegation content, and for that purpose, the delegator needs to collect, for example, the attribute information of the agent and the delegation content information. (5) When a delegation information registrant registers delegation information on behalf of a delegator, there is a possibility that information different from the delegation content intended by the delegator will be registered as the delegation information. This is because delegation conditions vary depending on the will of the delegator, making it difficult to turn the delegation content into rules; because delegation information is entered manually, configuration errors are likely to occur; and there may be a misunderstanding between the delegator and the person registering the delegation information.

[0024] Therefore, in this embodiment, when registering the delegation information shown in Fig. 3(a), the delegation processing system 1 performs the following processing to solve the above problem. This makes it possible to improve the convenience and accuracy of registering the delegation information.

[0025] <Explanation of the functional configuration of the delegation processing system 1> FIG. 4 is a block diagram showing an example of the functional configuration of the delegation information setting system 20. As shown in FIG. As shown in the figure, the delegation information setting system 20 includes a delegation information setting request receiving unit 201, a delegator setting unit 202, a delegation content setting unit 203, a delegate setting unit 204, a delegation condition setting unit 205, a delegation information registration unit 206, a delegation information registration management store setting unit 207, a delegation information confirmation unit 208, a sub-delegation setting unit 209, and a delegation information registration management store 210. The delegation information setting request receiving unit 201 receives a delegation information setting request, which is a request to set delegation information, from a delegation information registrant. The delegator setting unit 202 calculates the delegator candidate conditions and acquires user information from the account management table 311 (see FIG. 5) of the authentication / authorization server 30. The delegator candidate conditions are conditions for becoming a delegator candidate. The delegator setting unit 202 then finds delegator candidates who are candidates for the delegator from the delegator candidate conditions and the user information, and presents the delegator candidates to the delegator information registrant. When the delegator information registrant then inputs to select a delegator from the delegator candidates, the delegator setting unit 202 acquires this as a response. The delegation content setting unit 203 calculates delegation content candidate conditions and acquires delegation content candidate information from the delegation content table 211 of the delegation information registration management store 210. The delegation content candidate conditions are conditions for extracting delegation content candidates. Then, the delegation content setting unit 203 obtains delegation content candidates from the authority held by the selected delegator, and presents the delegation content candidates to the delegation information registrant. The authority held by the delegator can be acquired from attribute information held by the selected delegator. Then, when the delegation information registrant makes an input to select delegation content from the delegation content candidates, the delegation content setting unit 203 acquires this as an answer. The agent setting unit 204 calculates the agent candidate conditions and obtains user information from the account management table 311 of the authentication / authorization server 30. The agent candidate conditions are the conditions for becoming an agent candidate. Then, agent candidates who are candidates for the agent are obtained from the agent candidate conditions and the user information, and the agent candidates are presented to the delegation information registrant. Then, when the delegation information registrant makes an input to select an agent from the agent candidates, the agent setting unit 204 obtains this as a response. The delegation condition setting unit 205 acquires delegation condition candidates, which are candidates for delegation conditions that the delegator specifies as conditions for the agent, from the delegation condition table 212. Then, the delegation condition candidates are presented to the delegation information registrant. Then, when the delegation information registrant inputs a delegation condition to be selected from the delegation condition candidates, the delegation condition setting unit 205 acquires this as a response.

[0026] The delegation information registration unit 206 sends a request to register the delegation information and the delegation information to the authentication and authorization server 30. In this embodiment, the delegation information includes information on the delegator, the delegation content, the agent, the resources owned by the delegator, and the delegation conditions. In other words, the delegation information is information that allows the "delegator" to permit the "agent" to perform "processing content" on the "resources owned by the delegator" under the "delegation conditions." Depending on the delegation content, the resources owned by the delegator may not be necessary. The delegation information registration management store setting unit 207 provides the delegation information registrant with a function of editing data in the delegation content table 211 and the delegation condition table 212 in the delegation information registration management store 210. The delegation information confirmation unit 208 sends a request to acquire delegation information to the delegation information setting unit 302 (see FIG. 5) of the authentication / authorization server 30, and presents the acquired delegation information to the delegation information registrant. The delegation information confirmation unit 208 also accepts a request to set delegation information or a request to set re-delegation. The sub-delegation setting unit 209 sets the sub-agent when the agent sub-delegates to the sub-agent. The delegation information registration and management store 210 includes a delegation content table 211 and a delegation condition table 212 . The delegation content table 211 stores conditions of the delegator and the agent for the delegation content, which is the content of the process to be delegated. The delegation condition table 212 stores the contents of the delegation conditions.

[0027] FIG. 5 is a block diagram showing an example of the functional configuration of the authentication / authorization server 30. As shown in FIG. As shown in the figure, the authentication and authorization server 30 includes a user information management store setting unit 301 , a delegation information setting unit 302 , an authentication and authorization unit 303 , and a user information management store 310 . The user information management store setting unit 301 sets data to be stored in an account management table 311 and a delegation information management table 312 of the user information management store 310 . When a request for registration of delegation information is received from the delegation information setting system 20, the delegation information setting unit 302 sets the delegation information in the delegation information management table 312 of the user information management store 310. The authentication and authorization unit 303 receives a request for authentication or authorization from the application server 50, performs authentication and authorization of the user based on the data stored in the account management table 311 and the delegation information management table 312, and returns the result as a token. The user information management store 310 includes an account management table 311 and a delegation information management table 312 . The account management table 311 stores user information, which is information on users who use the delegation processing system 1. The user information includes a user name, user attributes linked to the user name, etc. A delegator and an agent are selected from users whose user information is stored in the account management table 311. The delegation information management table 312 stores the delegation information sent from the delegation information setting system 20 .

[0028] FIG. 6 is a block diagram showing an example of the functional configuration of the resource server 40. As shown in FIG. As shown in the figure, the resource server 40 includes a delegation information confirmation unit 401 , a resource management unit 402 , a process execution unit 403 , and a resource information management store 410 . The delegation information confirmation unit 401 confirms the delegation information when the agent makes a request to process a resource in the resource server 40 . The resource management unit 402 manages the resources stored in the resource information management store 410 . The process execution unit 403 executes a process using a resource stored in the resource information management store 410 based on the delegation information. The resource information management store 410 includes a resource management table 411. The resource management table 411 manages the sources stored in the resource information management store 410.

[0029] FIG. 7 is a diagram showing the data structure of the delegation content table 211. As shown in FIG. The delegation content table 211 includes the following items: delegation content, conditions of the delegator, resources of the delegator, and conditions of the agent. The delegation content is the content of the delegation described above. The delegator's conditions are the conditions of the delegator required for the delegation content. The delegator's resources are the resources owned by the delegator that are required to execute the delegation content. Resources can also be said to be elements required for the delegator to perform their work. The agent's conditions are the conditions of the agent required for the delegation content. Here, when the delegation content is "use of a signature key," the delegator's condition is "possessing a signature key," and the delegator's resource is the "signature key." Also, when the delegation content is "use of a signature key," the agent's condition is "having XX qualification."

[0030] FIG. 8 is a diagram showing the data structure of the delegation condition table 212. As shown in FIG. The delegation condition table 212 includes predetermined condition contents. Here, the condition contents "within the same department" and "job title: □□ or higher" are prepared in advance as the condition contents.

[0031] FIG. 9 is a diagram showing the data structure of the account management table 311. As shown in FIG. The account management table 311 stores user information and includes the following items: user name, password, attribute 1: department, attribute 2: job title, attribute 3: resource, and attribute 4: qualifications. User name is the user's name or ID. PW is the password used for authentication. Attribute 1: Department, Attribute 2: Job title, Attribute 3: Resource, and Attribute 4: Qualifications are attribute information for a user, and respectively indicate the department to which the user belongs, the user's job title, the resources owned by the user, and the qualifications held by the user.

[0032] FIG. 10 is a diagram showing the data structure of the delegation information management table 312. As shown in FIG. The delegation information management table 312 includes the following items: delegator, delegation content, resource, delegation authority, agent, delegation conditions, and delegation information registrant. Among these, the delegator, the delegation contents, the agent, and the delegation information registrant are as described above. In addition, the resource is the resource of the delegator, and the delegation authority is the authority to delegate.

[0033] <Detailed explanation of the operation of the delegation information setting system 20> Next, a detailed description will be given of the operation of the delegation information setting system 20. The delegation information setting system 20 performs the following processes 1 to 3 in order.

[0034] (Process 1) The delegation information setting request receiving unit 201, the delegator setting unit 202, the delegation content setting unit 203, and the agent setting unit 204 set delegation information from candidates of delegation information that can be mechanically calculated based on user information prepared in advance. In process 1, the delegator, delegation content, agent, and resources owned by the delegator are set among the delegation information. In actual process, the delegation information is set in an interactive format between the delegation information setting system 20 and the delegation information registrant. That is, the delegation information is set in the following format: narrowing down input candidates based on user information, etc. → presentation of input candidates → input (answer) by the delegation information registrant.

[0035] (Process 2) The delegation condition setting unit 205 sets delegation information that cannot be mechanically calculated based on user information, etc. In process 2, delegation conditions are set from among the delegation information. Here, too, the actual process involves setting this delegation information through an interaction between the delegation information setting system 20 and the delegation information registrant. That is, the delegation conditions are set in the format of narrowing down delegation conditions → presentation of input candidates → input (answer) by the delegation information registrant.

[0036] (Process 3) The delegation information registration unit 206 registers the set delegation information in the delegation information management table 312 of the authentication / authorization server 30 .

[0037] Fig. 11 is a diagram showing the overall operation of processes 1 to 3. Fig. 12 is a sequence diagram showing process 1. Here, exchange of information between a delegation information registrant terminal 10 (delegation information registrant), a delegation information setting system 20, and an authentication / authorization server 30 is shown.

[0038] Process 1 will be described below with reference to FIGS. First, a delegation information registrant makes a delegation information setting request, which is a request to set delegation information, from the delegation information registrant terminal 10 (S1201). Then, the delegation information setting request receiving unit 201 receives the delegation information setting request (S1202).

[0039] Next, the delegator setting unit 202 performs a delegator candidate condition calculation process as a process for calculating delegator candidate conditions that can be set by the delegation information registrant (S1203). The delegation information registrant can be identified, for example, from the login information entered by the delegation information registrant in S1201. The delegator candidate conditions are, for example, conditions that determine a person in the same affiliation as the delegator as a delegator that can be set, based on the user information of the delegation information registrant. Also, the delegator candidate conditions are, for example, conditions that determine only the delegator himself (the delegation information registrant) as a delegator that can be set. The delegator candidate conditions may be set in advance by the delegator setting unit 202, or a table of these setting candidates may be kept within the delegation processing system 1, and the delegator information registrant may select from this table during the delegator candidate conditions calculation process.

[0040] Next, the delegator setting unit 202 acquires user information (including user attribute information) having the delegator candidate conditions obtained in S1203 from the authentication / authorization server 30 (S1204). This is performed by sending a query requesting user information having the conditions obtained in S1203 to the authentication / authorization server 30, and the authentication / authorization server 30 returns the corresponding user information (S1205). The delegator setting unit 202, which has received the user information, presents the corresponding user as a delegator candidate on the screen (S1206). At the same time, the delegator setting unit 202 presents a selection screen for delegator candidates, and the delegation information registrant selects and inputs a delegator from the delegator candidates (S1207). At this time, the delegator setting unit 202 may present only the name of the delegator candidate on the screen, or may present part of the attribute information (e.g., affiliation) on the screen as well. Through steps S1203 to S1207, the delegator setting unit 202 can set a delegator.

[0041] Next, the delegation content setting unit 203 performs a delegation content candidate condition calculation process (S1208) to calculate delegation content candidate conditions from the attribute information of the delegator selected by the delegator setting unit 202. Here, the delegation content candidate conditions are the authority held by the delegator. The authority held by the delegator is, for example, the attribute value of the attribute information (information acquired from the account management table 311) of the delegator selected by the delegator setting unit 202. In addition, the authority held by the delegator may be obtained, for example, by storing a correspondence table between attribute values ​​and authority in the delegator processing system 1 and this table and the attribute value of the attribute information (information acquired from the account management table) of the delegator selected by the delegator setting unit 202.

[0042] Next, the delegation content setting unit 203 acquires settable delegation content candidates from the delegation content table 211 based on the authority possessed by the delegator obtained in S1208. This is performed by sending a query for delegation content candidates to the delegation content table 211 and acquiring corresponding user information from the delegation content table 211. In addition, resource candidates that are candidates for resources owned by possible delegators are acquired from the user information (account management table 311) of the delegator (S1209). Furthermore, the delegation content setting unit 203 presents delegation content candidates and resource candidates on the screen (S1210). In addition, the delegation content setting unit 203 presents a selection screen for delegation content candidates and resource candidates, and the delegation information registrant selects and inputs the delegation content and resource from these candidates (S1211). Through steps S1208 to S1211, the delegation content setting unit 203 can set the delegation content and the resources owned by the delegator.

[0043] Next, the agent setting unit 204 performs an agent candidate condition calculation process (S1212) as a process for calculating agent candidate conditions from the delegation contents selected by the delegation contents setting unit 203. Here, the agent candidate conditions are the authority required for the agent. Then, the agent setting unit 204 acquires user information of the user having this authority from the authentication / authorization server 30 (S1213). This is performed by sending a query to the authentication / authorization server 30 requesting information on the user having the authority obtained in S1212, and the authentication / authorization server 30 returns the corresponding user information (S1214). The agent setting unit 204, which has received the user information, presents the corresponding user as an agent candidate on the screen (S1215). The agent setting unit 204 also presents a selection screen for agent candidates, and the delegation information registrant selects and inputs an agent from among the agent candidates (S1216). At this time, the agent setting unit 204 may present only the name of the agent candidate on the screen, or may present part of the attribute information (e.g., affiliation) on the screen as well. Through steps S1212 to S1216, the agent setting unit 204 can set an agent.

[0044] The delegator setting unit 202, the delegation content setting unit 203, and the agent setting unit 204 can be determined based on the user information of the delegator and the agent when delegating from the delegator to the agent, and function as a first presentation unit that presents candidates for delegation information, which is information for making the delegation, as first input candidates.

[0045] Here, as shown in S1206 of Fig. 11, the first input candidates include delegator candidates determined based on user information. Then, as shown in S1204 to S1205 of Fig. 11, the delegator candidates are selected from users who satisfy the conditions for becoming delegator candidates based on the user information.

[0046] As shown in S1210 of FIG. 11, the first input candidates further include delegation content candidates, which are candidates for delegation content, obtained based on the authority held by a delegator selected from the delegator candidates. As shown in S1215 of FIG. 11, the first input candidate includes a candidate agent, which is a candidate agent that is determined based on the authority required for the agent based on the delegation content selected from the candidate delegation content.

[0047] FIG. 13(a) is a diagram showing a case where the authority held by the delegator is set as the attribute value of the attribute information of the delegator (information acquired from the account management table 311) in S1208 of FIG. Fig. 13(a) is the account management table 311 shown in Fig. 9. Here, a case is shown in which a user with the user name A-1 is set as the delegator. Also, a case is shown in which the authority of the delegator, user A-1, is attribute 3, which is an attribute value in the account management table 311. In this case, attribute 3 is an owned resource, which in the case of user A-1, is "signature key (A-1)".

[0048] FIG. 13B is a diagram showing the process of acquiring delegation content candidates and resource candidates based on the authority held by the delegator in S1209 of FIG. Fig. 13(b) is a table created based on the delegation content table 211 shown in Fig. 7. Here, when the delegation content is "use of a signature key", the delegator's condition is "possessing a signature key", and the delegator's owned resource is the "signature key".

[0049] The delegation content setting unit 203 sets the authority held by the user A-1 to "signature key (A-1)" from the account management table 311, and sets the settable delegation content candidate to "use of signature key" from the delegation content table 211. Also, since the delegator's condition is "having a signature key" and the delegator's owned resource is "signature key" from the delegation content table 211, the delegation content setting unit 203 sets the resource candidate to "signature key (A-1)" from the account management table 311. FIG. 13(c) shows the results of obtaining the delegation content candidates and resource candidates.

[0050] In this way, the delegation content candidates are obtained based on the resources owned by the delegator selected from the delegator candidates. In this case, it can be said that the first input candidate includes resource candidates for the delegator, which are derived from the delegation content candidates.

[0051] FIG. 14 is a diagram showing the agent candidate condition calculation process in S1212 of FIG. Fig. 14 is a diagram similar to Fig. 13(b), and is a table created based on the delegation content table 211. The agent setting unit 204 sets the conditions of the agent in the delegation content table 211 as the authority required for the agent. Here, it is shown that "has XX qualification" is set as the authority required for the agent.

[0052] FIG. 15 is a sequence diagram showing processes 2 and 3. Here, like FIG. 12, information exchange between the delegation information registrant terminal 10 (delegation information registrant), the delegation information setting system 20, and the authentication / authorization server 30 is shown.

[0053] Processes 2 and 3 will be described below with reference to FIGS. First, the delegation condition setting unit 205 acquires delegation condition candidates that can be set by the delegation information registrant from the delegation condition table 212 (acquire delegation condition information) (S1501). That is, the delegation condition candidates that can be set by the delegator are selected. This is performed by sending a query requesting the delegation condition candidates to the delegation condition table 212 and acquiring the corresponding user information from the delegation condition table 212. Next, the delegation condition setting unit 205 presents the acquired delegation condition candidates on the screen (presentation of delegation condition information) (S1502). At the same time, the delegation condition setting unit 205 presents a selection screen for delegation condition candidates, and the delegation information registrant selects and inputs the delegation condition from the delegation condition candidates (S1503). At this time, the delegation condition setting unit 205 may present options and the delegation information registrant may select, or the delegation information registrant may input information (such as numerical values) related to the options. The former corresponds to, for example, the case of selecting an option with years of service equal to or greater than a specified number, and the latter corresponds to the case of inputting years of service. Then, the delegation condition setting unit 205 verifies that the agent satisfies the delegation conditions based on the attribute information of the agent (S1504). By steps S1501 to S1504, the delegation condition setting unit 205 can perform the process 2 and set the delegation conditions.

[0054] Next, the Entrustment Information Registration Unit 206 presents the entrusted information obtained in Processes 1 and 2 on the screen (S1505). The entrusted information registrant checks and approves the entrusted information (S1506). If disapproved, the process starts over from Process 1. The Entrustment Information Registration Unit 206 presents the entrusted information to be registered and, if the entrusted information registrant approves the entrusted information, sends it to the Authentication and Authorization Server 30 (S1507). Then, the Authentication and Authorization Server 30 registers the entrusted information in the Entrusted Information Management Table 312 (S1508). Through S1505 to S1508, the Entrustment Information Registration Unit 206 performs Process 3 and can register the entrusted information in the Authentication and Authorization Server 30.

[0055] The Entrustment Condition Setting Unit 205 functions as a second presentation unit that presents, as a second input candidate, an entrustment condition candidate that is a candidate for entrusted information other than the first input candidate and is a candidate for the entrustment conditions determined by the entruster as the conditions for the trustee. Also, as shown in S1504 of FIG. 15, the Entrustment Condition Setting Unit 205 verifies whether the trustee satisfies the entrustment conditions selected from among the entrustment condition candidates. Then, the Entrustment Information Registration Unit 206 registers the entrusted information selected from the first input candidate and the second input candidate.

[0056] <Explanation of UI (User Interface)> Next, in Processes 1 to 3, the UI when the entrusted information registrant sets entrusted information using the Entrusted Information Registrant Terminal 10 will be described. FIG. 16 is a screen displayed when the entrusted information registrant makes an entrusted information setting request in S1201 of FIG. 12. The illustrated screen is a so-called home screen. On this screen, a button Bt1 for newly registering entrusted information and a button Bt2 for checking, changing, and deleting entrusted information are displayed. When the entrusted information registrant presses the button Bt1, the processes after S1202 are started.

[0057] FIG. 17 shows a screen on which delegator candidates are presented in S1206 to S1207 of FIG. 12, and on which the delegation information registrant selects and inputs a delegator from the delegator candidates. In the illustrated screen, a pull-down menu Pm1 is displayed, and users with user names A-1 to A-4 are displayed as delegator candidates. For example, when a delegation information registrant selects user A-1 and presses the OK button Bt3, user A-1 is selected and entered.

[0058] FIG. 18 shows a screen on which delegation content candidates are presented in S1210 to S1211 of FIG. 12 and on which the delegation information registrant selects and inputs delegation content from the delegation content candidates. In the illustrated screen, a pull-down menu Pm2 is displayed, and "Use signature key" and "Refer to signature key" are displayed as delegation content candidates. For example, when the delegation information registrant selects "Use signature key" and presses the OK button Bt4, "Use signature key" is selected and input.

[0059] FIG. 19 shows a screen on which resource candidates are presented in S1210 to S1211 of FIG. 12, and on which the delegation information registrant selects and inputs a resource from the resource candidates. In the illustrated screen, a pull-down menu Pm3 is displayed, and "Signature key (A-1)" is displayed as a resource candidate. For example, when the delegation information registrant selects "Signature key (A-1)" and presses the OK button Bt5, "Signature key (A-1)" is selected and input.

[0060] FIG. 20 shows a screen on which agent candidates are presented in S1215 to S1216 of FIG. 12, and on which the delegation information registrant selects an agent from the agent candidates and inputs the selected agent. In the illustrated screen, a pull-down menu Pm4 is displayed, and users with user names B-1 to B-4 are displayed as agent candidates. For example, when the delegation information registrant selects user B-1 and presses the OK button Bt6, user B-1 is selected and entered.

[0061] It is also possible to temporarily save the setting contents at the end of process 1 and issue a delegation information registration request to another delegation information registrant to execute process 2. This is the case, for example, where process 1 is performed by a system administrator and process 2 and subsequent processes are performed by the delegator himself. FIG. 21 shows this case, and shows a screen for temporarily saving the contents set up to FIG. 20 as basic information. In the screen shown in the figure, a dialogue box Db1 is displayed, and when the OK button Bt7 is pressed in response to the message "Do you want to register basic information with the above contents?", the basic information is registered.

[0062] FIG. 22 shows a screen on which delegation condition candidates are presented in S1502 to S1503 of FIG. 15, and also shows a screen on which the delegation information registrant selects and inputs a delegation condition from the delegation condition candidates. In the illustrated screen, a pull-down menu Pm5 is displayed, and "within the same department" and "position: □□ or higher" are displayed as delegation condition candidates. For example, when the delegation information registrant selects "within the same department" and presses the OK button Bt8, "within the same department" is selected and input.

[0063] FIG. 23 shows a screen on which the delegation information registrant confirms and approves the delegation information in S1506 of FIG. In the screen shown in the figure, a dialog box Db2 is displayed, and when the OK button Bt9 is pressed in response to the message "Do you want to register the delegation information with the above details?", the delegation information is registered.

[0064] FIG. 24 shows a screen presenting the delegation information to be registered in S1507 of FIG. In the screen shown in the figure, a dialogue box Db3 is displayed, showing the delegation information to be registered.

[0065] FIG. 25 is a diagram showing delegation information to be registered. Here, the delegator is user A-1, the agent is user B-1, the registrant (the person who registered the delegation information) is user C-1, the delegation content is "Use signature key", the resource (resource owned by the delegator) is "Signature key (A-1)", the delegation condition is "Within the same department", and the delegation information has been registered.

[0066] <Modification> Next, a modification of the above-mentioned delegation information setting system 20 will be described. In a modified example, not only can the delegator delegate to the agent, but the agent can also further delegate to a sub-agent.

[0067] FIG. 26 is a diagram illustrating sub-delegation. First, the delegator delegates the power of attorney to the agent (primary delegation). This delegation (primary delegation) can be made in the manner described above. On the other hand, in this embodiment, the agent can sub-delegate to a sub-agent (delegation [second degree]). It is also possible for the sub-agent to further sub-delegate to another sub-agent (delegation [third degree]). In other words, sub-delegation can be performed any number of times. In FIG. 26, the case where delegation has been performed n times is shown as sub-delegation (delegation [nth degree]). However, when performing re-delegation, there is a possibility that delegation may be given to an unintended person. Also, there are cases where it is desired to add delegation conditions for each re-delegation. Therefore, in this embodiment, for the former, the range of conditions set in the delegation information is made the same or smaller each time re-delegation is performed. In other words, the range of conditions set in the delegation information at the time of re-delegation cannot be made larger. Also, for the latter, it is possible to add conditions to be set in the delegation information. The range of conditions set in the delegation information is, for example, the range in which re-delegation is possible, such as a limit on the number of times re-delegation can be performed, and job title.

[0068] 27(a)-(b) are diagrams showing the range of conditions set in the delegation information when sub-delegation is performed. Of these, Fig. 27(a) is a diagram showing the conditions set in the delegation information. Here, the condition set in the delegation information of the delegator is the condition (primary). Also, the condition set in the delegation information of the agent shows a case where a condition (secondary) is added to the condition (primary). Furthermore, the conditions set in the delegation information of a sub-agent who has been sub-delegated by the agent are the same as those of the agent, showing that they are the condition (primary) and the condition (secondary). In this case, when adding a condition (secondary), if the condition is related to a higher-level delegation condition, it cannot be broader than the condition above it. Methods for verifying this include determining the relationship from the tree structure of job titles, and determining the relationship from the tree structure of qualification information. The left diagram in Figure 27(b) shows this case, and illustrates a case where the range of the condition (secondary) is smaller than the range of the condition (primary). It also illustrates a case where, when a condition (tertiary) is added, the range of the condition (tertiary) is smaller than the range of the condition (secondary). Note that, if the condition is not related to a higher-level delegation condition, it is possible to add conditions without being bound by such restrictions, as shown in the right diagram in Figure 27(b).

[0069] Fig. 28 is a diagram showing the operation of the delegation information setting system 20 when sub-delegation is performed, and Fig. 29 is a sequence diagram showing the processing when sub-delegation is performed. First, the delegation information registrant makes a delegation information setting request, which is a request to set delegation information, from the delegation information registrant terminal 10 (S2901). Then, the delegation information setting request receiving unit 201 receives the delegation information setting request (S2902). Next, the sub-delegation setting unit 209 performs a sub-agent candidate condition calculation process as a process for calculating a sub-agent candidate condition that can be set by the delegation information registrant (S2903). Next, the delegation information confirmation unit 208 obtains the delegation information from the authentication / authorization server 30 and sends it to the delegation information setting unit 302 of the authentication / authorization server 30 (S2904). This is done by sending a query requesting the delegation information to the authentication / authorization server 30, and the authentication / authorization server 30 returns the corresponding delegation information (S2905). The person who registers the delegation information is, for example, an agent.

[0070] Next, the sub-delegation setting unit 209 acquires user information having the sub-agent candidate conditions from the authentication / authorization server 30 (S2906). This is performed by sending a query requesting user information having the sub-agent candidate conditions to the authentication / authorization server 30, and the authentication / authorization server 30 returns the corresponding user information (S2907). The sub-delegation setting unit 209, which has received the user information, presents the corresponding user on the screen as a sub-agent candidate (S2908). At the same time, the sub-delegation setting unit 209 presents a selection screen for the sub-agent candidate, and the delegation information registrant selects and inputs a sub-agent from the sub-agent candidates (S2909). By the above process, a sub-agent can be set.

[0071] Next, the sub-delegation setting unit 209 sets the agent in the delegation information to the delegator, and sets the delegation information to the delegation information while leaving the delegation contents and delegation conditions unchanged (S2910). The sub-delegation setting unit 209 also receives the delegation details as an input, calls the agent setting unit 204, and sets the agent (in this case, the sub-agent) in the delegation information (S2911). Furthermore, the sub-delegation setting unit 209 calls the delegation condition setting unit 205 using the delegation details as an input, and sets additional delegation conditions (S2912). Then, the delegation information registration unit 206 is called using the delegation information set up until now as input of the sub-delegation information, and the sub-delegation information is registered (S2913). By S2903 to S2913, the sub-delegation setting unit 209 can register the sub-delegated person in the authentication / authorization server 30.

[0072] <Explanation of the modified UI> Next, in a modified example, a UI when a delegation information registrant sets sub-delegation information using the delegation information registrant terminal 10 will be described. FIG. 30 shows a screen on which the delegation information registrant confirms and approves the sub-delegation information. In this case, the dialog box Db4 shown in Fig. 23 is displayed. The dialog box Db4 is the same as the dialog box Db2 shown in Fig. 23, except that the delegation conditions in the dialog box Db2 become the sub-delegation conditions. When the OK button Bt10 is pressed in response to the message "Do you want to register the sub-delegation information with the above contents?", the delegation information is registered.

[0073] FIG. 31 shows a screen presenting the sub-delegation information to be registered. In this case, the dialog box Db3 shown in Figure 24 is displayed, displaying the delegation information. Furthermore, a dialog box Db5 is displayed, displaying the sub-delegation information to be registered. Here, it shows that the delegator is user B-1, the agent is user D-1, the registrant (the person who registered the delegation information) is user C-1, the delegation content is "Use signature key", the resource (resource owned by the delegator) is "signature key (A-1)", the delegation condition is "within the same department", and the delegation information has been registered.

[0074] The information of the delegator, the delegation contents, and the agent are not independent information, but are related to each other. Therefore, it is possible to narrow down the input candidates of other information by using each of these pieces of information. In this embodiment, the delegation information setting system 20 is used, and by registering in the order of the delegator → the delegation contents → the agent, the delegation information setting system 20 narrows down the candidates that can be registered in the next setting item, presents them to the delegation information registrant, and sets the delegator, the delegation contents, and the agent. As a result, the burden on the delegation information registrant is reduced, and the delegation information can be registered more easily. In addition, it is possible to suppress the delegation information registrant from setting the delegation information. In other words, it is possible to register the delegation information more accurately. Furthermore, it is possible to register the delegation information that reflects the intention of the delegation information registrant. In this embodiment, the order of registration is the delegator → the delegation contents → the agent, but the order of registration of the delegator, the delegation contents, and the agent is not limited to this, and registration may be performed in any order. At that time, as in the procedure described in this embodiment, the previously registered information (delegator, delegation contents, agent) is used to narrow down the candidates for the information to be set next (delegator, delegation contents, agent), making it easier to register the delegation information. Also, it is possible to prevent the delegation information registrant from making mistakes in setting the delegation information. In other words, it is possible to register the delegation information more accurately. In this embodiment, the delegation information setting system 20 sets the delegator, delegation contents, and agent in the above-mentioned manner as delegation information that can be mechanically calculated based on user information, etc. in process 1, but sets the delegation conditions as delegation information that cannot be mechanically calculated based on user information, etc. In this way, by separating process 1 and process 2 and setting the delegation information, it is possible to set delegation information that reflects the intention of the delegation information registrant. In the past, there was no way to set the delegator, delegation details, agent, and terms of assignment using the above method. According to the modified example, when sub-delegation is performed, the possibility of delegation to an unintended person is reduced. In addition, delegation conditions can be added for each sub-delegator.

[0075] Although the delegation information setting system 20, the authentication and authorization server 30, and the resource server 40 described in detail above are described as separate devices, any two or more of them may be integrated. For example, the delegation information setting system 20 may be incorporated as a function within the authentication and authorization server 30 or the resource server 40. Also, some of the functions of the delegation information setting system 20, the authentication and authorization server 30, and the resource server 40 may be provided as separate devices. Furthermore, a single or multiple delegators and agents may be registered at one time. A group of users may be designated and registered as a delegator and agent. Similarly, any number of delegation contents may be registered at one time. Similarly, any number of delegation conditions may be registered. Furthermore, delegation conditions do not have to be set.

[0076] <Delegation processing method explanation> The above-described processing performed by the delegation information setting system 20 is realized by the cooperation of software and hardware resources. That is, the processor 101 in the computer provided in the delegation information setting system 20 loads software for realizing each of the above-described functions into the main storage device 102, executes the software, and realizes each of these functions. Therefore, the processing performed by the delegation information setting system 20 can be considered as a delegation processing method in which, when delegating from the principal to the agent, a candidate for delegation information, which is information for making the delegation, is determined based on the user information of the principal and the agent by the processor executing a program recorded in memory, a candidate for delegation information, which is information for making the delegation, is presented as a first input candidate, a candidate for delegation information other than the first input candidate, which is a candidate for delegation condition that the principal sets as a condition for the agent, is presented as a second input candidate, and the delegation information selected from the first input candidate and the second input candidate is registered.

[0077] Although the present embodiment has been described above, the technical scope of the present invention is not limited to the scope described in the above embodiment. It is clear from the claims that various modifications and improvements to the above embodiment are also included in the technical scope of the present invention. [Explanation of symbols]

[0078] 1... delegation processing system, 10... delegation information registrant terminal, 20... delegation information setting system, 30... authentication / authorization server, 40... resource server, 50... application server, 201... delegation information setting request receiving unit, 202... delegator setting unit, 203... delegation content setting unit, 204... agent setting unit, 205... delegation condition setting unit, 206... delegation information registration unit, 207... delegation information registration management store setting unit, 208... delegation information confirmation unit, 209... sub-delegation setting unit, 210... delegation information registration management store, 211... delegation content table, 212... delegation condition table, 311... account management table, 312... delegation information management table, 411... resource management table

Claims

1. a first presentation unit that presents candidates of delegation information, which is information for delegating a delegation from a delegator to a recipient and can be determined based on user information of the delegator and the recipient, as a first input candidate; a second presentation unit that presents, as a second input candidate, a delegation condition candidate that is a candidate for delegation information other than the first input candidate and is a candidate for a delegation condition that the delegator specifies as a condition for the agent; a delegation information registration unit that registers delegation information selected from the first input candidate and the second input candidate; A delegation processing device comprising:

2. The delegation processing device according to claim 1 , wherein the first input candidates include delegator candidates determined based on the user information.

3. The delegation processing device according to claim 2 , wherein the delegator candidates are selected from users who satisfy conditions for becoming the delegator candidates based on the user information.

4. The delegation processing device according to claim 3 , wherein the first input candidates further include delegation content candidates that are candidates for delegation content and are determined based on the authority held by the delegator selected from the delegator candidates.

5. The delegation processing device according to claim 4 , wherein the delegation content candidates are determined based on resources owned by the delegator selected from the delegator candidates.

6. The delegation processing device according to claim 5 , wherein the first input candidates include resource candidates of the delegator obtained from the delegation content candidates.

7. The delegation processing device according to claim 4, wherein the first input candidates include agent candidates that are candidates for the agent and are determined based on the authority required for the agent determined from the delegation content selected from the delegation content candidates.

8. The delegation processing device according to claim 1 , wherein the delegation information includes information on the delegator, the delegation contents, the agent and resources owned by the delegator, and the delegation conditions.

9. The delegation processing device according to claim 1 , wherein the second presentation unit verifies whether or not the agent satisfies the delegation condition selected from the delegation condition candidates.

10. A sub-delegation setting unit is further provided for setting a sub-agent when performing sub-delegation, The delegation processing device according to claim 1 , wherein the sub-delegation setting unit presents sub-agent candidates who are candidates for the sub-agent.

11. The delegation processing device according to claim 10 , wherein the sub-delegation setting unit keeps the range of conditions set in the delegation information the same or narrows it every time sub-delegation is performed.

12. The delegation processing device according to claim 11 , wherein the condition set in the delegation information is at least one of a limit on the number of times re-delegation is allowed and a range within which re-delegation is allowed.

13. The delegation processing device according to claim 10 , wherein the sub-delegation setting unit is capable of adding a condition to be set in the delegation information.

14. The processor executes the program stored in the memory, When a delegator delegates to an agent, candidates of delegation information, which can be determined based on user information of the delegator and the agent and are information for delegating, are presented as first input candidates; Present, as a second input candidate, a delegation condition candidate which is a candidate for delegation information other than the first input candidate and is a candidate for a delegation condition that the delegator specifies as a condition for the agent; registering delegation information selected from the first input candidate and the second input candidate; Delegation processing method.

15. A delegation processing device that sets delegation information when delegating from a delegator to a recipient; a delegation management device for allowing the agent to process the delegation contents based on the delegation information; Equipped with The delegation processing device includes: a first presentation unit that presents candidates of delegation information, which is information for delegating a task, as a first input candidate and can be determined based on user information of the delegator and the agent when delegating a task from the delegator to the agent; a second presentation unit that presents, as a second input candidate, a delegation condition candidate that is a candidate for delegation information other than the first input candidate and is a candidate for a delegation condition that the delegator specifies as a condition for the agent; a delegation information registration unit that registers delegation information selected from the first input candidate and the second input candidate; A delegation processing system comprising:

Images