Entrance-exit authority management system, information processing device, entrance-exit authority management method, and computer-readable storage medium

Abstract

To provide an advantageous technology for maintaining and managing assignment of entrance-exit authority for enabling a user to enter / leave a partitioned management area in a facility in an appropriate state.SOLUTION: An entrance-exit authority management system comprises: an authority assignment unit which gives entrance-exit authority; an information storage unit which stores first information which information of an organization which a user belongs to is associated with for each identification information of the user, and second information which the information on a management area is associated with for each information of the organization; a first acquisition unit which acquires a correspondence relation between the user and the management area, on the basis of the first information and the second information; an authority deriving unit which derives the entrance-exit authority which should be assigned for each management area and for each user, on the basis of the correspondence relation acquired by the first acquisition unit; and a notification unit which notifies a manager, if the entrance-exit authority derived by the authority deriving unit does not match the entrance-exit authority assigned by the authority assignment unit.SELECTED DRAWING: Figure 3

Description

[Technical field]

[0001] The present disclosure relates to a technology for an entry / exit authority management system that manages the entry / exit authority of users to a partitioned managed area within a facility. [Background technology]

[0002] Patent Document 1 discloses a technology related to a passage authority granting system capable of setting passage authority. The system of this technology generates an authority granting information management table in which the correspondence between area IDs and personal IDs is described, based on a preset organization information management table, layout information management table, and personal information table. [Prior art documents] [Patent documents]

[0003] [Patent Document 1] JP 2011-70373 A Summary of the Invention [Problem to be solved by the invention]

[0004] When presetting the layout information management table in the system of Patent Document 1, as the scale of the facility increases and the number of areas to be set increases, the amount of work required for setting increases. In addition, the authority to enter and exit the divided management areas in the facility may not be uniformly granted to all users depending on the organization to which they belong or the layout. For example, a user who performs a specific task for a certain period of time is required to be temporarily granted the authority to enter and exit the management area for that task. In such a case, if the administrator of the authority to enter and exit the room manually sets the authority to enter and exit the room, it may be difficult to maintain the authority to enter and exit the room in an appropriate state.

[0005] The present disclosure has been made to solve the problems described above, and aims to provide an advantageous technology for efficiently granting entry / exit authority to users to enter and exit partitioned managed areas within a facility, and for maintaining and managing the granting of entry / exit authority to users to enter and exit managed areas in an appropriate state. [Means for solving the problem]

[0006] The entry / exit authority management system disclosed herein is an entry / exit authority management system that manages entry / exit authority granted to each user for each partitioned management area within a facility, and includes an authority granting unit that grants entry / exit authority, an information storage unit that stores first information in which information of the organization to which the user belongs is associated with each user's identification information, and second information in which management area information is associated with each organization's information, a first acquisition unit that acquires a correspondence between users and management areas based on the first information and the second information, an authority derivation unit that derives entry / exit authority to be granted for each management area and for each user based on the correspondence acquired by the first acquisition unit, and a notification unit that notifies an administrator if the entry / exit authority derived by the authority derivation unit does not match the entry / exit authority granted by the authority granting unit.

[0007] In addition, the information processing device of the present disclosure includes an authority granting unit that grants entry and exit authority to each user for each partitioned management area within a facility, a first acquisition unit that acquires a correspondence between users and management areas based on first information in which information of the organization to which the user belongs is associated with each user's identification information and second information in which management area information is associated with each organization's information, an authority derivation unit that derives entry and exit authority to be granted for each management area and for each user based on the correspondence acquired by the first acquisition unit, and a notification unit that notifies an administrator if the entry and exit authority derived by the authority derivation unit does not match the entry and exit authority granted by the authority granting unit.

[0008] In addition, the entry / exit authority management method disclosed herein is an entry / exit authority management method that causes a computer to manage the entry / exit authority granted to each user for each partitioned management area within a facility, and includes an authority granting step of granting entry / exit authority, a first acquisition step of acquiring a correspondence between users and management areas based on first information in which information of the organization to which the user belongs is associated with each user's identification information, and second information in which management area information is associated with each organization's information, an authority derivation step of deriving entry / exit authority to be granted for each management area and for each user based on the correspondence acquired in the first acquisition step, and a notification step of notifying an administrator if the entry / exit authority derived in the authority derivation step does not match the entry / exit authority granted in the authority granting step.

[0009] Furthermore, the computer-readable recording medium of the present disclosure is a computer-readable recording medium having recorded thereon a program that causes a computer to execute management of the entry / exit authority granted to each user for each partitioned management area within a facility, the program being configured to obtain first information in which information of the organization to which the user belongs is associated with each user's identification information, and second information in which management area information is associated with each organization's information, obtain a correspondence between the user and the management area based on the first information and the second information, derive the entry / exit authority to be granted for each management area and for each user based on the correspondence between the user and the management area, and notify an administrator if the derived entry / exit authority does not match the granted entry / exit authority. Effect of the Invention

[0010] According to the technology disclosed herein, it is possible to efficiently grant entry / exit authority to users to enter and exit a partitioned managed area within a facility, and to maintain and manage the granting of entry / exit authority to users to enter and exit the managed area in an appropriate state. [Brief description of the drawings]

[0011] [Figure 1] 1 is a diagram showing a configuration example of an entry / exit authority management system and related facilities in the first embodiment. FIG. [Diagram 2] 1 is a diagram showing a specific example of a facility to which the entry / exit authority management system in the first embodiment is applied. [Diagram 3] 1 is a diagram illustrating an example of the configuration of an entry / exit authority management system according to a first embodiment. [Figure 4] FIG. 13 is a diagram illustrating an example of a personnel information management table. [Diagram 5] FIG. 11 is a diagram illustrating an example of a space usage status management table. [Figure 6] FIG. 13 is a diagram showing an example of a space / facility information management table. [Figure 7] 1 is a diagram showing an example of a graph structure of information managed in a space / facility management device. FIG. [Figure 8] 2 is an example of route data stored in the route data storage unit 402. [Figure 9] 11 is a flowchart showing a routine in which the entrance / exit control device executes an entrance / exit authority derivation process to reevaluate the entrance / exit authority. [Figure 10] FIG. 13 illustrates an example of an authentication information management table. [Figure 11] FIG. 11 is a diagram illustrating an example of an entry / exit authority information management table. [Figure 12] 10 is a flowchart showing a routine for executing a determination process and a notification process by the entry and exit control device. [Figure 13] FIG. 2 is a diagram illustrating an example of hardware resources of the entrance and exit management device. [Figure 14] FIG. 13 is a diagram illustrating another example of hardware resources of the entrance and exit management device. [Figure 15] FIG. 11 is a block diagram showing functions of an entry / exit authority management system according to the second embodiment. [Figure 16] 10 is a flowchart showing a routine for executing history information update processing by the entrance and exit management device. [Figure 17] 10 is a flowchart showing a routine for executing performance evaluation processing by the entrance and exit control device. [Figure 18] FIG. 11 is a diagram showing a configuration example of an entry / exit authority management system and related facilities in a third embodiment. [Figure 19] FIG. 11 is a diagram showing a specific example of a facility to which the entry / exit authority management system in the third embodiment is applied. [Figure 20] FIG. 13 is a diagram showing an example of a space / facility information management table of the space / facility management device in the embodiment 3. [Figure 21] FIG. 11 is a diagram showing an example of a graph structure of information managed in the space and equipment management device of the embodiment 3. [Figure 22] 13 is an example of route data stored in a route data storage unit according to the third embodiment. [Diagram 23] 13 is a flowchart showing a routine for executing a determination process and a notification process by the entry and exit control device of the embodiment 3. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0012] Hereinafter, an embodiment will be described with reference to the drawings. In addition, elements common to the various drawings are given the same reference numerals, and duplicated explanations will be omitted.

[0013] 1. Embodiment 1 1-1. Overview of the Entry / Exit Authority Management System in the First Embodiment FIG. 1 is a diagram showing an example of the configuration of the entry / exit authority management system and its related equipment in the first embodiment. The entry / exit authority management system 10 is a system that manages the entry / exit authority of each user for each management area partitioned within a facility such as a building. The entry / exit authority management system 10 is configured to be able to communicate with related equipment, that is, one or more authentication devices 500, one or more communication terminals 700, and one or more operation terminals 800, via a network 8 such as the Internet. Entry and exit to the management area is restricted by, for example, a door 600. The door 600 is controlled to be unlocked and locked in response to a command from the authentication device 500.

[0014] The authentication device 500 is a device that authenticates a user who enters and leaves a management area through a door 600. The authentication device 500 is installed, for example, near the door 600 of each management area, and executes an authentication process that reads unique information of the user. The authentication process can be performed by a known authentication process, such as object authentication using an ID card or a two-dimensional code, or biometric authentication such as face authentication or fingerprint authentication. The authentication device 500 receives authentication information for identifying a user who has the authority to enter and leave from the entry and exit authority management system 10, and uses the received authentication information to confirm whether or not the user corresponding to the user's identification information has the authority to enter and leave. If the user has the authority to enter and leave, the authentication device 500 sends a command to the door 600 to unlock the corresponding door 600. Then, when the authentication device 500 detects that the user has entered and left the room, when a predetermined time has passed, when the opened door is closed, etc., the authentication device 500 sends a command to lock the corresponding door 600.

[0015] The communication terminal 700 is a terminal device owned by an entry / exit authority manager. The communication terminal 700 receives and outputs a notification sent from the entry / exit authority management system 10. Examples of the communication terminal 700 include a PC (personal computer), a smartphone, a tablet, and the like. Examples of the notification form include email, SNS (social networking service), display on a screen, audio output, and the like.

[0016] The operation terminal 800 is a terminal device used when an entry / exit authority administrator inputs information to the entry / exit authority management system 10. Examples of the operation terminal 800 include a PC (personal computer), a smartphone, a tablet, and the like. The operation terminal 800 may be configured as a terminal common to the communication terminal 700.

[0017] FIG. 2 is a diagram showing a specific example of a facility to which the entry / exit authority management system in the first embodiment is applied. In the example shown in FIG. 2, a space AR100 indicates a space outside an entrance / exit of the facility. Spaces AR101, AR102, AR110, and AR703 indicate common spaces or moving spaces within the facility. AR103 and AR702 indicate spaces used by the department. AR712 indicates a space for a specific purpose such as a library in the department. DR100, DR101, DR102, DR103, DR702, DR703, and DR712 indicate doors 600 for entering and exiting the space. CR1011, CR1012, CR1031, CR1032, CR7021, CR7022, and CR7021 indicate authentication devices 500 provided corresponding to the doors 600.

[0018] For example, a user belonging to Section I moves between the entrance of the facility and the space AR702 used by Section I along the route indicated by the dashed line in the figure. For this reason, the entry / exit authority manager grants entry / exit authority to the user of Section I to authentication devices CR1011, CR1012, CR7021, and CR7022 corresponding to doors DR101 and DR702 that are present along the route.

[0019] Here, for example, if a change occurs in the user belonging to Section I due to an organizational transfer or the like, the set entry and exit authority may become inappropriate. The entry and exit authority management system 10 of this embodiment is characterized by an operation of determining whether the set entry and exit authority is appropriate or not, and notifying the entry and exit authority manager. The configuration of the entry and exit authority management system will be described below using an example of managing the entry and exit authority of users in the facility illustrated in FIG. 2.

[0020] 1-2. Example of the configuration of the entrance and exit authority management system FIG. 3 is a diagram showing an example of the configuration of the entry / exit authority management system in the first embodiment. Hereinafter, the internal configuration and functions of the entry / exit authority management system will be described with reference to FIG. 1 as well. The entry / exit authority management system 10 is realized, for example, by one or more server devices. The entry / exit authority management system 10 is provided in the facility to be managed. Alternatively, the entry / exit authority management system 10 may be provided in a location different from the facility. As another example, the entry / exit authority management system 10 may be realized by a server on the cloud.

[0021] The entry / exit authority management system 10 includes an entry / exit management device 100, a personnel management device 200, a space / facility management device 300, and a route search device 400. The entry / exit management device 100, the personnel management device 200, the space / facility management device 300, and the route search device 400 may each be realized by a different server device. In that case, the entry / exit management device 100 is configured to be able to communicate with the personnel management device 200, the space / facility management device 300, and the route search device 400 via a network 8.

[0022] The entrance / exit control device 100 is an information processing device that manages the entrance / exit authority of each user for each management area. The functions of the entrance / exit control device 100 will be described in detail later.

[0023] The personnel management device 200 is a device that manages personnel information of facility users and space usage information of organizations. The personnel management device 200 may be configured as a plurality of personnel management devices 200 independent of each other for each organization that uses the facility. In this case, there is an advantage that different organizations do not have to interfere with each other's settings.

[0024] The personnel management device 200 functions as an information storage unit that stores a personnel information management table 201 as first information and a space usage status management table 202 as second information. Fig. 4 is a diagram showing an example of a personnel information management table. In the example shown in this figure, the personnel information management table 201 associates personnel information such as affiliation and position with the name as unique identification information of facility users. The identification information of the user is not limited to the name, and may be other unique identification information.

[0025] 5 is a diagram showing an example of a space usage status management table. In the example shown in this figure, the space usage status management table 202 associates the name, which serves as identification information for the organization using the facility, with an area ID, which identifies the management area. The personnel management device 200 updates the setting contents of the personnel information management table 201 or the space usage status management table 202 when a change occurs in the personnel information or the space usage status.

[0026] The space / facility management device 300 is a device for managing information on spaces and facilities in a facility. Typically, the space / facility management device 300 functions as a storage device that stores a space / facility information management table 301 as third information. FIG. 6 is a diagram showing an example of the space / facility information management table. In the example shown in this figure, the space / facility information management table 301 associates a node ID indicating a location, a type of the space or facility, a unique ID, and an authentication device ID of the corresponding authentication device 500 for each space or facility in the facility. In addition, the space / facility information management table 301 associates a space with a door for entering and leaving the space. When a change occurs in the state of the space or facility, the space / facility management device 300 updates the space / facility information management table 301 to the latest state.

[0027] Fig. 7 is a diagram showing an example of a graph structure of information managed by a space / facility management device. The circles in this diagram represent nodes that indicate the installation locations of spaces or facilities, and the lines represent edges that indicate the connections between the nodes from the perspective of user movement. Doors DR100, DR101, DR102, DR103, DR702, DR703, and DR712 are basically composed of two nodes that indicate the positions of the entrance side and exit side. If an authentication device is installed for passage from each direction, a "1" is added to the node, and if an authentication device is not installed, a "0" is added to the node.

[0028] Authentication devices CR1011, CR1012, CR1031, CR1032, CR7021, CR7022, and CR7021 are disposed in the corresponding nodes, and lock and unlock the doors enclosed by dashed lines in the figure.

[0029] The route search device 400 is a device that searches for a travel route from an entrance / exit of a facility to each space. The route search device 400 includes, as its functional blocks, a route search unit 401 and a route data storage unit 402. The route data storage unit 402 stores route data for managing travel routes within the facility.

[0030] Fig. 8 is an example of route data stored in route data storage unit 402. The route data shown in this figure is represented by nodes and edges, and is handled, for example, on a graph basis. Circles in Fig. 8 indicate nodes, and n1000, n1001, n1011, n1012, etc. indicate node IDs. Straight lines indicate edges. Note that route data may be created manually.

[0031] Based on the route data, the route search unit 401 searches for routes from the entrance / exit of the facility to each space and for doors, authentication devices, and other equipment along the route. The route search unit 401 may also search for routes by analyzing map data and structural data of the facility using a known analysis method.

[0032] 1-3. Functions of the entrance / exit management device The entry / exit management device 100 has, as its functional blocks, a first acquisition unit 101, a second acquisition unit 102, an authority derivation unit 103, an authority granting unit 104, an authority determination unit 105, an entry / exit authority information management table 110, and an authentication information management table 111.

[0033] The first acquisition unit 101 is a functional block for executing a first acquisition process for acquiring area information of a management area used by a user. In the first acquisition process, the first acquisition unit 101 identifies an affiliated organization associated with identification information of a target user to be managed, using the personnel information management table 201. Then, the first acquisition unit 101 acquires an area ID corresponding to the identified affiliated organization as area information of the management area of ​​the target user, using the space usage status management table 202.

[0034] The second acquisition unit 102 is a functional block for executing a second acquisition process for acquiring door information and authentication device information associated with a management area. In the second acquisition process, the second acquisition unit 102 acquires, using the space / facility information management table 301, the type of door associated with the area ID of the target user acquired in the first acquisition process and the authentication device ID associated with the door, as door information and authentication device information associated with the target user.

[0035] The authority derivation unit 103 derives the entry / exit authority to be granted for each management area and for each user, based on the correspondence between the users and the management areas acquired by the first acquisition unit 101. Typically, the authority derivation unit 103 derives the entry / exit authority to be granted to the target user for the authentication machine of the acquired authentication machine ID, based on the door information and authentication machine information acquired by the second acquisition unit 102. This process is hereinafter referred to as the "entrance / exit authority derivation process."

[0036] For example, when the entry / exit authority management system 10 is newly installed, the authority derivation unit 103 executes the entry / exit authority derivation process for all users of the facility. When a setting item related to the entry / exit authority is changed, the authority derivation unit 103 executes the entry / exit authority derivation process for reevaluating the entry / exit authority related to the changed setting item.

[0037] Fig. 9 is a flowchart showing a routine in which the entrance / exit control device executes an entrance / exit authority derivation process to reevaluate the entrance / exit authority. The process of the flowchart shown in Fig. 9 also represents a part of an entrance / exit authority management method that causes a computer to execute management of the entrance / exit authority of each user granted to each partitioned management area in a facility.

[0038] In step S100, it is determined whether a change in the settings of the personnel information management table 201, the space usage status management table 202, or the space and facility information management table 301 has been detected. If the determination is not true, the process returns to step S100. On the other hand, if the determination is true, the process proceeds to step S102.

[0039] In step S102, it is determined whether the item whose setting has been changed is an item related to the authority to enter and exit the room. Here, when the setting of the personnel information management table 201 is changed due to a certain user being transferred to another department, it is determined that the item whose setting has been changed is an item related to the authority to enter and exit the room. Also, when the setting of the space usage status management table 202 is changed due to an organization moving to a new room, it is determined that the item whose setting has been changed is an item related to the authority to enter and exit the room. Also, when the setting of the space / facility information management table 301 is changed due to the installation of a new authentication device 500, it is determined that the item whose setting has been changed is an item related to the authority to enter and exit the room. Furthermore, when the setting of the authority to enter and exit the room of a certain user is changed by the administrator of the authority to enter and exit the room, it is determined that the item whose setting has been changed is an item related to the authority to enter and exit the room.

[0040] As a result of the process in step S102, if the determination is not satisfied, the process returns to step S100, and if the determination is satisfied, the process proceeds to step S104. In step S104, an entry / exit authority derivation process is executed for reevaluating the entry / exit authority related to the item whose setting has been changed. Here, when a certain user changes his / her affiliation and the setting of the personnel information management table 201 is changed, the entry / exit authority of the user is evaluated again. When an organization changes its room and the setting of the space usage status management table 202 is changed, the entry / exit authority of all users belonging to the organization is evaluated again. When a new authentication device 500 is installed and the setting of the space / facility information management table 301 is changed, the entry / exit authority of all users passing through the node where the authentication device 500 is installed is evaluated again. When the setting of a certain user's entry / exit authority is changed by the entry / exit authority administrator, the entry / exit authority of the user is evaluated again.

[0041] In the entry / exit authority derivation process in step S104, the route search unit 401 searches for a movement route from the facility entrance / exit to the managed area and an authentication device present on the movement route. Then, the authority derivation unit 103 derives the entry / exit authority to be granted to a user having a correspondence relationship with the managed area for an authentication device present on the movement route searched by the route search unit 401. When the process in step S104 is completed, the process proceeds to step S106.

[0042] In step S106, the entry / exit authority is updated using the result of the reevaluation in step S104.

[0043] The authorization unit 104 is a functional block for registering the entry / exit authority information set by the entry / exit authority administrator in the authentication information management table 111. FIG. 10 is a diagram showing an example of the authentication information management table. In the example shown in this figure, in the authentication information management table 111, an authentication type and an authentication information ID are associated with a name as identification information of a user. The authentication type here is a type of user authentication, and is exemplified by a card, a fingerprint, a face, and the like. The authentication information ID is information linked to an authentication machine ID of a corresponding authentication device. FIG. 11 is a diagram showing an example of the entry / exit authority information management table. The correspondence between the authentication information ID and the authentication machine ID is specified by the entry / exit authority information management table 110 shown in FIG. 11. The entry / exit authority information is input to the authorization unit 104 by the entry / exit authority administrator from the operation terminal 800 or the communication terminal 700. Alternatively, the entry / exit authority information is input to the authorization unit 104 from the authority derivation unit 103. The entry / exit authority information input here is the entry / exit authority information derived by the entry / exit authority derivation process described above, which is granted for each authentication machine and each user. This allows the entry / exit authority to be granted only to the user's movement route, making it possible to grant the entry / exit authority to the corresponding area and door more appropriately. In addition, the entry / exit authority information is automatically input to the authority granting unit 104, reducing the effort of the entry / exit authority manager.

[0044] The authority determination unit 105 is a functional block for executing a determination process for determining whether the entry / exit authority information set in the entry / exit authority information management table 110 is appropriate. The notification unit 106 is a functional block for executing a notification process for notifying the communication terminal 700 of the determination result by the authority determination unit 105.

[0045] Fig. 12 is a flowchart showing a routine in which the entrance / exit control device executes a determination process and a notification process. The process of the flowchart shown in Fig. 12 also represents a part of an entrance / exit authority management method that causes a computer to execute management of the entrance / exit authority given to each user for each partitioned management area in a facility.

[0046] In step S110, the authority determination unit 105 executes a determination process to determine whether the entry / exit authority information derived by the authority derivation unit 103 matches the entry / exit authority information set in the entry / exit authority information management table 110. If the determination is found to be true, it is determined that the entry / exit authority information set in the entry / exit authority information management table 110 is appropriate, and this routine is terminated.

[0047] On the other hand, if the determination is not successful, it is determined that the entry / exit authority information set in the entry / exit authority information management table 110 is not appropriate, and the process proceeds to step S112. In step S112, the notification unit 106 executes notification processing. Specifically, the notification unit 106 notifies the communication terminal 700 of inconsistency information including the inconsistency content of the entry / exit authority information set in the entry / exit authority information management table 110 with respect to the entry / exit authority information derived by the authority derivation unit 103.

[0048] According to the entry / exit authority management system 10 described above, it is possible to determine whether the entry / exit authority for each user set by the entry / exit authority administrator is appropriate under the current facility usage situation, and to notify the entry / exit authority administrator. This makes it possible to provide an opportunity to correct an inappropriate entry / exit authority state.

[0049] 1-4.Modifications The entry / exit authority management system 10 of this embodiment may employ the following modified aspects.

[0050] 1-4-1. Hardware resources of the entrance and exit authority management system 10

[0051] 13 is a diagram showing an example of hardware resources of the entrance and exit control device 100. The entrance and exit control device 100 includes, as hardware resources, a processing circuit 1006 including a processor 1002 and a memory 1004. The processing circuit 1006 may include multiple processors 1002. The processing circuit 1006 may include multiple memories 1004.

[0052] In this embodiment, each unit indicated by reference numerals 101 to 106, 110, and 111 indicates a function of the entrance and exit management device 100. The functions of the entrance and exit authority information management table 110 and the authentication information management table 111 as storage units are realized by the memory 1004. The functions of each unit indicated by reference numerals 101 to 106, 110, and 111 can be realized by software written as a program, firmware, or a combination of software and firmware. The program is stored in the memory 1004. Alternatively, the program may be recorded in a computer-readable recording medium. The entrance and exit management device 100 realizes the functions of each unit indicated by reference numerals 101 to 106, 110, and 111 by executing the program stored in the memory 1004 by the processor 1002 (computer).

[0053] The processor 1002 is also called a CPU (Central Processing Unit), central processing unit, processing unit, arithmetic unit, microprocessor, microcomputer, or DSP. The memory 1004 may be a semiconductor memory, a magnetic disk, a flexible disk, an optical disk, a compact disk, a mini disk, or a DVD. Possible semiconductor memories include RAM, ROM, flash memory, EPROM, and EEPROM.

[0054] Fig. 14 is a diagram showing another example of hardware resources of the entrance and exit control device. In the example shown in Fig. 14, the entrance and exit control device 100 includes a processor 1002, a memory 1004, and a processing circuit 1006 including dedicated hardware 1008. Fig. 14 shows an example in which some of the functions of the entrance and exit control device 100 are realized by the dedicated hardware 1008. All of the functions of the entrance and exit control device 100 may be realized by the dedicated hardware 1008. As the dedicated hardware 1008, a single circuit, a composite circuit, a programmed processor, a parallel programmed processor, an ASIC, an FPGA, or a combination of these can be adopted.

[0055] The hardware resources of the personnel management device 200 are similar to the examples shown in FIG. 13 or FIG. 14. The personnel management device 200 has a processing circuit including a processor and memory as hardware resources. The personnel management device 200 realizes the functions of each unit by executing a program stored in the memory with the processor. The functions of the personnel information management table 201 and the space usage status management table 202 as storage units are realized by the memory 1004. The personnel management device 200 may have a processing circuit including a processor, memory, and dedicated hardware as hardware resources. Some or all of the functions of the personnel management device 200 may be realized by dedicated hardware.

[0056] The hardware resources of the space / facility management device 300 are similar to those shown in the examples of FIG. 13 or FIG. 14. The space / facility management device 300 comprises, as its hardware resources, a processing circuit including a processor and memory. The space / facility management device 300 realizes the functions of each unit by having the processor execute programs stored in the memory. The function of the space / facility information management table 301 as a storage unit is realized by the memory 1004. The space / facility management device 300 may comprise, as its hardware resources, a processing circuit including a processor, memory, and dedicated hardware. Some or all of the functions of the space / facility management device 300 may be realized by dedicated hardware.

[0057] The hardware resources of the route search device 400 are similar to the examples shown in FIG. 13 or FIG. 14. The route search device 400 includes a processing circuit including a processor and a memory as hardware resources. The route search device 400 realizes the functions shown in each unit by executing a program stored in the memory with the processor. The function of the route data storage unit 402 as a storage unit is realized by the memory 1004. The route search device 400 may include a processing circuit including a processor, a memory, and dedicated hardware as hardware resources. Some or all of the functions of the route search device 400 may be realized by dedicated hardware.

[0058] In the entry / exit authority management system 10 , all or part of the functions of the entry / exit control device 100 may be installed in the personnel management device 200 , the space / facility management device 300 , or the route search device 400 .

[0059] 2. Embodiment 2 The entry / exit authority management system of the second embodiment is characterized by a function for evaluating the usage record of users who have been granted entry / exit authority. Differences between the entry / exit authority management system of the second embodiment and the example disclosed in the first embodiment will be described in particular detail. For features not described in the second embodiment, any of the features of the example disclosed in the first embodiment may be adopted.

[0060] 2-1. Functions of the Entry / Exit Authority Management System of the Second Embodiment 15 is a block diagram showing functions of the entry / exit authority management system according to the embodiment 2. The entry / exit control device 100 according to the embodiment 2 further includes a performance evaluation unit 107 and a history information management table 112 in addition to the functions of the entry / exit control device 100 according to the embodiment 1.

[0061] The record evaluation unit 107 has a function of evaluating the entry and exit record for each user who has been granted entry and exit authority and for each management area. The history information management table 112 stores history information in which the user's identification information is associated with an authentication device ID and the last usage date and time. When a user is authenticated in the authentication process in the authentication device 500, the record evaluation unit 107 updates the last usage date and time of the corresponding history information. This process is hereinafter referred to as the "history information update process." Note that in the history information update process, there is no distinction made between the authentication types of users. In other words, as long as the user's identification information is common, the history information management table 112 is updated as common history information even if the authentication types are different, such as card, fingerprint, face, etc.

[0062] Furthermore, the performance evaluation unit 107 evaluates the entry / exit performance of each user for each management area based on the history information stored in the history information management table 112. This process is hereinafter referred to as the "performance evaluation process." The performance evaluation process may be executed all at once at a predetermined frequency or time period, or may be executed at an individual timing for each authentication device or for each user's affiliation. This allows the performance evaluation process to be executed at an appropriate timing for each authentication device or user's affiliation when the security level differs for each authentication device or user's affiliation.

[0063] 2-2. Specific processing of the entry / exit authority management system according to the second embodiment Fig. 16 is a flowchart showing a routine for an entry / exit management device to execute a history information update process. The process of the flowchart shown in Fig. 16 also represents a part of an entry / exit authority management method that causes a computer to execute management of entry / exit authority for each user granted for each partitioned management area in a facility.

[0064] In step S200, the result evaluation unit 107 judges whether or not the passage of a user has been detected within the facility. Here, the result evaluation unit 107 judges whether or not a user who has been granted entry and exit authority has been authenticated in the authentication process executed in each authentication device 500. As a result, if the judgment is not established, the processing of this routine is terminated, and if the judgment is established, the processing proceeds to step S202.

[0065] In step S202, the result evaluation unit 107 updates the last use date and time of the user for the authentication device 500 that was permitted to pass through in the process of step S200, in the history information management table 112. After the process of step S202 is performed, this routine is ended.

[0066] Fig. 17 is a flowchart showing a routine for the entrance / exit control device to execute performance evaluation processing. The processing of the flowchart shown in Fig. 17 also represents a part of an entrance / exit authority management method that causes a computer to execute management of the entrance / exit authority given to each user for each partitioned management area in a facility.

[0067] In step S210, the performance evaluation unit 107 calculates the time that has elapsed since the last use date and time for each authentication device for all users who have been granted the authority to enter and leave the controlled area of ​​the facility. In step S212, the performance evaluation unit 107 judges whether each calculated elapsed time has exceeded a reference time. The reference time used here is a value that has been set in advance as the elapsed time after which the entry and exit authority should be reviewed. Note that the reference time may be set to a different value for each authentication device or user. If the judgment is not established as a result, it is determined that the set user authority is appropriate, and this routine is terminated.

[0068] On the other hand, if the determination in step S212 is positive, the process proceeds to step S214. In step S214, the result evaluation unit 107 adds the authentication device ID and the user identification information for the authentication device and its user that are positive in the determination in step S212 to the notification list in association with each other. When the process in step S214 is completed, the process proceeds to step S216. In step S216, the notification unit 106 notifies the user authority administrator of the notification list.

[0069] According to the above-mentioned performance evaluation process, when a user is granted the authority to enter and leave a room to an authentication device for which the period during which the user has not entered and left the room exceeds a reference time, a notification is sent to the entry and exit authority manager. This makes it possible to prompt confirmation and correction of the entry and exit authority, and therefore makes it possible to appropriately maintain the granted state of the entry and exit authority from the viewpoint of the entry and exit performance.

[0070] 3.Embodiment 3. The entry / exit authority management system of the third embodiment is characterized by a function of evaluating whether the unlocking authority is appropriate in a facility where a security box such as a safe or a lockbox with unlocking authority set is installed. In the entry / exit authority management system of the third embodiment, differences from the example disclosed in the first embodiment will be particularly described in detail. For features not described in the third embodiment, any of the features of the example disclosed in the first embodiment may be adopted.

[0071] 3-1. Overview of the Entry / Exit Authority Management System in the Third Embodiment 18 is a diagram showing a configuration example of the entry / exit authority management system and its related equipment in embodiment 3. In addition to the configuration of the entry / exit authority management system 10 in embodiment 1, the entry / exit authority management system 10 in embodiment 3 is configured to be able to communicate with an authentication device 510, which is related equipment, via a network 8. A lockbox 900 is an example of a security box, and unlocking and locking are controlled by receiving commands from the authentication device 510.

[0072] Fig. 19 is a diagram showing a specific example of a facility to which the entry / exit authority management system in the third embodiment is applied. In the example shown in Fig. 19, space AR103 represents a space used by Section J. KB1100 represents a key locker 900 installed in space AR103. CR1100 represents an authentication device 510 provided in correspondence with the key locker 900. The entry / exit management device 100 manages the authority to unlock the key locker 900 using an entry / exit authority information management table 110, similar to the authority to enter and exit a managed area.

[0073] The lockbox 900 is installed in the space AR103 of the J division. Therefore, if a user who is not granted the authority to enter and leave the route from the entrance of the facility to the space AR103 is granted the authority to unlock the lockbox 900, it may be necessary to review the authority to enter and leave the lockbox 900 or the authority to unlock the lockbox 900 for that user. The entry / exit authority management system 10 of this embodiment is characterized by the operation of determining whether the entry / exit authority or unlocking authority set is appropriate and notifying the entry / exit authority manager. The configuration of the entry / exit authority management system will be described below using as an example a case where the entry / exit authority and unlocking authority of users are managed in the facility illustrated in FIG. 19.

[0074] The entry / exit authority management system 10 of the third embodiment has a common configuration with the entry / exit authority management system 10 of the first embodiment. The equipment managed by the space / equipment management device 300 includes a lockbox 900. FIG. 20 is a diagram showing an example of a space / equipment information management table of the space / equipment management device of the third embodiment. In the example shown in this figure, the space / equipment information management table 301 associates, for each space or equipment in the facility, a node ID indicating a location, a type of the space or equipment, a unique ID, and an authentication device ID of the corresponding authentication device 500. The equipment type here includes a lockbox. When a change occurs in the state of the space or equipment, the space / equipment management device 300 updates the space / equipment information management table 301 to the latest state.

[0075] 21 is a diagram showing an example of a graph structure of information managed in the space / equipment management device of embodiment 3. The graph structure shown in this figure further includes a key lock KB1100 and an authentication device CR1100 in addition to the graph structure of information managed in the space / equipment management device of embodiment 1. The authentication device CR1100 is placed at a node in the space AR103, and locks and unlocks the connected key lock KB1100. The key lock KB1100 is installed in the space AR1100. The key lock KB1100 operates upon receiving unlock and lock instructions from the authentication device CR1100.

[0076] 22 is an example of route data stored in the route data storage unit 402 according to the third embodiment. In the route data shown in this figure, a node n1100 is further allocated to the route data according to the first embodiment.

[0077] 3-2. Characteristic Operation of the Entrance and Exit Management Device of the Third Embodiment In the determination process, the authority determination unit 105 determines whether the unlock authority entry / exit authority information set in the entry / exit authority information management table 110 is appropriate. Fig. 23 is a flowchart showing a routine for executing the determination process and the notification process by the entry / exit management device 100 of the third embodiment. The process of the flowchart shown in Fig. 23 also represents a part of an entry / exit authority management method that causes a computer to execute the management of the entry / exit authority for each user granted for each partitioned management area in a facility.

[0078] In step S300, the route search unit 401 searches for a travel route from the entrance of the facility to the lockbox 900 and an authentication device corresponding to a door located along the route, based on the route data. When the process of step S300 is completed, the process proceeds to step S302.

[0079] In step S302, the authority determination unit 105 executes a determination process to determine whether the user who has been granted authority to unlock the lockbox 900 in the entry / exit authority information management table 110 has been granted authority to enter / exit an authentication device along the movement route searched for in step S300. If the determination is found to be successful, it is determined that the unlocking authority information and the entry / exit authority information set in the entry / exit authority information management table 110 are appropriate, and this routine ends.

[0080] On the other hand, if the determination is not successful, it is determined that the unlocking authority information or the entry / exit authority information set in the entry / exit authority information management table 110 is not appropriate, and the process proceeds to step S304. In step S304, the notification unit 106 executes notification processing. Specifically, the notification unit 106 sends a notification from the communication terminal 700 to the entry / exit authority administrator to urge him or her to review the authorization status.

[0081] According to the entry / exit authority management system 10 of the third embodiment described above, it is possible to judge whether the entry / exit authority and unlocking authority for each user set by the entry / exit authority administrator are appropriate and to notify the entry / exit authority administrator of the result. This makes it possible to provide an opportunity to correct the inappropriate state of the entry / exit authority and unlocking authority.

[0082] 3-3.Modifications The entry / exit authority management system 10 of this embodiment may employ the following modified aspects.

[0083] The entry / exit authority management system of the third embodiment may further include a function of evaluating the unlocking authority based on the unlocking record of a user who is granted the unlocking authority of the lockbox 900. In this case, when a user is authenticated in the authentication process in the authentication device 510, the record evaluation unit 107 executes a history information update process for updating the last use date and time of the corresponding history information. Then, the record evaluation unit 107 executes a record evaluation process for evaluating the unlocking record of each lockbox for each user based on the history information stored in the history information management table 112. In the record evaluation process, the record evaluation unit 107 judges whether the elapsed time from the last use date and time exceeds a reference time. As a result, if the judgment is found to be true, it may be judged that the set unlocking authority is not appropriate and a notification process may be executed. According to such an operation, it is possible to urge the administrator to review the unlocking authority of a user who has not used the lockbox 900 for more than the reference time.

[0084] 4.Other Although the preferred embodiments have been described in detail above, the present disclosure is not limited to the above-described embodiments, and various modifications and substitutions can be made to the above-described embodiments without departing from the scope of the claims.

[0085] Various aspects of the present disclosure are summarized below as appendices.

[0086] (Appendix 1) An access authority management system for managing access authority for each user granted for each management area divided within a facility, an authority granting unit that grants the entry and exit authority; an information storage unit that stores first information in which information on an organization to which a user belongs is associated with each piece of identification information of the user, and second information in which information on a management area is associated with each piece of information on the organization; a first acquisition unit that acquires a correspondence relationship between the user and the management area based on the first information and the second information; an authority derivation unit that derives an entry / exit authority to be granted for each of the management areas and each of the users based on the correspondence relationship acquired by the first acquisition unit; a notification unit that notifies an administrator when the entry / exit authority derived by the authority derivation unit does not match the entry / exit authority granted by the authority granting unit; An entry / exit authority management system equipped with (Appendix 2) a record evaluation unit that updates a record of entry and exit to the management area, including a last access date and time for each user; 2. The entry / exit authority management system according to claim 1, wherein the notification unit is configured to notify an administrator when the elapsed time from the last use date and time exceeds a reference time. (Appendix 3) the information storage unit includes third information in which information of an authentication device for authenticating entry and exit to the management area is associated with information of each management area, a second acquisition unit that acquires information on the authentication device corresponding to each of the management areas based on the third information, The authority derivation unit derives authority for being authenticated by the authentication device corresponding to the managed area as the entry / exit authority. 3. The entry / exit authority management system according to claim 1 or 2, configured as follows: (Appendix 4) a route search unit that searches for a travel route from an entrance / exit of the facility to the management area, The authority derivation unit derives the entry / exit authority to be granted to a user having a correspondence relationship with the managed area for the authentication device located on the movement route. The entry / exit authority management system according to claim 3, configured as follows: (Appendix 5) The entry / exit authority management system according to any one of Supplementary Note 1 to Supplementary Note 3, wherein the authority granting unit is configured to grant the entry / exit authority upon receiving input from an administrator or input from the authority derivation unit. (Appendix 6) the authority granting unit is configured to further grant unlocking authority to each user for a security box installed in the management area, a route search unit that searches for a travel route from an entrance / exit of the facility to the management area, The notification unit notifies an administrator when the entry / exit authority required to pass through the movement route is not granted to the user who has been granted the unlocking authority. The entry / exit authority management system according to any one of Supplementary Note 1 to Supplementary Note 5, configured as follows: (Appendix 7) a record evaluation unit that updates the unlocking record including the last access date and time for each user of the security box, 7. The entry / exit authority management system according to claim 6, wherein the notification unit is configured to notify an administrator when the elapsed time from the last use date and time exceeds a reference time. (Appendix 8) an authority granting unit that grants entry and exit authority to each user for each partitioned management area within the facility; a first acquisition unit that acquires a correspondence relationship between the user and the management area based on first information in which information of an organization to which the user belongs is associated with each identification information of the user, and second information in which information of a management area is associated with each information of the organization; an authority derivation unit that derives an entry / exit authority to be granted for each of the management areas and each of the users based on the correspondence relationship acquired by the first acquisition unit; a notification unit that notifies an administrator when the entry / exit authority derived by the authority derivation unit does not match the entry / exit authority granted by the authority granting unit; An information processing device comprising: (Appendix 9) 1. An entry / exit authority management method for causing a computer to manage entry / exit authority for each user granted for each management area partitioned within a facility, comprising: an authority granting step of granting the entry / exit authority; a first acquisition step of acquiring a correspondence relationship between the user and the management area based on first information in which information of an organization to which the user belongs is associated with each identification information of the user, and second information in which information of a management area is associated with each information of the organization; an authority derivation step of deriving an entry / exit authority to be granted to each of the management areas and each of the users based on the correspondence relationship acquired in the first acquisition step; a notification step of notifying an administrator when the entry / exit authority derived in the authority derivation step does not match the entry / exit authority granted in the authority granting step; The entry / exit authority management method includes: (Appendix 10) A computer-readable recording medium having a program recorded thereon for causing a computer to execute management of entry and exit authority for each user granted for each management area partitioned within a facility, The program is Acquire first information in which information on an organization to which the user belongs is associated with each piece of identification information of the user, and acquire second information in which information on a management area is associated with each piece of information on the organization; acquiring a correspondence relationship between the user and the management area based on the first information and the second information; deriving an entry / exit authority to be granted to each of the management areas and each of the users based on the correspondence relationship between the users and the management areas; If the derived entry / exit authority does not match the granted entry / exit authority, notify the administrator. A computer-readable recording medium configured to: [Explanation of symbols]

[0087] 8 network, 10 entry / exit authority management system, 100 entry / exit management device, 101 first acquisition unit, 102 second acquisition unit, 103 authority derivation unit, 104 authority granting unit, 105 authority determination unit, 106 notification unit, 107 performance evaluation unit, 110 entry / exit authority information management table, 111 authentication information management table, 112 history information management table, 200 personnel management device, 201 personnel information management table, 202 space utilization status management table, 300 space / facility management device, 301 space / facility information management table, 400 route search device, 401 route search unit, 402 route data storage unit, 500 authentication device, 510 authentication device, 600 door, 700 communication terminal, 800 operation terminal, 900 Key storage, 1002 processor, 1004 memory, 1006 processing circuit, 1008 dedicated hardware

Claims

1. An access authority management system for managing access authority for each user granted for each management area divided within a facility, an authority granting unit that grants the entry and exit authority; an information storage unit that stores first information in which information on an organization to which a user belongs is associated with each piece of identification information of the user, and second information in which information on a management area is associated with each piece of information on the organization; a first acquisition unit that acquires a correspondence relationship between the user and the management area based on the first information and the second information; an authority derivation unit that derives an entry / exit authority to be granted for each of the management areas and each of the users based on the correspondence relationship acquired by the first acquisition unit; a notification unit that notifies an administrator when the entry / exit authority derived by the authority derivation unit does not match the entry / exit authority granted by the authority granting unit; An entry / exit authority management system equipped with

2. a record evaluation unit that updates a record of entry and exit to the management area, including a last access date and time for each user; The entry / exit authority management system according to claim 1 , wherein the notification unit is configured to notify an administrator when the time elapsed since the last use date and time exceeds a reference time.

3. the information storage unit includes third information in which information of an authentication device for authenticating entry and exit to the management area is associated with information of each management area, a second acquisition unit that acquires information on the authentication device corresponding to each of the management areas based on the third information, The authority derivation unit derives authority for being authenticated by the authentication device corresponding to the managed area as the entry / exit authority. The entry / exit authority management system according to claim 1 or 2, configured to:

4. a route search unit that searches for a travel route from an entrance / exit of the facility to the management area, The authority derivation unit derives the entry / exit authority to be granted to a user having a correspondence relationship with the managed area for the authentication device located on the movement route. The system for managing entry and exit authority according to claim 3 , which is configured as follows:

5. 3. The entry / exit authority management system according to claim 1, wherein the authority granting unit is configured to grant the entry / exit authority upon receiving an input from an administrator or an input from the authority derivation unit.

6. the authority granting unit is configured to further grant unlocking authority to each user for a security box installed in the management area, a route search unit that searches for a travel route from an entrance / exit of the facility to the management area, The notification unit notifies an administrator when the entry / exit authority required to pass through the movement route is not granted to the user who has been granted the unlocking authority. The entry / exit authority management system according to claim 1 or 2, configured to:

7. a record evaluation unit that updates the unlocking record including the last access date and time for each user of the security box, The entry / exit authority management system according to claim 6 , wherein the notification unit is configured to notify an administrator when the time elapsed since the last use date and time exceeds a reference time.

8. an authority granting unit that grants entry and exit authority to each user for each partitioned management area within the facility; a first acquisition unit that acquires a correspondence relationship between the user and the management area based on first information in which information of an organization to which the user belongs is associated with each identification information of the user, and second information in which information of a management area is associated with each information of the organization; an authority derivation unit that derives an entry / exit authority to be granted for each of the management areas and each of the users based on the correspondence relationship acquired by the first acquisition unit; a notification unit that notifies an administrator when the entry / exit authority derived by the authority derivation unit does not match the entry / exit authority granted by the authority granting unit; An information processing device comprising:

9. 1. An entry / exit authority management method for causing a computer to manage entry / exit authority for each user granted for each management area partitioned within a facility, comprising: an authority granting step of granting the entry / exit authority; a first acquisition step of acquiring a correspondence relationship between the user and the management area based on first information in which information of an organization to which the user belongs is associated with each identification information of the user, and second information in which information of a management area is associated with each information of the organization; an authority derivation step of deriving an entry / exit authority to be granted to each of the management areas and each of the users based on the correspondence relationship acquired in the first acquisition step; a notification step of notifying an administrator when the entry / exit authority derived in the authority derivation step does not match the entry / exit authority granted in the authority granting step; The entry / exit authority management method includes:

10. A computer-readable recording medium having a program recorded thereon for causing a computer to execute management of entry and exit authority for each user granted for each management area partitioned within a facility, The program is Acquire first information in which information on an organization to which the user belongs is associated with each piece of identification information of the user, and acquire second information in which information on a management area is associated with each piece of information on the organization; acquiring a correspondence relationship between the user and the management area based on the first information and the second information; deriving an entry / exit authority to be granted to each of the management areas and each of the users based on the correspondence relationship between the users and the management areas; If the derived entry / exit authority does not match the granted entry / exit authority, notify the administrator. A computer-readable recording medium configured to:

Images