Authority management application and authority management system

Abstract

To provide an authority management application and a data management system that can manage user authority by devices that users log in on in a data directory, and then create inspection audit trails thereof so that even an authority administrator of a production facility department who does not have expert knowledge about a server OS make no operation miss.SOLUTION: There is provided an authority management system 100 that executes an authority management application to manage operation authority by devices, and the authority management system comprises a PC 200 which is driven by a universal OS, a server 300 which is installed locally or on a cloud, display means 400 which serves as a monitor connected to the PC, and a local LAN or Internet communication means 500 which allows the PC and server to communicate with each other. The authority administrator when executing the authority management application on the PC changes operation authority, user by user, according to specifications by devices A, B, C, ..., that need to be under authority management while confirming users and operation authority displayed on the display means.SELECTED DRAWING: Figure 1

Description

[Technical field]

[0001] The present invention relates to an authority management application (hereinafter referred to as an authority management app) that manages the authority of a user who is logged in to an apparatus, and to an authority management system.

[0002] Specifically, this relates to an authority management application and authority management system that executes and stores the registration, modification, deletion, etc. of users and their authorities (hereinafter referred to as authority registration, etc.) in advance on a PC (including a server), and then stores the authority registration, etc. in a server directory where a communication protocol called Lightweight Directory Access Protocol (hereinafter referred to as LDAP) of the server OS is implemented.

[0003] Servers use directory services that assign unified identification names to network resources, such as user accounts, shared folders, and network-connected devices such as printers, and can register, record, search, and provide information on their location, attributes, settings, etc.

[0004] Information on network resources registered on the server is communicated according to the directory service's communication protocol. LDAP is used as the directory service's communication protocol. Specific examples of LDAP that client PCs access and use include "Active Directory (registered trademark)" and "OpenLDAP" (hereafter referred to as AD), which manage resources on a Windows (registered trademark) network. The directory structure of the server used for the directory service is a simple hierarchical data structure suited to the characteristic that reads are frequent relative to writes.

[0005] The present invention relates to a technology for managing user rights of network resources, particularly production facilities, by managing user rights through LDAP. Specifically, the present invention relates to an authority management application and an authority management system that create access rights for users to network resources, update the access rights in the AD of a server, store the history, and create an audit trail based on the history. [Background technology]

[0006] Conventionally, applications for PCs (hereafter referred to as applications) store a tabular authority management database (hereafter referred to as DB) within the application, and the DB collates user IDs and passwords to manage whether or not the application can be operated. Similarly, for production equipment, a tabular DB created for each piece of production equipment is stored in the production equipment itself, the server for the production equipment, or a client PC, and the DB manages the authority to operate the production equipment.

[0007] Meanwhile, the authority management for logging in to client PCs belonging to the network and the use of printers, etc. is performed by AD of the server OS that manages the client PCs. In authority management by AD, the target devices and the execution authority of the user are registered in multiple groups configured in a hierarchical data structure. Specifically, a user is registered in one of the groups, and for devices such as printers that belong to that group, the user is allowed to operate the target devices within the scope of the execution authority granted to the group.

[0008] By using an IC card with biometric authentication function to guarantee the authenticity of a user and allowing only genuine users to run client PCs based on the authority registration etc. stored in the AD of the server, it is easy to prevent unauthorized execution. Particularly in the field of factory automation (hereinafter referred to as the FA field), storing a hierarchical data structure of administrator authority, operator authority, viewer authority etc. in the AD of the server makes it easy to prevent unauthorized operation of production equipment and is therefore ideal.

[0009] However, in the FA field, there are many devices to be managed, and the reality is that the authority registration of users in each department is done by an authority administrator appointed for each department. This makes it difficult to obtain specialized knowledge about the server OS, and registration errors are likely to occur, which has hindered the widespread use of authority registration using AD.

[0010] For example, if a group registered in AD is mistakenly deleted, it is not enough to simply restore the group; all users belonging to that group must be individually re-registered and any problems that arise as a result of deleting the group must also be resolved, resulting in problems that could disrupt production plans.

[0011] In particular, in the field of factory automation, where efficient production to avoid producing defective products is required, there was a demand for a permissions management app that would enable even permissions administrators without specialized knowledge of server OS to register permissions in AD easily and without making mistakes.

[0012] In addition, AD only stores the latest execution authority, and does not have the function to record who changed AD or accumulate and store authority history. Therefore, there was a problem that it was not possible to create an audit trail record to prove the operation history of production equipment and the authority history of users only from the AD of the OS server.

[0013] Non-Patent Document 1 discloses a technology in which an authority management server constantly monitors all changes to an AD domain, acquires the changes, and centrally manages log information. In AD, the history of added / changed operation contents, PC, operating user, time of change, etc. is acquired, and an audit trail can be created from the change history.

[0014] However, the technology disclosed in Non-Patent Document 1 is limited to obtaining change information on the server's AD and identifying the number of failures and details of the causes of failures, and has the problem that it cannot deal with operational errors in AD, such as an authorized administrator in one department accidentally changing or deleting the AD of another department.

[0015] Patent Document 1 discloses a technology that makes it easy and simple to manage accounts in an organization's network, reduces mistakes in change work, and outputs audit trails. According to the technology described in Patent Document 1, employee accounts are managed by customizing the OS functions of the account server, and the start and end periods when the account is valid are determined for each employee, and for example, at midnight every day, the account server queries each DB server that has established the employee's access authority to change the employee's account.

[0016] In response to an inquiry, if an employee's account is no longer valid, the DB server creates change data for that employee and sends it to the account management server. The account server then executes the account change process corresponding to all of the change data, communicates the change results to the DB server, and the DB server reflects the account information.

[0017] In other words, according to the technology described in Patent Document 1, the operational authority of staff members is managed by an account server and a DB server, so it is necessary to determine the start and end dates of the account's validity and to perform processing to determine whether the account is within the validity period, and there was a problem that input errors in the validity period, which differs for each staff member, could affect the operational authority.

[0018] Patent document 2 discloses an authority management system that has an authority information table that associates individual numbers with authority information corresponding to the individual numbers, and a personnel information table that associates individual numbers with organizational information, job position information, and job information, and that updates to the personnel information table also update the authority information table.

[0019] According to the technology described in Patent Document 2, the system department administrator sets the department and authority type, and the user department administrator sets the authority for each user department. The tasks shared by the system department administrator and the user department administrator are separated, allowing each to manage the authority of employees with simple operations.

[0020] However, the accounting system host, which stores organizational information, and the ETL server, which extracts, processes, and exports data, are said to reference individual personnel information tables to set authority information tables for stores and departments.Since the operation authority management of employees is based on both the accounting system host and the ETL server, and the authority information table and personnel information table are linked, there was an issue that a malfunction in either one could cause the entire authority management to become unusable.

[0021] Production facilities, especially pharmaceutical production facilities, require strict quality control and it is necessary to prevent operational errors. Therefore, there was a demand for an authority management app that can easily and appropriately manage authority in the data directory and create a change history as an audit trail so that even authority managers in the production facility department, who do not have the same level of specialized knowledge as IT engineers, do not make operational errors. [Prior art documents] [Patent documents]

[0022] Patent Document 1: Patent No. 2008-203909 Patent Document 2: Patent No. 2015-230492 [Non-patent literature]

[0023] Non-patent literature 1: Product information page of Ranex Co., Ltd. "Manage Active Directory change history. Understand the operation of privileged IDs", [Retrieved April 1, 2023], Website URL < https: / / wp.techtarget.itmedia.co.jp / contents / 27423 > Summary of the Invention [Problem to be solved by the invention]

[0024] The present invention aims to provide an authority management application and a data management system that can manage user authority for each device when a user is logged in to the device in a data directory and create an audit trail, so that even an authority manager in a production equipment department who does not have specialized knowledge about the server OS can avoid operational errors. [Means for solving the problem]

[0025] A first aspect of the present invention is an authority management application in which an administrative user manages the operation authority of a device, the application storing the operation authority in a server directory formed by a memory area of ​​a server communicating via LDAP, the application causes a processing means of the server to function as a user registration means, an operation authority generation means, an operation authority allocation means, and an operation authority update means, the memory area of ​​the server other than the server directory serves as a second memory means, the second memory means functions as a history information memory section, the user registration means stores the administrative user, an assigned user to whom the operation authority is assigned, and a user ID corresponding to each of them in the second memory means, The operation authority generating means associates a device ID with an authority ID to generate an operation authority ID for the device, and when the administrative user causes either the administrative user or the assigned user to be displayed on a display means connected to the server, the operation authority assigning means assigns the operation authority ID corresponding to either of the displayed users to a user ID corresponding to either of the displayed users to make it user authority management information, and the operation authority updating means updates the user authority management information to the server directory and adds the user authority management information to the history information storage unit to store the history.

[0026] A second aspect of the present invention is an authority management application in which an administrative user manages the operation authority of a device, the application storing the operation authority in a server directory formed by a storage area of ​​a server communicating via LDAP, the application causing a processing means of a PC operated by the administrative user to function as a user registration means, an operation authority generation means, an operation authority allocation means, and an operation authority update means, the storage means of the PC serves as a second storage means, the second storage means functions as a history information storage section, the user registration means stores the administrative user, an assigned user to whom the operation authority is assigned, and a user ID corresponding to each of them in the second storage means, The operation authority generating means associates a device ID with an authority ID to generate an operation authority ID for the device, and when the administrative user causes either the administrative user or the assigned user to be displayed on a display means connected to the PC, the operation authority assigning means assigns the operation authority ID corresponding to either of the displayed users to a user ID corresponding to either of the displayed users to create user authority management information, and the operation authority updating means updates the user authority management information to the server directory and adds the user authority management information to the history information storage unit to store the history.

[0027] In the first and second inventions, the device to which the authority management application is applied is preferably, but not limited to, a production facility, and may be a PC for office work. Although the server directory communicated by LDAP cannot store data in a table format and data registration is not easy, the data is stored in a hierarchical data structure, so data can be read quickly, and it is suitable for managing and using the operation authority of many users for many devices.

[0028] The authority management application may be executed on either a server or a client PC (hereinafter referred to as PC), and it goes without saying that processing and storage may be shared separately, with the memory area constituting the history information storage unit being the PC and processing execution being the server.

[0029] The administrative user who logs in to the authority management app may be an administrator of the authority management app, an authority manager of the production equipment department, etc., but is not limited to a user who logs in to the device to which the authority management app is applied. The administrative user who logs in may be registered including a login ID consisting of the user name, telephone number, email address, etc. of the administrative user and the assigned user, and a user ID for identifying the user such as a password, and the generated operation authority ID may be assigned to the registered user ID to update the operation authority. The operation authority ID is generated for each device by combining the device ID and the authority ID.

[0030] The operation authority of a device is generally defined as the management authority, the drive authority, the setting change authority, the viewing authority, etc., but depending on the device, the authority may be further divided into various types. For example, the operation authority of the device may be given its own specifications, such as a first administrator changing the settings of the device and a second administrator approving the setting change so that the setting change becomes effective.

[0031] Since the operation authority ID is generated according to the specifications of the unique operation authority for each device by combining the device ID and the authority ID, even if the authority is variously differentiated for each device, it is possible to grant authority that is diversely differentiated according to the device.

[0032] With either the administrative user or the assigned user displayed on the display screen constituting the display means, an operation authority ID is assigned to a user ID by the operation authority assignment means, so that the user ID and operation authority ID can be correctly and easily assigned according to a specific user name to produce correct user authority management information.

[0033] User authority management information consisting of a user ID and an operation authority ID is updated in the server directory by the operation authority update means, and the history is accumulated in the history information storage unit. Update means that the previous user right management information corresponding to the user and device is replaced with newly generated user authority management information. Since the storage area of ​​either the server or the PC other than the server directory is used as the history information storage unit, it is easy to store the user, device, operation authority, change time, etc. as tabular data.

[0034] Even if only the latest user authority management information is stored in the server directory, the user authority management information before replacement is also stored in the history information storage section, so that even if user authority management is performed in the server directory, an unprecedented advantageous effect is achieved that an audit trail of user and device user authority management information can be created from information in the history information storage section.

[0035] A third invention of the present invention is characterized in that, in the authority management application of the first or second invention, the second storage means functions as a list storage unit and the processing means functions as an operation authority selection means, the operation authority generation means stores a list of the operation authority IDs in the list storage unit, the operation authority selection means reads out the list stored in the list storage unit and displays it on the display means, and the administrative user can select the operation authority ID from the list.

[0036] According to the third invention, the list of operation authority IDs generated by the operation authority generating means is stored in the list storage section of the second storage means. The operation authority selecting means implemented by the processing means reads out the list of operation authority IDs from the list storage section, displays the list on the display means, and selects one of the operation authority IDs from the displayed list and assigns it to the user.

[0037] According to the third invention, the operation authority ID for each device is listed in advance, and the listed operation authority ID is also displayed on the screen displaying the user ID, thereby achieving the effect that the operation authority ID can be easily and correctly assigned to the user ID.

[0038] A fourth invention of the present invention is characterized in that, in the authority management application of the first or second invention, the processing means further functions as an extraction means and an automatic update means for the user authority management information, the extraction means extracts the latest user authority management information stored in the history information storage unit, and the automatic update means updates the latest user authority management information in the server directory at a predetermined interval.

[0039] According to the fourth aspect of the present invention, an extracting means implemented by a processing means extracts the latest user authority management information for all users and all devices from the user authority management information. An automatic updating means implemented by the processing means updates the latest user authority management information in a server directory at a predetermined interval, for example, at one-minute intervals. This provides an effect that even if the authority management is changed without the authority management application, the user authority management information is corrected to the latest by the authority management application.

[0040] A fifth aspect of the present invention is characterized in that, in the authority management application of the first or second aspect of the invention, when an execution action of the authority management application, registration of the administrative user or the assigned user, generation of the operation authority ID, or assignment of the operation authority ID is performed, the operation authority update means stores the performer and the time of execution of the execution action together as history information in the history information storage unit, thereby making it possible to create an audit trail of the execution of the authority management application.

[0041] According to the fifth aspect of the present invention, since the execution action related to the operation authority management, the executor, and the execution time are stored in the history information storage unit, it is possible to easily create an audit trail related to the authority management of the user and the device, and also to create an audit trail related to the execution action of the authority management. Here, execution includes not only a case where it is executed normally, but also a case where it is executed unsuccessfully.

[0042] A sixth aspect of the present invention is an authority management system in which an authority management application for managing an operation authority of a device by an administrative user is executed, the authority management system includes a server and a display means, the operation authority is stored in a server directory formed by a storage area of ​​the server communicating by LDAP, the processing means of the server functions as a user registration means, an operation authority generation means, an operation authority allocation means, and an operation authority update means, a storage area of ​​the server other than the server directory is a second storage means, the second storage means functions as a history information storage unit, and the user registration means registers the administrative user, an assigned user to whom the operation authority is assigned, and a user ID corresponding to each of them in the second storage means. the operation authority management information storing unit stores the operation authority ID and the operation authority management information in a storage unit, the operation authority generation unit associates the device ID with the authority ID to generate an operation authority ID for the device, the administrative user causes either the administrative user or the assigned user to be displayed on a display unit connected to the server, the operation authority assignment unit assigns the operation authority ID corresponding to either of the displayed users to a user ID corresponding to either of the displayed users to create user authority management information, and the operation authority update unit updates the user authority management information to the server directory and adds the user authority management information to the history information storage unit to store the history.

[0043] A seventh aspect of the present invention is an authority management system in which an authority management application for managing an operation authority of a device by an administrative user is executed, the authority management system includes a server, a PC operated by the administrative user, and a display means, the operation authority is stored in a server directory formed by a storage area of ​​the server communicating by LDAP, the processing means of the PC functions as a user registration means, an operation authority generation means, an operation authority allocation means, and an operation authority update means, the storage means of the PC is a second storage means, the second storage means functions as a history information storage unit, and the user registration means registers the administrative user, an assigned user to whom the operation authority is assigned, and a user ID corresponding to each of them to the second storage means. the operation authority management information storing unit stores the operation authority ID and the operation authority management information in a storage unit, the operation authority generation unit associates the device ID with the authority ID to generate an operation authority ID for the device, the administrative user causes either the administrative user or the assigned user to be displayed on a display unit connected to the server, the operation authority assignment unit assigns the operation authority ID corresponding to either of the displayed users to a user ID corresponding to either of the displayed users to create user authority management information, and the operation authority update unit updates the user authority management information to the server directory and adds the user authority management information to the history information storage unit to store the history.

[0044] An eighth invention of the present invention is characterized in that, in the authority management system of the sixth or seventh invention, the second storage means functions as a list storage unit and the processing means functions as an operation authority selection means, the operation authority generation means stores a list of the operation authority IDs in the list storage unit, the operation authority selection means reads out the list stored in the list storage unit and displays it on the display means, and the administrative user can select the operation authority ID from the list.

[0045] A ninth aspect of the present invention is characterized in that, in the authority management system of the sixth or seventh aspect of the invention, the processing means functions as an extraction means and an automatic update means for the user authority management information, the extraction means extracts the latest user authority management information stored in the history information storage unit, and the automatic update means updates the latest user authority management information in the server directory at a predetermined interval.

[0046] The tenth invention of the present invention is characterized in that, in the authority management system of the sixth or seventh invention, when any of the following execution actions is performed: execution of the authority management application, registration of the administrative user or the assigned user, generation of the operation authority ID, or assignment of the operation authority ID, the operation authority update means stores the performer and the execution time of the execution action together as history information in the history information storage unit, thereby making it possible to create an audit trail of the execution of the authority management application. Effect of the Invention

[0047] According to the first, second, sixth and seventh aspects of the present invention, the authorization which is diversified according to the device can be easily and correctly managed according to the specific user name, and even if the user authority is managed by the server directory, an audit trail of the user authority management information of the user and the device can be created by the information in the history information storage unit, which is an advantageous effect not seen in the past. According to the third and eighth aspects of the present invention, the operation authority IDs are listed on the screen displaying the user IDs, which has the effect of making it possible to easily and correctly assign operation authority IDs to user IDs. According to the fourth and ninth aspects of the present invention, even if the authority management has been changed without the authority management application, the authority management application can correct the user authority management information to the latest one. According to the fifth and tenth aspects of the present invention, not only is it easy to create an audit trail related to the authority management of users and devices, but it is also possible to create an audit trail related to the execution of authority management. [Brief description of the drawings]

[0048] [Figure 1] FIG. 1 is a schematic diagram of a privilege management system (first embodiment). [Diagram 2] FIG. 1 is a block diagram of a rights management system (first embodiment). [Diagram 3] 13 is a screen display when an operation authority ID is assigned to a user (first embodiment). [Figure 4] FIG. 11 is an explanatory diagram of a server directory update process and a history information storage process (first embodiment). [Diagram 5] FIG. 11 is a flow diagram showing a process of assigning an operation authority ID (first embodiment). [Figure 6] FIG. 11 is a flow diagram relating to an operation authority update process (first embodiment). [Figure 7] FIG. 11 is a flow diagram relating to a history information storage process (first embodiment). [Figure 8] FIG. 11 is an explanatory diagram of an operation authority ID (first embodiment). [Figure 9] FIG. 11 is a flow diagram showing a process for generating an operation authority ID (first embodiment). [Figure 10] 13 shows an example of a screen display when registering a user (Example 1). [Figure 11] FIG. 1 is a flow diagram relating to user registration (Example 1). [Figure 12] FIG. 11 is a flow diagram showing an automatic update process of user authority management information (first embodiment). [Figure 13] Example of an audit trail (Example 1). DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0049] In an authority management application or authority management system that manages the operating authority of devices such as PCs and production equipment using a server directory made up of a storage area of ​​a server that communicates with LDAP, the server directory is not directly updated by users, but rather the authority manager in the production department is made to manage the operating authority for each user using the authority management application.

[0050] Furthermore, in addition to updating the latest operation authority created by the authority management application in the server directory, the operation authority is updated in a storage area different from the server directory, and an update history is accumulated in the storage area each time an update is made, so that an audit trail can be created. This makes it possible to create an audit trail even if the operation authority is managed in a server directory that cannot store an update history of the operation authority. EXAMPLES

[0051] In the first embodiment, an authority management system 100 that executes an authority management application 1 to manage operation authority for each device will be described with reference to Fig. 1 to Fig. 13. Fig. 1 shows an overview of the authority management system, and Fig. 2 shows a block diagram of the authority management system. Fig. 3 shows an execution screen in which an operation authority ID is assigned to a user by the authority management application. Fig. 4 shows an explanatory diagram of the processing of the authority management application when an operation authority ID is assigned to a user, and the update of the server directory.

[0052] Fig. 5 shows a flow diagram of an operation authority allocation process. Fig. 6 shows a flow diagram of an operation authority update process. Fig. 7 shows a flow diagram of a history information storage process. Fig. 8 shows an explanatory diagram of an operation authority ID generated according to specifications unique to each device. Fig. 9 shows a flow diagram of an operation authority ID generation process.

[0053] Fig. 10 shows an example of a user registration execution screen. Fig. 11 shows a flow diagram relating to user registration processing. Fig. 12 shows a flow diagram relating to automatic update processing of user authority management information. Fig. 13 shows an example of an audit trail.

[0054] In the first embodiment, a case will be described in which an administrative user executes an authority management application installed in a PC 200, and causes the server 300 to acquire user authority management information updated by the authority management application via a communication means, and causes the information to be updated in a server directory. First, the overall configuration of the authority management system 100 will be described with reference to FIG.

[0055] The authority management system 100 includes a PC 200, a server 300, a display means 400 connected to the PC, and a communication means 500 for communicating between the PC and the server. When an administrative user executes an authority management application on the PC 200, the administrative user changes the operation authority for each user in accordance with the specifications of each of the devices A, B, C, ... while checking the users and operation authorities displayed on the display means 400.

[0056] The PC 200 may be a PC that runs on a general-purpose OS. The server 300 may be a server installed on-site, or may be a cloud server. The display means 400 may be a monitor connected to a PC. The communication means 500 may be a communication connection via an on-site LAN, or may be an Internet communication connection. The devices A, B, C, etc. may be any device that requires authority management, such as an office PC, production equipment, or an entrance / exit management device.

[0057] Each device subject to the management of operation authority is a device that manages the execution of production equipment, etc., and is connected to the server 300 via communication means 500. The user first inputs user information that identifies the user to each device, and the user ID is recognized. The user ID only needs to be effectively recognized by an IC card that stores the user ID or a biometric authentication device. The user ID is sent from the device to the server 300 via communication means 500, and an operation authority ID assigned to the user according to the user ID is sent from the server to the device, and the device is driven according to the operation authority ID.

[0058] Specifically, when a user ID is communicated to device A, an operation authority ID "A_Operator (see Figures 3 and 8)" which combines the device ID "A" and the authority ID "Operator" stored in the server directory is sent to device A, and device A is operated within the scope of the authority of the operation authority ID "A_Operator", assuming that the user has operation authority for the authority ID "Operator" for device A.

[0059] Now, detailed configurations of the authority management system 100 and the authority management application 1 will be described with reference to the block diagram shown in Fig. 2. The server 300 constituting the authority management system includes a processing means 310 and a storage means 320, and is driven by a general-purpose server OS. The processing means may be a central processing unit (hereinafter referred to as a CPU), and the storage means may be an HDD, SSD, RAM, or the like. Here, the server may be a virtual server constructed in the storage area of ​​a PC.

[0060] A part of the storage means of the server functions as a server directory 10 formed by the server storage area 321 that is communicated by LDAP. The server directory 10 may be, for example, Active Directory (registered trademark) implemented in a Windows (registered trademark) server OS, or the open source OpenLDAP, and the present invention can be introduced while utilizing an existing system that manages authority by these server directories.

[0061] The server directory 10 stores the user and user ID, the operation authority ID that associates the device ID and the authority ID, and the latest user authority management information, which constitute the operation authority 11 (see FIG. 2). The user may be the user's name, for example, "A", "B", etc., and the user ID may be "U001", "U002", etc., which are numbered in the server directory so as not to overlap (see FIG. 3 and FIG. 10).

[0062] Since the user and the user ID are stored together, the administrative user can assign the operation authority ID based on the user ID using the user name as a clue, making it difficult for human error to occur in the authority assignment. The user ID may also be stored together with the organization ID, department ID, job title ID, device login ID, password, telephone number, email address, etc.

[0063] An equipment ID is information that can uniquely identify an equipment. For example, for a manufacturing machine, it may be a combination of the equipment's location information, name, etc., such as "first manufacturing line_packaging machine 1." For ease of understanding, in this embodiment, the equipment ID of equipment A is indicated by "A" and the equipment ID of equipment B is indicated by "B" (see FIG. 8).

[0064] The authority ID refers to the scope of authority set according to the specifications of each device, and is not limited to, for example, user registration authority, setting change authority, audit trail viewing authority, facility use authority, etc. The operation authority ID is associated with one device ID so that operation authority IDs are not duplicated (see Figure 3).

[0065] User authority management information refers to information that assigns an operation authority ID according to a user based on the user ID (see Figures 2 and 8). The "latest" refers to the state in which newly registered or pre-update user authority management information has been overwritten and saved with the updated user authority management information, and the state before the update has been deleted.

[0066] The storage means 320 of the server may allow a storage area other than the server directory (hereinafter referred to as other storage area 322) to function as the history information storage unit 20 by an authority management application described later (see FIG. 2). Furthermore, the other storage area 322 also stores an access control application (hereinafter referred to as other application 323) that manages devices that can access the server, and a production record 324 of each device.

[0067] The PC 200 is composed of a processing means 210 and a storage means 220, and is driven by a general-purpose OS (see FIG. 2). The processing means may be a CPU, and the storage means may be a HDD, SSD, RAM, or the like. Furthermore, a monitor constituting a display means 400, and a keyboard, mouse, and the like constituting an input means 410 are connected to the PC. The authority management application 1 is installed in the storage means 220, and is executed by the user operating the PC.

[0068] The authority management application 1 causes the processing means 210 (see FIG. 1) of the PC to function as user registration means 211 (see FIG. 10), operation authority generation means 212 (see FIG. 8), operation authority assignment means 213 (see FIG. 3), and operation authority update means 214 (see FIG. 4). In addition, the authority management application causes the processing means 210 to function as operation authority selection means 215 (see FIG. 3), extraction means 216 (see FIG. 12), automatic update means 217, and audit trail creation means 218 (see FIG. 12).

[0069] The authority management application 1 also stores in the storage means 220 of the PC operation authority 221, which is the same as the operation authority 11 stored in the server directory 10, specifically, the user and the user ID, the operation authority ID, and the latest user authority management information. Furthermore, the authority management application 1 also stores a history 222 of the user's authority management information (see FIG. 2) and history information 223 that integrates the performed action, the executor, and the performed time related to the authority management application 1.

[0070] Furthermore, the authority management application 1 causes another storage area 322 of the server to function as a history information storage unit 20. The history information storage unit 20 stores a history 21 of all user authority management information, and also stores history information 22 that integrates the performed action, the executor, and the time of execution related to the authority management application 1. Note that, it goes without saying that the storage means 220 of the PC may function as the history information storage unit instead of the other storage area 322 of the server.

[0071] Here, the execution action refers to the launching of the authority management application 1, the registration, update, and deletion of a user by the user registration means 211, the generation of an operation authority ID by the operation authority generation means 212, the assignment of operation authority by the operation authority assignment means 213, etc. The launching of the authority management application 1 refers to, for example, the launching of an application, login authentication, etc.

[0072] The executor refers to an administrative user who starts and executes a PC, such as an administrator of the authority management application, an authority administrator of the production equipment department, etc. The executor may be identified by login authentication when starting the authority management application 1, or by login authentication when starting the PC, and is not limited to this. Since the mode of login authentication is not limited, the configuration related to these login authentications is omitted in FIG. 2.

[0073] It is preferable to previously cause the processing means 210 to function as the operation authority selection means 215, and to store a list 225 of operation authority IDs generated by the operation authority generation means 212 in the list storage unit 224 (see FIG. 2). This list 225 of operation authority IDs is displayed on the display means in a selectable manner when an operation authority ID is assigned to a user (see FIG. 3).

[0074] Now, the operation authority allocation means 213, the operation authority update means 214, and the operation authority selection means 215, which are characteristic components of the present invention, will be described in detail with reference to Fig. 3 to Fig. 7. An example will be described in which "A / U001" starts and executes an authority management application as an administrative user, and assigns authority to an assigned user "B / U002".

[0075] In the screen display for allocating operation authority IDs to users (see FIG. 3), from the left, a user list 230, user information 231 such as user name and user ID, list of operation authority IDs 225, and user authority management information 232 are displayed. Also, a top bar 233 displays management user "A" and his ID "U001". User information 231 displays registration information such as user name "B", user ID "U002", device login ID "abcd", password "1234", etc., related to the assigned user "B" selected from the user list 230.

[0076] A list 225 (see FIG. 3) of operation authority IDs selectably displayed by the operation authority selection means 215 functioning in the processing means 210 displays the operation authority IDs 225 (see FIG. 2) stored in the list storage unit 224 in order of authority level for each device. The user authority management information 232 (see FIG. 3) displays the operation authority IDs assigned to users according to the devices from the list of operation authority IDs.

[0077] Here, the operation authority allocation means 213 and the operation authority update means 214, which are characteristic processes performed by the authority management application 1, will be described with reference to Figs. 3 and 4. The operation authority allocation means 213 allows the management user "A / U001" to allocate the operation authority of "A_Operator" to the allocated user "B / U002", for example. Specifically, in the operation authority allocation process (see the shaded frame in Fig. 4 and the flow in Fig. 5), one of the operation authority IDs 225 is selected and associated with the user ID 231 shown in the user information (see Fig. 3), and the user authority management information 232 is created (see Fig. 4(1)). Then, the user authority management information 232, the executor who performed the process, and the execution time are stored in the server directory 10 (see Fig. 4(2)) and the history information storage unit 20 (see Fig. 4(4)) via the communication means 500 (see Fig. 13).

[0078] When the operation authority ID of the assigned user "B / U002" is changed from "A_Operator" to "A_Maintenance", the operation authority update means 214 executes the operation authority allocation process (see FIG. 4(3)), and then replaces the previous user authority management information with the updated user authority management information in the server directory 10 (see FIG. 4(2)) via the communication means 500. Then, in the history information storage unit 20 (see FIG. 4(4)), in addition to the previous information, new user authority management information is added, and history information showing the change history is stored.

[0079] Furthermore, the operation authority update means 214 causes the server directory 10 to acquire the latest stored user authority management information 232 (see FIG. 3) and history information via the communication means 500 at a desired timing. The desired timing may be, for example, a timing that coincides with an action to be performed, such as updating the operation authority, or may be at a preset interval, for example, every minute, and is not limited to this.

[0080] The processing of the authority management application 1 will be described in detail below with reference to Fig. 3 and the flow charts shown in Fig. 5 to Fig. 7. The operation authority assignment processing in step 100 is executed by the operation authority assignment means 213 which constitutes a processing means. First, in step 110, the screen display shown in Fig. 3 is displayed on the display means 400. On the screen display, it is possible to select a user to which the operation authority is to be assigned from the pre-registered user list 230 (see Fig. 3), for example, "A", "B", etc. (S110).

[0081] Next, for example, the assigned user "B" is selected and the user information "B / U002, abcd..." is displayed, and then in step 120, a list 225 of operation authority IDs stored in the list storage unit (see Figs. 2 and 3) is read out and displayed selectably on the display means (S120). The list 225 of operation authority IDs is a list of operation authorities applicable to the selected assigned user "B / U002". The process proceeds to step 130, where the currently assigned user authority management information is displayed for the assigned user "B / U002" (S130), and the process proceeds to step 140.

[0082] In step 140, if the assigned user "B / U002" is a new user, the operation authority assignment means 213 leaves the user authority management information blank, but if user authority management information has already been assigned, the operation authority assignment means 213 reads the assigned user authority management information, such as "A_Operator", from the PC's storage means 220 and displays it in the user authority management information 232 (see Figure 3).

[0083] The administrative user selects an operation authority ID to be assigned to the user ID "U002" with the user information column 231 for the assigned user "B", the list of operation authority IDs 225, and the user authority management information 232 displayed side by side on the display means (see FIG. 3). For example, when assigning an operation authority ID linked to "A_Maintenance" to the assigned user "B", the administrative user selects "A_Maintenance" from the list of operation authority IDs 225, selects the authority assignment button 234, and moves it to the user authority management information 232 (see FIG. 3).

[0084] Furthermore, in order to prevent multiple registrations of authority related to device A for user ID "B / U002," the administrative user selects "A_Operator," which was displayed before the update, in user authority management information 232, selects authority deletion button 235, deletes the unnecessary operating authority, and selects decision button 236 (see FIG. 3), to terminate step 140. It goes without saying that user authority management information may be stored for each different device, for example, "A" and "B."

[0085] In step 140, with the user and user ID displayed, an operation authority ID that combines a device and operation authority can be assigned, and updated or deleted as necessary, so that even an administrative user who does not have specialized knowledge of the server OS can easily assign operation authority that combines a user, device, and authority without making a mistake.

[0086] Following the processing by the operation authority allocation means, in step 200, the operation authority update means 214 executes an update process of the operation authority (S200). In step 210, the latest user authority management information is communicated to the server (S210), and the process proceeds to step 220. In step 220, the latest user authority management information is overwritten and saved onto the user authority management information before the update that was stored in the server directory 10, and the server directory is updated (S220).

[0087] If the server directory 10 is, for example, Active Directory (registered trademark), a function (Power Shell (registered trademark)) that can automate specified tasks can be used to replace authority groups (corresponding to operation authority IDs) that are hierarchically structured based on user IDs with new authority groups.

[0088] More specifically, when the server acquires user authority management information from the operation authority update means, the task automation function can automate tasks such as reading user information and authority group corresponding to the user ID and updating the authority group. This allows the allocation of operation authority by the authority management application to be applied to the server directory, and the assigned operation authority can be easily applied to the device.

[0089] Furthermore, in step 300, the operation authority update means 214 executes a history information storage process (S300). In step 310, when any of the following actions is performed, namely, execution of an authority management application, registration of a user, generation of an operation authority ID, and assignment of an operation authority ID, history information is created that integrates the performed action, the executor, and the time of execution (S310).

[0090] For example, when the user authority management information is updated, history information is created indicating who performed what action, and when, and to which user, and which operation authority ID was assigned to which action. Then, the process proceeds to step 320, where the created history information is added to the history information storage unit 20, and the history information is accumulated and stored.

[0091] As described above, the administrative user "A" executes the authority management application to update the user authority management information. Although the server directory 10 cannot store update history, the authority management application 1 stores history related to changes to the user authority management information in a history information storage unit (20, 222, 223) other than the server directory, so that not only the change history of the operation authority ID but also an audit trail of the execution action related to the change can be created.

[0092] Furthermore, the history of correct and latest user authority management information is stored in the history information storage unit 20. Even if a malicious user directly modifies or deletes the server directory 10, or if an administrative user who has access to the AD mistakenly directly modifies or deletes the user authority management information, the server directory 20 can be quickly restored to its original normal state from the history information in the history information storage unit.

[0093] Since there is no need to directly access the server OS, which requires specialized knowledge, even an administrative user in the production equipment department will not mistakenly operate an access control app or the like stored in another memory area 322 (see Figure 2) of the server when updating operating authority, and system errors due to human operating errors will not occur.

[0094] Next, specific examples of operation authority IDs generated by the operation authority generating means 212 will be described in detail with reference to Fig. 8 and Fig. 9. Fig. 8 shows a list of operation authority IDs generated by the operation authority generating means 212. Here, the operation authority of device A is shown in list 240, and the operation authority of device B is shown in list 241. In the list of Fig. 8, the authority IDs linked to the device IDs are shown by filling in the squares in the table. Fig. 9 shows a processing flow diagram.

[0095] The device ID and authority ID are created in advance by an administrative user executing an authority management application, and are stored in the storage means of the PC. The device ID may be "A", "B", etc. The authority ID may be authority level information such as "Administrator (administrative user)", "SystemAdmini (system administrator)", "Maintenance (production manager)", "Operator (general)", etc. The operation authority ID may be generated by combining these, such as "A_Administrator".

[0096] Authorization IDs are created according to the unique specifications of each piece of equipment. Specifically, for equipment "A," only common authorization IDs are created, such as "user registration authority," "audit trail viewing authority," "settings change authority," and "equipment use authority." For equipment "B," in addition to the common authorization IDs, authorization IDs specific to the production equipment are also created, such as "production type registration," which registers new product varieties, and "production type switching," which switches between registered varieties.

[0097] The generation of the operation authority ID by the operation authority generating means 212 may be performed by associating a device ID and an authority ID created in advance, and the mode is not limited. Here, an example will be described in which a list of device IDs and authority IDs is displayed in a tabular form on the display means in a selectable manner, so that the operation authority ID can be easily assigned.

[0098] In step 400, the authority management application 1 is started to execute the operation authority generation means 212 (S400). In step 410, the lists 240, 241 (see FIG. 8) for setting the operation authority ID for each device are displayed on the display means (S410). At this stage, all the squares in the list are unselected.

[0099] In step 420, when the administrative user binds, for example, the device ID "A" with an authority ID for the administrative user, he selects all the boxes of the authority ID shown in the row of "A_Administrator" in the list. The operation authority generating means 212 generates the operation authority ID "A_Administrator" that grants all operation authorities to the device ID "A" (S420).

[0100] More specifically, for the operation authority IDs related to the administrative user, in row 242 of "A_Administrator" related to the device ID "A", all the boxes of the authority IDs are selected, the device ID and the authority ID are combined, and all authorities are granted. For the operation authority IDs related to the system administrator, in row 243 of "A_SystemAdmini", only the boxes of the authority IDs related to "user registration" and "audit trail viewing" are selected and combined, and only the authority related to system management is granted without allowing the operation of production equipment.

[0101] For the operation authority ID for the production manager, only the squares of the authority IDs related to operating the production equipment, such as "setting changes" and "equipment use authority," are selected and linked for row 244 of "A_Maintenance," and only the authority related to operating the production equipment is granted. For the operation authority ID for a user who is only authorized to use equipment, only the squares of "equipment use authority" are selected and linked for row 245 of "A_Operator."

[0102] After generating the operation authority ID for device ID "A", in step 430, a list (see FIG. 3) is created in which the generated operation authority IDs are arranged in descending order of authority level for each device, and the list is stored in a list memory section formed by the memory means of the PC (S430).

[0103] Here, user registration and automatic update of user authority management information will be explained in more detail. First, regarding user registration, Fig. 10 shows a user registration screen, and Fig. 11 shows a flow diagram. On the screen display of the display means 400, a user list 250, a new registration button 251, a user information registration field 252, and a decision button 254 are displayed. In the user registration process (S500), in step 510, information of a new user is registered (S510). On the user registration screen, the new registration button 251 is selected, and the user registration process is started by the user registration means 211, which is a processing means.

[0104] When an administrative user "A" inputs, for example, "B" in the user name input field 253, in step 520, the user registration means issues, for example, "U002" as a user ID (step 520). At this time, a device login ID "abcd" and a password "1234" corresponding to each individual device may also be issued (see FIG. 10). In step 530, the decision button 254 is selected (see FIG. 10), and the user and the user ID are stored in the storage means 220.

[0105] Next, the automatic update of the user authority management information will be described with reference to the flow diagram of Fig. 12. In step 600, the authority management application 1 is started, and the extraction means 216 and the automatic update means 217 execute the automatic update process of the user authority information (S600). In step 610, the extraction means 216 implemented by the processing means of the server or PC extracts the latest user authority management information (21, 222) for all users from the history information storage unit (22, 223) implemented by the storage means at predetermined intervals (S610), and proceeds to step 620.

[0106] In step 620, the automatic update means 217 implemented by the processing means communicates the latest user authority management information to the server (S620), and the process proceeds to step 630, where the latest user authority management information is overwritten and saved in the server directory 10, and updated (S630). Even if the user authority management information has been illegally changed without the authority management application, it is corrected to the latest user authority management information by the authority management application.

[0107] Next, a specific example of the audit trail 330 will be described with reference to Fig. 13. In Fig. 13, the user authority management information before the information was updated is marked with "original" to distinguish it from the latest user authority management information. It is preferable that the processing means of the server or PC functions as the audit trail creation means 218, and that the audit trail 330 is output in a read-only data format that cannot be tampered with.

[0108] History information relating to the executed actions stored in the history information storage unit 20 (see FIG. 2) and server directory update information are output in chronological order to the audit trail 330. In the case of history information, the execution time, the perpetrator, and the executed action are output on one line.

[0109] The execution actions of the history information, i.e., server directory update information, are shown in contrast to "Summary" and "Details" for easy understanding. The execution times are shown in chronological order from a1 to b5. In addition, if an unauthorized user attempts unauthorized processing, or if the authority management app does not execute normally, these are also output as "execution errors" in addition to the history information (see the line with execution time b1).

[0110] An example of an administrative user assigning operation authority to an assigned user is shown in line a5, for example. Line a5 shows a case where, at time a5, administrative user "A / U001" assigned operation authority ID "A_Operator" for device "A" to new user ID "U002" and updated the server directory 10. "Summary" indicates "operation authority assignment," and "Details" indicates that operation authority assignment of "A_Operator" for device "A" has been executed to "U002" (see line a5 for execution time).

[0111] In addition, for the automatic update of the server directory 10 accompanying the user assignment at a5 o'clock, the record related to the operation authority update means 214 indicates the execution time "a6 o'clock", executor "--", summary "Server directory update", details "Original "U002=Not set" Latest "U002=A_Operator"" (see the row for execution time a6).

[0112] In addition, at time b1, if a non-administrator user "B" attempts to execute the authority management app and fails, this will be recorded as an unauthorized login attempt with an overview of "Execution error" and details of "Failure to execute authority management app."

[0113] (others) In the present embodiment, an example in which the authority management application is installed in a PC has been described, but the authority management application may be installed in a server and the server may be accessed from a PC to execute the authority management application. Also, an example in which the server is provided with a history information storage unit has been described, but it goes without saying that the server may be provided with the history information storage unit instead of the PC. In this embodiment, for ease of understanding, authority management for production equipment has been described, but the present invention may also be applied to authority management for applications executed on general office PCs and authority management related to the use of network resources. The embodiments disclosed herein are illustrative in all respects and should not be considered restrictive. The technical scope of the present invention is not limited to the above description but is indicated by the claims, and is intended to include all modifications within the meaning and scope of the claims. [Explanation of symbols]

[0114] 1...Permission management app, 100...Permission management system, 200...PC, 300...server, 400...display means, 500...communication means, 10...server directory, 20...history information storage unit, 11...operation authority, 21...user authority management information history, 22...history information, 210: processing means, 211: user registration means, 212: operation authority generation means, 213: operation authority allocation means, 214: operation authority update means, 215: operation authority selection means, 216...extraction means, 217...automatic update means, 218...audit trail creation means, 220: storage means; 221: operation authority; 222: history of user authority management information; 223 ... history information, 224 ... list storage unit, 225 ... list of operation authority IDs, 230...user list, 231...user information column, 232...List of user authority management information, 233...Top bar, 234: authority assignment button; 235: authority deletion button; 236: decision button; 240,241…List, 242…"A_Administrator" line, 243…"A_SystemAdmini" line, 244…"A_Maintenance" line, 245…"A_Operator" line, 250...User list, 251...New registration button, 253...user name input field, 254...decision button, 310... processing means, 320: storage means, 321: storage area, 322: other storage area, 323...Other apps, 324...Production records, 330...Audit trail, 410...Input means

Claims

1. In an authority management application for managing an operation authority of a device, An authority management application for storing the operation authority in a server directory formed by a storage area of ​​a server that is communicated via LDAP, a processing means of the server or the PC is made to function as a user registration means, an operation authority generation means, an operation authority allocation means, and an operation authority update means, and a storage area of ​​the server or the PC other than the server directory is made to function as a history information storage unit; The user registration means registers a user together with a user ID, the operation authority generating means generates an operation authority ID for the device by relating the device ID and the authority ID; In a state where a user who manages operation authority is displayed on a display means connected to either the server or the PC, the operation authority allocation means allocates the operation authority ID corresponding to the user to the user ID to set it as user authority management information; the operation authority update means updates the user authority management information in the server directory, and adds the user authority management information to the history information storage unit to store the history; 2. A rights management application comprising:

2. Further, a storage area of ​​either the server or the PC other than the server directory is made to function as a list storage unit, and the processing means is made to function as the operation authority selection means, the operation authority generating means causes the list storage unit to store a list of operation authority IDs generated by the operation authority generating means; the operation authority selection means reads out the list stored in the list storage unit, and causes the display means to display the operation authority ID in a selectable manner from the list displayed thereon; 2. The rights management application of claim 1.

3. Furthermore, the processing means functions as an extracting means and an automatic updating means for the user authority management information, The extracting means extracts the latest user authority management information stored in the history information storage unit, the automatic update means updates the latest user authority management information in the server directory at a predetermined interval; 3. The rights management application according to claim 1 or 2.

4. The operation authority update means When any of the following actions is performed, namely, execution of an authority management application, registration of a user, generation of an operation authority ID, and assignment of an operation authority ID, the action is stored as history information in the history information storage unit together with the person who performed the action and the time of the action, thereby making it possible to create an audit trail of the execution of the authority management application.

3. The rights management application according to claim 1 or 2.

5. In an authority management system in which an authority management application for managing operation authority of a device is executed, The authority management system includes a server, a PC, and a display means; The operation authority is stored in a server directory which is a storage area of ​​a server that is connected via LDAP. A processing means of either the server or the PC functions as a user registration means, an operation authority generation means, an operation authority assignment means, and an operation authority update means, and a storage area of ​​either the server or the PC other than the server directory functions as a history information storage unit, The user registration means registers a user together with a user ID, the operation authority generating means generates an operation authority ID for the device by relating the device ID and the authority ID; In a state where a user who manages operation authority is displayed on a display means connected to either the server or the PC, the operation authority allocation means allocates the operation authority ID corresponding to the user to the user ID to set it as user authority management information; the operation authority update means updates the user authority management information in the server directory, and adds the user authority management information to the history information storage unit to store the history; 2. An authority management system comprising:

6. Further, a storage area of ​​either the server or the PC other than the server directory functions as a list storage unit, and the processing means functions as the operation authority selection means, the operation authority generating means causes the list storage unit to store a list of operation authority IDs generated by the operation authority generating means; the operation authority selection means reads out the list stored in the list storage unit, and causes the display means to display the operation authority ID in a selectable manner from the list displayed thereon; 6. The rights management system according to claim 5,

7. Furthermore, the processing means functions as an extracting means and an automatic updating means for the user authority management information, The extracting means extracts the latest user authority management information stored in the history information storage unit, the automatic update means updates the latest user authority management information in the server directory at a predetermined interval; 7. The authority management system according to claim 5 or 6.

8. The operation authority update means When any of the following actions is performed, namely, execution of an authority management application, registration of a user, generation of an operation authority ID, and assignment of an operation authority ID, the action is stored as history information in the history information storage unit together with the person who performed the action and the time of the action, thereby making it possible to create an audit trail of the execution of the authority management application.

7. The authority management system according to claim 5 or 6.

Images