Program, method, information processing apparatus, and system

Abstract

To provide a program, a method, an information processing apparatus, and a system for easily managing the authority to use a service for users in an organization.SOLUTION: A program to be executed by a computer equipped with a processor and a memory, causes the processor to execute the steps of: acquiring information on a process of a terminal device, the process being executed through user operation on the terminal device; acquiring, based on the acquired process information, information on an attribute of the user in an organization that the user belongs to and information on a service related to the process; and determining, based on the attribute information and the service information related to the process, whether the user has the authority to use the service.SELECTED DRAWING: Figure 11

Description

[Technical Field]

[0001] The present disclosure relates to a program, a method, an information processing device, and a system. [Background technology]

[0002] In recent years, the use of SaaS (Software as a Service) has been expanding. In SaaS, software running on a server is provided to users as a service via a network such as the Internet. Furthermore, there is a technology in which organizations such as companies set available SaaS for each user and limit the scope of SaaS usage, thereby reducing the occurrence of problems such as information leaks. Patent Document 1 describes that if a record of a certain user in a CASB (Cloud Service Management Tool) log records that the user used a cloud service that is not registered in the user attribute information, the user is detected as a suspicious user. [Prior art documents] [Patent documents]

[0003] [Patent Document 1] Japanese Patent Application Publication No. 2023-054869 Summary of the Invention [Problem to be solved by the invention]

[0004] In Patent Document 1, available services are registered for each user, so the task of managing the usage rights for each user is cumbersome.

[0005] An object of the present disclosure is to easily manage service usage rights for users within an organization. [Means for solving the problem]

[0006] A program to be executed by a computer having a processor and memory, the program causing the processor to execute the following steps: acquiring information regarding a process of a terminal device that is executed by a user operating the terminal device; acquiring information regarding the attributes of the user in the organization to which the user belongs and information regarding the service related to the process based on the acquired information regarding the process; and determining whether the user has authority to use the service based on the information regarding the attributes and the information regarding the service related to the process. [Effects of the Invention]

[0007] It is possible to easily manage service usage rights for users within an organization. [Brief explanation of the drawings]

[0008] [Figure 1] 1 is a block diagram showing an example of the overall configuration of a system 1. FIG. [Figure 2] 2 is a block diagram illustrating an example of the configuration of a terminal device 10 shown in FIG. [Figure 3] FIG. 2 is a diagram illustrating an example of a functional configuration of a first server 20. [Figure 4] FIG. 2 is a diagram illustrating an example of a functional configuration of a second server 30. [Figure 5] FIG. 2 is a diagram showing the data structure of a correspondence table 2021. [Figure 6] FIG. 2 is a diagram showing the data structure of a SaaS table 2022. [Figure 7] FIG. 10 is a diagram showing the data structure of a restriction table 2023. [Figure 8] FIG. 10 is a diagram showing the data structure of a user information table 2024. [Figure 9] FIG. 2 is a diagram showing the data structure of a condition table 2025. [Figure 10] FIG. 10 is a diagram showing the data structure of a determination result table 2026. [Figure 11] FIG. 10 is a schematic diagram illustrating an example of authority determination processing. [Figure 12]2 is a schematic diagram illustrating an example of a display screen of a display 141 of a terminal device 10. FIG. [Figure 13] FIG. 2 is a block diagram showing the basic hardware configuration of a computer 90. DETAILED DESCRIPTION OF THE INVENTION

[0009] Hereinafter, embodiments of the present disclosure will be described with reference to the drawings. In the following description, the same components are denoted by the same reference numerals. The names and functions of the components are also the same. Therefore, detailed descriptions thereof will not be repeated.

[0010] <Summary> An agent application is installed on a terminal device, and an agent realized by the agent application monitors actions performed by a user. When a user performs a predetermined process, the terminal device transmits information about the user's process to a server. Based on the received information, the server acquires information about the user's attributes within the organization and information about the service related to the process. Based on the user's attributes, the server determines whether the user is authorized to use the service.

[0011] <1 Overall system configuration> Fig. 1 is a block diagram showing an example of the overall configuration of a system 1. The system 1 shown in Fig. 1 includes, for example, a terminal device 10, a first server 20, and a second server 30. The terminal device 10, the first server 20, and the second server 30 are communicatively connected via, for example, a network 80.

[0012] 1 shows an example in which the system 1 includes two terminal devices 10, but the number of terminal devices 10 included in the system 1 is not limited to two. The number of terminal devices 10 included in the system 1 may be less than three, or may be three or more.

[0013] 1, a collection of multiple devices may be considered as one first server 20. The way in which multiple functions required to realize the first server 20 according to this embodiment are allocated to one or multiple pieces of hardware can be determined appropriately in consideration of the processing capacity of each piece of hardware and / or the specifications required for the first server 20.

[0014] 1, a collection of multiple devices may be treated as one second server 30. The way in which multiple functions required to realize the second server 30 according to this embodiment are allocated to one or multiple pieces of hardware can be determined appropriately in consideration of the processing capacity of each piece of hardware and / or the specifications required for the second server 30.

[0015] 1 is, for example, an information processing device operated by a user. Specifically, for example, the terminal device 10 is an information processing device operated by an employee of a company.

[0016] The terminal device 10 is realized by, for example, a desktop PC, a laptop PC, etc. The terminal device 10 may be, for example, a mobile terminal such as a smartphone or a tablet, etc. The terminal device 10 may be a wearable terminal such as an HMD (Head Mount Display) or a wristwatch-type terminal.

[0017] The terminal device 10 includes a communication IF (Interface) 12, an input device 13, an output device 14, a memory 15, a storage 16, and a processor 19. The input device 13 is a device for receiving input operations from a user (for example, a touch panel, a touch pad, a pointing device such as a mouse, a keyboard, etc.). The output device 14 is a device for presenting information to a user (a display, a speaker, etc.).

[0018] The first server 20 is, for example, an information processing device that manages web services used by employees of a company. The first server 20 is realized by, for example, a computer connected to a network 80. As shown in Fig. 1, the first server 20 includes a communication IF 22, an input / output IF 23, a memory 25, a storage 26, and a processor 29. The input / output IF 23 functions as an input device for receiving input operations from a user and as an interface with an output device for outputting information to the user.

[0019] The second server 30 is, for example, an information processing device that provides web services used by employees of a company. That is, the second server 30 is, for example, an information processing device that provides SaaS (Software as a Service). The second server 30 issues accounts to employees based on, for example, a contract with the company. The employees use the web services via the assigned accounts. The second server 30 is, for example, realized by a computer connected to the network 80. The second server 30 has, for example, a configuration similar to that of the first server 20 in FIG. 1.

[0020] Each information processing device is configured by a computer equipped with an arithmetic unit and a storage device. The basic hardware configuration of the computer and the basic functional configuration of the computer realized by the hardware configuration will be described later. For each of the terminal device 10, the first server 20, and the second server 30, descriptions that overlap with the basic hardware configuration and basic functional configuration of the computer will be omitted.

[0021] <1.1 Terminal device configuration> Fig. 2 is a block diagram showing an example configuration of the terminal device 10 shown in Fig. 1. As shown in Fig. 2, the terminal device 10 includes a communication unit 120, an input device 13, an output device 14, an audio processing unit 17, a microphone 171, a speaker 172, a camera 160, a position information sensor 150, a storage unit 180, and a control unit 190. The blocks included in the terminal device 10 are electrically connected by, for example, a bus or the like.

[0022] The communication unit 120 performs processing such as modulation and demodulation for the terminal device 10 to communicate with other devices. The communication unit 120 performs transmission processing on the signal generated by the control unit 190 and transmits it to the outside (for example, the first server 20 or the second server 30). The communication unit 120 performs reception processing on the signal received from the outside and outputs it to the control unit 190.

[0023] The input device 13 is a device for inputting instructions or information by a user operating the terminal device 10. The input device 13 is realized, for example, by a touch-sensitive device 131 or the like, which inputs instructions by touching an operation surface. When the terminal device 10 is a PC or the like, the input device 13 may be realized by a reader, keyboard, mouse, or the like. The input device 13 converts instructions input by the user into electrical signals and outputs the electrical signals to the control unit 190. The input device 13 may include, for example, a receiving port that receives electrical signals input from an external input device.

[0024] The output device 14 is a device for presenting information to a user operating the terminal device 10. The output device 14 is realized, for example, by a display 141 or the like. The display 141 displays data according to the control of the control unit 190. The display 141 is realized, for example, by an LCD (Liquid Crystal Display) or an organic EL (Electro-Luminescence) display or the like.

[0025] The audio processing unit 17 performs, for example, digital-to-analog conversion processing of an audio signal. The audio processing unit 17 converts a signal provided from the microphone 171 into a digital signal and provides the converted signal to the control unit 190. The audio processing unit 17 also provides the audio signal to the speaker 172. The audio processing unit 17 is realized, for example, by a processor for audio processing. The microphone 171 receives audio input and provides an audio signal corresponding to the audio input to the audio processing unit 17. The speaker 172 converts the audio signal provided from the audio processing unit 17 into audio and outputs the audio to the outside of the terminal device 10.

[0026] The camera 160 is a device that receives light with a light receiving element and outputs the light as an image capturing signal.

[0027] The position information sensor 150 is a sensor that detects the position of the terminal device 10, and is, for example, a GPS (Global Positioning System) module. The GPS module is a receiving device used in a satellite positioning system. In the satellite positioning system, signals are received from at least three or four satellites, and the current position of the terminal device 10 equipped with the GPS module is detected based on the received signals. The position information sensor 150 may detect the current position of the terminal device 10 from the position of the wireless base station to which the terminal device 10 is connected.

[0028] The storage unit 180 is realized by, for example, the memory 15, the storage 16, etc., and stores data and programs used by the terminal device 10. The storage unit 180 stores, for example, user information 181 and an agent application 187. The information and applications stored in the storage unit 180 are not limited to these.

[0029] The user information 181 includes, for example, information about the user who uses the terminal device 10. The information about the user includes, for example, a user ID, the user's name, age, address, date of birth, password, contact information (address), and the like.

[0030] The agent application 187 is an application for managing the use of SaaS by a user. The agent application 187 is installed on the terminal device 10. The agent application 187 runs, for example, in the background of other applications installed on the terminal device 10, and monitors processes executed by the user.

[0031] The control unit 190 is realized by the processor 19 reading a program including the agent application 187 stored in the storage unit 180 and executing instructions included in the program. The control unit 190 controls the operation of the terminal device 10. The control unit 190 functions as an operation reception unit 191, a transmission / reception unit 192, a presentation control unit 193, and an acquisition unit 194 by operating in accordance with the program.

[0032] The operation reception unit 191 performs processing for receiving instructions or information input from the input device 13. Specifically, for example, the operation reception unit 191 receives instructions or information input from the touch-sensitive device 131 or the like.

[0033] Furthermore, the operation reception unit 191 receives voice instructions input from the microphone 171. Specifically, for example, the operation reception unit 191 receives a voice signal that is input from the microphone 171 and converted into a digital signal by the voice processing unit 17. For example, the operation reception unit 191 analyzes the received voice signal and extracts a predetermined noun, thereby acquiring an instruction from the user.

[0034] The transmitting / receiving unit 192 performs processing for the terminal device 10 to transmit and receive data to and from an external device such as the first server 20 or the second server 30 in accordance with a communication protocol. Specifically, for example, the transmitting / receiving unit 192 transmits information input by the user or instructions from the user to the first server 20 or the second server 30. In addition, the transmitting / receiving unit 192 receives information provided from the first server 20 or the second server 30.

[0035] The presentation control unit 193 controls the output device 14 to present information provided from the first server 20 or the second server 30 to the user. Specifically, for example, the presentation control unit 193 causes the information provided from the first server 20 or the second server 30 to be displayed on the display 141. In addition, the presentation control unit 193 causes the information provided from the first server 20 or the second server 30 to be output from the speaker 172.

[0036] The acquisition unit 194 acquires information about a process executed by a user operating the terminal device 10. Specifically, for example, the acquisition unit 194 acquires the name of an application executed by the user's operation and the process name of the application. The acquisition unit 194 stores the acquired application name, process name, and the date and time when this information was acquired in the storage unit 180 (not shown).

[0037] The acquisition unit 194 also acquires information generated when the user operates the browser. The information generated when the user operates the browser is, for example, the browser usage history, and more specifically, the URLs and page titles of web pages visited by the user operating the browser. The acquisition unit 194 acquires the information generated when the browser is operated from the browser used in the terminal device 10 at a predetermined timing, for example, at a predetermined cycle such as every five minutes. The acquisition unit 194 stores the acquired information, the date and time when the information was acquired, the name of the browser that acquired the information, and identification information of the terminal device 10 (for example, a device GUID) in the storage unit 180 (not shown).

[0038] <1.2 Functional configuration of the first server> 3 is a diagram illustrating an example of the functional configuration of the first server 20. As illustrated in FIG. 3, the first server 20 functions as a communication unit 201, a storage unit 202, and a control unit 203.

[0039] The communication unit 201 performs processing for the first server 20 to communicate with external devices.

[0040] The storage unit 202 includes, for example, a correspondence table 2021, a SaaS table 2022, a restriction table 2023, a user information table 2024, a condition table 2025, and a judgment result table 2026. The tables stored in the storage unit 202 are not limited to these.

[0041] The correspondence table 2021 is a table that associates information for identifying a SaaS with information about a process executed by a user. Details will be described later.

[0042] The SaaS table 2022 is a table that stores information for identifying SaaS, the contents of the SaaS, etc. The SaaS stored in the SaaS table 2022 is, for example, SaaS that is not permitted for use within an organization. In other words, the SaaS table 2022 is a blacklist. The SaaS stored in the SaaS table 2022 may also be, for example, SaaS that is permitted for use within an organization. In other words, the SaaS table 2022 may be a whitelist. Details will be described later. The SaaS table 2022 is updated when a company using the system 1 signs up for a new SaaS.

[0043] The restriction table 2023 is a table that associates conditions for restricting the operation of the terminal device 10 in response to the determination result by the determination module 2037 with the restrictions on the operation of the terminal device 10. Details will be described later. The restriction table 2023 is updated whenever a new correspondence between the determination result and the restrictions on the operation of the terminal device 10 is registered.

[0044] The user information table 2024 is a table that stores information about users. The user information table 2024 is updated whenever information about a new user is registered. Details will be described later.

[0045] The condition table 2025 is a table that stores information about conditions related to SaaS usage rights, and will be described in detail later.

[0046] The determination result table 2026 is a table that stores the detection log of the user's use of SaaS and the determination results by the determination module 2037. Details will be described later.

[0047] The control unit 203 is realized by the processor 29 reading a program stored in the storage unit 202 and executing instructions included in the program. By operating in accordance with the program, the control unit 203 performs functions shown as a reception control module 2031, a transmission control module 2032, a presentation control module 2033, a management module 2034, a first acquisition module 2035, a second acquisition module 2036, a determination module 2037, and a restriction module 2038.

[0048] The reception control module 2031 controls the process in which the first server 20 receives a signal from an external device in accordance with a communication protocol.

[0049] The transmission control module 2032 controls the process in which the first server 20 transmits a signal to an external device in accordance with a communication protocol.

[0050] The presentation control module 2033 presents the information extracted from the storage unit 202 to a predetermined user via an external terminal.

[0051] The management module 2034 manages information stored in the storage unit 202. Specifically, for example, the management module 2034 updates the user information table 2024 when there is information about a new user or when there is an update to the information about an already registered user. Furthermore, for example, the management module 2034 updates the correspondence table 2021 when there is a new correspondence between information for identifying a SaaS and information about a process performed by a user. Furthermore, for example, the management module 2034 updates the SaaS table 2022 when there is information about a new SaaS. Furthermore, for example, the management module 2034 updates the restriction table 2023 when there is a new correspondence between a determination result by the determination module 2037 and a restriction on the operation of the terminal device 10. Furthermore, for example, the management module 2034 updates the condition table 2025 when there is new information about conditions related to SaaS usage rights.

[0052] The first acquisition module 2035 acquires information related to processing executed by a user operating the terminal device 10. The first acquisition module 2035 transmits a request for information acquired by the acquisition unit 194 of the terminal device 10 to the terminal device 10 at a predetermined timing (for example, at a predetermined cycle). The terminal device 10 transmits the information acquired by the acquisition unit 194 to the first server 20 in response to the request. The first acquisition module 2035 acquires the information transmitted from the terminal device 10.

[0053] Alternatively, the terminal device 10 transmits the information acquired by the acquisition unit 194 to the first server 20 at a predetermined timing (for example, at a predetermined cycle or at the timing when the acquisition unit 194 acquires the information). The first acquisition module 2035 acquires the information transmitted from the terminal device 10.

[0054] The second acquisition module 2036 acquires information about the attributes of the user in the organization to which the user belongs, based on information about the processing performed by the user. Specifically, for example, when the first acquisition module 2035 acquires information about the processing performed by the user operating the terminal device 10, the second acquisition module 2036 extracts the user ID of the user from the information. Then, the second acquisition module 2036 searches the user information table 2024 using the user ID of the user, and acquires the user attribute information (for example, job title identification information, department identification information). In this way, the second acquisition module 2036 identifies the user attributes.

[0055] Furthermore, the second acquisition module 2036 acquires information about the SaaS used by the user based on information about the processing executed by the user. Specifically, for example, in response to the first acquisition module 2035 acquiring information about the processing executed by the user's operation of the terminal device 10, the second acquisition module 2036 extracts the URL of the web page visited by the user from the information. Then, the second acquisition module 2036 compares the URL of the web page visited by the user with the correspondence table 2021 and acquires the SaaSID of the SaaS used by the user. In this way, the second acquisition module 2036 identifies the SaaS used by the user.

[0056] The determination module 2037 determines whether a user has authorization to use the SaaS used by the user based on the user's attributes. Specifically, the determination module 2037 determines whether the user has authorization to use the SaaS used by the user by determining whether the attributes of the user who executed the process satisfy the conditions for having authorization to use the SaaS used by the user. For example, the determination module 2037 acquires information on the user's attributes, such as job title and department, from the information acquired by the second acquisition module 2036, and acquires the SaaSID of the SaaS used by the user from the information acquired by the second acquisition module 2036. Then, the determination module 2037 references the condition table 2025 and determines whether the user's attributes, such as job title and department, satisfy the conditions stored in the "condition" item of the record related to the SaaSID of the SaaS used by the user.

[0057] Furthermore, the determination module 2037 stores the determination result in the determination result table 2026 in accordance with the above-mentioned determination.

[0058] The restriction module 2038 imposes restrictions on the operation of the terminal device 10 based on the determination result of the determination module 2037. That is, the restriction module 2038 transmits to the terminal device 10 an instruction to impose restrictions on the operation of the processor of the terminal device 10 based on the determination result of the determination module 2037. Specifically, for example, the restriction module 2038 determines whether the determination result stored in the determination result table 2026 satisfies a predetermined condition. The predetermined condition includes, for example, the following: - It was determined that the user did not have the right to use the SaaS that the user used. The number of times the same decision has been made has reached a predetermined value. - The number of times the same decision has been made within a specified period of time has reached a specified value.

[0059] For example, when the judgment results stored in the judgment result table 2026 satisfy at least one of the above conditions or at least one combination of the above conditions, the restriction module 2038 imposes a predetermined restriction on the operation of the terminal device 10. The predetermined restriction includes, for example, the following:

[0060] (Restrictions on operations on terminal device 10) - Prevent any operations on the terminal device 10 from being accepted

[0061] (Prohibition or restriction of access to resources related to SaaS that are determined to be unauthorised to be used) Here, a resource refers to any type of element available on a network, including, for example, physical or virtual devices such as servers, and various types of data and information such as web pages, files, databases, etc. Examples of prohibiting or restricting access to resources are shown below. - URL access prohibition and restriction - Folder access prohibition and restrictions - Prohibition or restriction of certain operations such as reading and writing

[0062] (Prohibition of operation of SaaS applications that are determined to be unauthorized to use) - Application execution prohibition and restriction - File execution prohibition and restrictions Stopping running applications

[0063] The determination result and the restrictions on the operation of the terminal device 10 are stored, for example, in the restriction table 2023. The restriction module 2038, for example, collates the determination result of the determination module 2037 with the restriction table 2023 and determines the restrictions on the operation of the terminal device 10.

[0064] <1.3 Functional configuration of the second server> 4 is a diagram illustrating an example of the functional configuration of the second server 30. As illustrated in FIG. 4, the second server 30 functions as a communication unit 301, a storage unit 302, and a control unit 303.

[0065] The communication unit 301 performs processing for the second server 30 to communicate with external devices.

[0066] The storage unit 302 includes, for example, a user information table 3021. The tables stored in the storage unit 302 are not limited to these. For example, a table other than the user information table 3021 may be stored.

[0067] The user information table 3021 is a table that stores information about users of companies that receive services provided by the second server 30, for example.

[0068] The control unit 303 is realized by the processor reading a program stored in the storage unit 302 and executing instructions included in the program. The control unit 303 operates in accordance with the program to perform functions shown as a reception control module 3031, a transmission control module 3032, and a service providing module 3033.

[0069] The reception control module 3031 controls the process in which the second server 30 receives a signal from an external device in accordance with a communication protocol.

[0070] The transmission control module 3032 controls the process in which the second server 30 transmits a signal to an external device in accordance with a communication protocol.

[0071] The service providing module 3033 provides services to users of a company that receives the services provided by the second server 30, for example.

[0072] <2 Data Structure> 5 to 10 are diagrams showing the data structures of tables stored in the first server 20. Note that Figures 5 to 10 are merely examples and do not exclude data that is not listed. Furthermore, even data that is listed in the same table may be stored in separate storage areas in the storage unit 202.

[0073] 5 is a diagram showing the data structure of correspondence table 2021. Correspondence table 2021 is a table having columns such as URL, with SaaSID as a key. Note that correspondence table 2021 may also have columns for storing information other than the above.

[0074] The SaaSID is an item that stores an identifier for uniquely identifying the SaaS. The URL is an example of information that indicates that the SaaS has been executed. The "URL" item stores, for example, the URL of the homepage that provides the corresponding SaaS.

[0075] 6 is a diagram showing the data structure of SaaS table 2022. SaaS table 2022 is a table having columns such as name, provider, version, and support information, with SaaSID as a key. Note that SaaS table 2022 may have columns for storing information other than these, or may not have any of these pieces of information.

[0076] The name is an item that stores the name of the SaaS. The provider is an item that stores the entity that provides the SaaS. The "provider" item stores, for example, the name of the company or the address of the website that provides the service. The version is an item that stores the version of the SaaS that is being provided. The support information is an item that stores information about the support provided for the SaaS.

[0077] 7 is a diagram showing the data structure of the restriction table 2023. The restriction table 2023 is a table having columns such as correspondence and priority, with conditions as keys. Note that the restriction table 2023 may also have columns for storing information other than these.

[0078] The condition is an item that stores the condition for restricting the operation of the terminal device 10. For example, the following contents are stored in the item "condition". The SaaS was used by a user who did not have the authorization to use it. The number of times the same decision has been made has reached a predetermined value. - The number of times the same decision has been made within a specified period of time has reached a specified value.

[0079] The restriction is an item that stores restrictions imposed on the terminal device 10. The item "restriction" stores, for example, the following: - Prevent any operations on the terminal device 10 from being accepted - Prohibition of access to specified URLs - Prohibit execution of specified applications -Prohibit access to specified folders - Preventing execution of specified files - Prohibition of certain operations such as reading and writing Stopping running applications

[0080] The priority is an item that stores the priority level when adopting a restriction. For example, priority 1 is higher than priorities 2 and 3, and when multiple conditions are met simultaneously, the restriction with the higher priority is adopted. Note that when multiple conditions are met simultaneously, multiple restrictions may be adopted.

[0081] 8 is a diagram showing the data structure of the user information table 2024. The user information table 2024 is a table having columns such as user name, department, and job title, with the user ID as a key. The user information table 2024 may also have columns for storing information other than the above. For example, the user information table 2024 may store information regarding the attributes of the user in the organization to which the user belongs, such as the department and job title, as well as information regarding the working style, employment type, qualifications, and job type.

[0082] The user ID is an item that stores an identifier for uniquely identifying a user. The user name stores a character string that indicates the name of the user. The user name may be set to any character string, such as the user's name or nickname.

[0083] The "department" is an item that stores information about the department to which the user belongs in the organization to which the user belongs. The department is an example of a user's attribute in the organization to which the user belongs. The "department" item stores, for example, a character string such as the department's identification information (department ID) or the department's name. The "department" item may store multiple values.

[0084] The "job title" is an item that stores information about the job title assigned to a user in the organization to which the user belongs. The job title is an example of a user's attribute in the organization to which the user belongs. The "job title" item stores, for example, character strings such as job title identification information (job title ID) and job title name. The "job title" item may also store information about rank identification information and rank name, grade identification information and grade name. The "job title" item may store multiple values.

[0085] 9 is a diagram showing the data structure of the condition table 2025. The condition table 2025 is a table having columns for the target SaaS, conditions, etc., with a condition ID as a key. Note that the condition table 2025 may also have columns for storing information other than the above.

[0086] The condition ID is an item for storing an identifier for uniquely identifying a condition.

[0087] The target SaaS is an item for storing information identifying the target SaaS for which conditions regarding usage rights are defined. For example, SaaSID is stored in the target SaaS.

[0088] The condition is an item that stores the conditions under which a user is authorized to use the target SaaS. Specifically, the condition stores information regarding the conditions for the user's attributes for having the authorization to use the target SaaS. For example, the condition stores conditions related to the user's department, job title, etc. As a result, the conditions for the authorization to use each SaaS are determined based on the user's attributes within the organization. Therefore, if the user's attributes are changed in the user information table 2024, the user's authorization to use each SaaS is also changed. For example, the condition stores a conditional expression indicating a condition such as "department ID is 001." The condition may also store multiple conditional expressions using one or more identification information. As an example, the condition may store a conditional expression indicating a condition such as "job title ID is 001 and department ID is 002."

[0089] 10 is a diagram showing the data structure of the judgment result table 2026. The judgment result table 2026 is a table having columns such as time, detected SaaS, user ID, judgment result, etc., with a judgment result ID as a key. Note that the judgment result table 2026 may also have columns for storing information other than these.

[0090] The judgment result ID is an item for storing an identifier for uniquely identifying the detection log of the process related to the terminal device 10 executed by the user.

[0091] The time is an item for storing the time when the use of the SaaS was detected. For example, the timestamp when the detection corresponding to the judgment result ID was executed is stored in the item "time".

[0092] The detected SaaS stores information about the detected SaaS whose use was detected in the detection process corresponding to the judgment result ID. Specifically, the item "detected SaaS" stores identification information (e.g., SaaSID) of the SaaS used by the user in the user's processing related to the detection process.

[0093] The user ID is stored as the user ID of the user who used the detected SaaS.

[0094] The judgment result is an item that stores the judgment result of whether or not the user has the usage authorization for the detected SaaS in the processing of the detected user. For example, the judgment result stores "1" if the user has the usage authorization, and "0" if the user does not have the usage authorization.

[0095] <3 operations> (Authority determination process) 11 is a schematic diagram illustrating an example of an authority determination process in which the first server 20 monitors the terminal device 10 and determines whether or not the user has authorization to use the SaaS that is being used by operating the terminal device 10. In Fig. 11, when the user operates the terminal device 10 on which the agent app 187 is running to use a predetermined SaaS, the terminal device 10 detects the process being executed by the user and transmits information to the first server 20. Based on the acquired information, the first server 20 determines whether or not the user has authorization to use the SaaS.

[0096] First, a user who uses the terminal device 10 (hereinafter, the user) starts up the terminal device 10. The agent application 187 is set to start up automatically, for example, and is started up by the OS of the terminal device 10 when the terminal device 10 is started up. When the agent application 187 is started up, the control unit 190 may or may not present a notice that the agent application 187 is running so that the user can recognize it. The user operates the terminal device 10 and, for example, uses a predetermined SaaS to perform the task assigned to the user.

[0097] In step S11, the control unit 190 acquires information about the processing executed by the user. Specifically, for example, the acquisition unit 194 accesses the browser log file at a predetermined interval and acquires the URLs of web pages visited by the user operating the browser during that interval. Note that the date and time when the URL is acquired may be the date and time when the user visited the web page associated with the URL.

[0098] The control unit 190 transmits information related to the processing executed by the user. Specifically, for example, the transmitting / receiving unit 192 transmits to the first server 20 the user ID of the user who performed the processing, the URL acquired by the acquisition unit 194, and the date and time when the URL was acquired.

[0099] In step S12, the control unit 203 of the first server 20 acquires information about the SaaS used by the user based on information about the process executed by the user. Specifically, the first acquisition module 2035 acquires, from the information received from the terminal device 10, the user ID of the user who performed the process, the URL acquired by the acquisition unit 194, and the date and time when the URL was acquired.

[0100] In step S13, the control unit 203 acquires information about the SaaS used by the user in the process executed by the user. Specifically, for example, the second acquisition module 2036 compares the URL acquired in step S13 with the correspondence table 2021 and acquires the SaaSID of the SaaS used by the user.

[0101] Furthermore, the second acquisition module 2036 acquires information about the attributes of the user in the organization to which the user who executed the process belongs. Specifically, for example, the attribute acquisition module 2039 compares the user ID acquired in step S12 with the user information table 2024 and acquires the department ID and job title ID of the user.

[0102] In step S14, the control unit 203 acquires information about the usage authority predetermined for the SaaS used by the user. Specifically, for example, the determination module 2037 searches the item "target SaaS" in the condition table 2025 based on the acquired SaaSID, and acquires information about the item "conditions," thereby acquiring information about the conditions for having the usage authority for the SaaS.

[0103] The control unit 203 determines whether the user has authorization to use the SaaS used by the user. Specifically, for example, the determination module 2037 determines whether the user's job title ID and department ID satisfy the conditions stored in the "Condition" item of the record of the SaaSID of the SaaS used by the user in the condition table 2025.

[0104] The control unit 203 stores the determination result in the storage unit 202. Specifically, for example, the determination module 2037 stores the date and time when the URL was acquired in the item "Time" of the determination result table 2026, the SaaSID of the SaaS used by the user in the item "Detected SaaS", the user ID of the user in the item "User ID", and the determination result in the item "Determination result". For example, the item "Determination result" stores "0" if it is determined that the user does not have the usage authority, and stores "1" if it is determined that the user has the usage authority.

[0105] In step S15, the control unit 203 determines whether to impose restrictions on the operation of the terminal device 10. Specifically, for example, the restriction module 2038 determines whether the determination result of step S14 satisfies a predetermined condition. If the determination result satisfies the predetermined condition, the restriction module 2038 shifts the process to step S16. If the determination result does not satisfy the predetermined condition, the restriction module 2038 terminates the process.

[0106] In step S16, the control unit 203 transmits information relating to an instruction to impose a predetermined restriction on the operation of the terminal device 10 to the terminal device 10. Specifically, for example, the restriction module 2038 compares the determination result of step S14 with the restriction table 2023, determines the restriction on the operation of the terminal device 10, and transmits information relating to the instruction to impose the determined restriction to the terminal device 10.

[0107] More specifically, for example, if the number of times that a SaaS for which the user does not have the authority to use has been used reaches N times, the restriction module 2038 prohibits the terminal device 10 from accessing the URL of the web page that provides the SaaS (the URL of the web page that the user accessed by operating the browser, acquired in step S11). Also, for example, if the number of times that a SaaS for which the user does not have the authority to use has been used reaches N times within a predetermined period, the restriction module 2038 prohibits the terminal device 10 from accessing the URL of the web page that provides the SaaS.

[0108] Furthermore, the control unit 203 presents the result of the determination made by the determination module 2037 to the user. Specifically, the presentation control module 2033 transmits information to the terminal device 10 indicating at least one of the following: that the user does not have authorization to use the SaaS whose use has been detected, and that restrictions have been placed on the operation of the terminal device 10. As a result, the presentation control module 2033 presents or notifies the user via the terminal device 10 of at least one of the following: that the user does not have authorization to use the SaaS whose use has been detected, and that restrictions have been placed on the operation of the terminal device 10.

[0109] In step S17, the control unit 190 restricts the operation of the terminal device 10 based on the information received from the first server 20. Specifically, for example, the terminal device 10 stores the URL of the web page that provides the restricted SaaS or the domain included in the URL in the storage unit 180, and prohibits the terminal device 10 from accessing the web page corresponding to the URL or domain.

[0110] In step S18, the presentation control unit 193 presents or notifies the user of the result of the determination. The presentation control unit 193 presents or notifies the user of at least one of the fact that the user does not have the authority to use the SaaS whose use has been detected and that the operation of the terminal device 10 has been restricted.

[0111] Fig. 12 is a schematic diagram showing an example of a display screen of the display 141 of the terminal device 10. Fig. 12 shows an example in which access to a web page providing SaaS is prohibited due to use of SaaS for which the user does not have authorization to use. The screen shown in Fig. 12 displays a first area 1411 for notifying the user that access to a page provided by SaaS for which the user does not have authorization to use has been prohibited.

[0112] Furthermore, the control unit 203 may present or notify the administrative user of the result of the determination made by the determination module 2037. Specifically, the control unit 203 may present or notify the administrative user of at least one of the following: the user does not have authorization to use the SaaS whose use by the user has been detected, and that restrictions have been placed on the operation of the terminal device 10. The administrative user is, for example, a terminal management user (such as a user in the information systems department) who manages the terminal device 10, or an employee management user (such as a department manager or a user in the human resources department) who manages the user who operates the terminal device 10 and uses the SaaS. For example, the control unit 203 transmits information to the terminals owned by the administrative users, thereby presenting or notifying the administrative user via each terminal of at least one of the following: the user does not have authorization to use the SaaS whose use by the user has been detected, and that restrictions have been placed on the operation of the terminal device 10.

[0113] (summary) As described above, in the above embodiment, the first acquisition module 2035 acquires information about a process of the terminal device that is executed by the user operating the terminal device. The second acquisition module 2036 acquires information about the user's attributes in the organization to which the user belongs and information about the service related to the process based on the acquired information about the process. The determination module 2037 determines whether the user has permission to use the service based on the information about the attributes and the information about the service related to the process. In this way, whether or not a user has permission to use a service is determined based on the user's attributes, so there is no need to individually grant or revoke permission to use a service for each user. Therefore, according to the above embodiment, it is easy to manage the permission to use a service for users within an organization.

[0114] In the above embodiment, the presentation control module 2033 presents the result of the determination to the user via the terminal device. This allows the user to be informed of whether or not the user has authorization to use the service they used. This can prevent the user from using the service in future tasks.

[0115] In the above embodiment, the presentation control module 2033 presents the result of the determination to an administrator user who manages at least one of the user and the user's terminal device via the administrator user's terminal device. This allows the administrator user to take a predetermined action on the user or the user's terminal in response to the presented information. Therefore, the administrator user can quickly respond to a user who has used a service for which the user does not have authorization to use the service.

[0116] Furthermore, in the above embodiment, if it is determined that a user does not have authorization to use a service, the restriction module 2038 restricts access to resources related to the service on the user's terminal. This makes it possible to restrict the use of a service by an unauthorized user. Therefore, it is possible to reduce the risk of data leakage and the like caused by an unauthorized user using a service.

[0117] Furthermore, in the above embodiment, if it is determined that a user does not have authorization to use a service, the restriction module 2038 restricts the operation of applications related to the service on the user's terminal. This makes it possible to restrict the use of a service by an unauthorized user. Therefore, it is possible to reduce the risk of data leakage, etc., caused by an unauthorized user using a service.

[0118] In the above embodiment, the control unit 203 acquires information about the attributes of a predetermined user in an organization to which the predetermined user belongs, acquires information about services for which the predetermined user has access rights based on the information about the attributes of the predetermined user, and presents the acquired information about services for which the specific user has access rights to an administrator user who manages at least one of the predetermined user and the predetermined user's terminal device via the administrator user's terminal device. This allows the predetermined user to efficiently grasp the SaaS for which they have access rights.

[0119] In the above embodiment, the control unit 203 acquires information regarding a change in the attributes of a predetermined user, acquires information regarding a change in the usage authority of the predetermined user resulting from the attribute change, and presents the acquired information regarding the change in the usage authority of the predetermined user to the administrator user via the administrator user's terminal device. This allows the administrator user to efficiently grasp the SaaS that should be installed or removed from the terminal due to the addition or deletion of usage authority resulting from the attribute change.

[0120] <Modification> In the above embodiment, when the operation of the terminal device 10 is restricted because the user does not have the authorization to use the SaaS, an example is described in which the fact that the restriction has been imposed is presented to the user, as shown in Fig. 13. However, the information presented to the user is not limited to the fact that the operation of the terminal device 10 has been restricted. The presentation control unit 193 may present to the user that the user does not have the authorization to use the SaaS.

[0121] In the above embodiment, the browser usage history is used as information about the processing performed by the user. However, the application name and process name of the application executed by the user may also be used as information about the processing performed by the user. In this case, for example, the correspondence table 2021 associates SaaS with the application name and process name of the application executed by the user. The second acquisition module 2036 compares the acquired application name and process name with the correspondence table 2021 and acquires the SaaSID of the SaaS used by the user. In this way, the second acquisition module 2036 identifies the SaaS used by the user.

[0122] Furthermore, in the above embodiment, an example has been described in which the use of SaaS is monitored, but the use of applications by the terminal device 10 may also be monitored. In this case, the first server 20 stores, for example, a table in the correspondence table 2021 that stores application names, process names, etc., and SaaSIDs. The agent application 187 of the terminal device 10 transmits information related to execution events of applications, processes, etc., by the terminal device 10 to the first server 20. The determination module 2037 of the first server 20 collates the information acquired from the terminal device 10 with the table, and determines whether the user has authorization to use the application used by the user.

[0123] (Decision on granting authority) In the above embodiment, if the user does not have authorization to use the SaaS, a predetermined restriction is imposed on the terminal device 10. In addition to this, or instead, the control unit 203 may determine whether or not to grant the user authorization to use the SaaS.

[0124] Specifically, the control unit 203 may determine whether to grant usage authorization based on the number of times or frequency of use of the SaaS. For example, after step S14 of the authorization determination process, the control unit 203 may refer to the determination result table 2026 to acquire the number of times the user has used the SaaS or the frequency of use during a specific period. If the number of times or frequency of use exceeds a predetermined threshold, the control unit 203 may present the administrator user with information regarding the frequency of use of the SaaS by the user, information suggesting that the user be granted usage authorization for the SaaS, etc.

[0125] Alternatively, the control unit 203 may display a button for requesting the granting of SaaS usage rights on the display 141 of the terminal device 10. In response to the user pressing the button, the first server 20 may present to the administrator user information that the user is requesting the granting of SaaS usage rights.

[0126] (Presenting SaaS for which you have usage rights) The control unit 203 may present information about SaaS that a specific user has permission to use to a user such as an administrator user.

[0127] For example, in response to an instruction from a terminal of an administrator user or the like, or in response to the addition of a new record to the user information table 2024, the control unit 203 acquires information about the user's attributes stored in a predetermined record (the record in response to the instruction or the newly added record). The control unit 203 searches the condition table 2025 based on the acquired information about the attributes to acquire a list of SaaSIDs of records that satisfy the conditions. The control unit 203 then searches the SaaS table 2022 based on the acquired SaaSID to acquire information about SaaSs that the user associated with the record has usage rights to. The control unit 203 may present the acquired information to the administrator user. This allows the administrator user to efficiently grasp the SaaSs that the predetermined user has usage rights to (SaaSs that should be installed on the predetermined user's terminal). In particular, when a new user joins the organization, the administrator user can efficiently grasp the SaaSs that the new user has usage rights to (SaaSs that should be installed on the new user's terminal).

[0128] Furthermore, the control unit 203 may install SaaS that the new user has usage rights to on the terminal, or may issue a SaaS usage ID based on the acquired information. The installation of SaaS and the issuance of an ID can be realized by any SaaS management technology.

[0129] Furthermore, for example, the control unit 203 may acquire information regarding the change in user attributes in response to a change in the user attributes in a predetermined record of the user information table 2024. The control unit 203 may search the condition table 2025 based on information regarding the user attributes for each of the attributes before and after the change, and compare the search results before and after the attribute change to acquire the SaaSID of the SaaS for which usage rights have been changed (to which rights have been added or deleted) due to the change in the user attributes. The control unit 203 may then search the SaaS table 2022 based on the acquired SaaSID to acquire information regarding the SaaS for which the user's usage rights have been changed due to the change in the user attributes. The control unit 203 may present the acquired information to the administrative user. In this way, when the user's attributes are changed due to a transfer, promotion, or the like, the administrative user can efficiently grasp the SaaS that should be installed or deleted from the terminal because usage rights have been added or deleted due to the change in the user attributes.

[0130] Furthermore, the control unit 203 may install SaaS, for which usage rights have been added due to the attribute change, on the terminal, or issue a SaaS usage ID, based on the acquired information. Furthermore, the control unit 203 may uninstall SaaS, for which usage rights have been deleted due to the attribute change, from the terminal, or delete the SaaS usage ID. The installation and uninstallation of SaaS and the issuance and deletion of IDs are realized by any SaaS management technology.

[0131] (Identify your account plan) Regardless of whether or not a user has authorization to use the SaaS, they may be using a free plan with limited functionality to carry out their work. If the SaaS is being used even with limited functionality, it is likely that the user's work efficiency will improve if the organization to which the user belongs officially introduces a paid plan. Therefore, identifying the SaaS plan that a user is using is useful for improving work efficiency within an organization.

[0132] Therefore, the control unit 203 may identify the plan of the account used by the user in the SaaS related to the user's processing. For example, the control unit 203 may identify the plan of the account in the authority determination process in the above embodiment. As an example, the control unit 203 may identify the plan of the account used by the user in the SaaS when it is determined in step S15 that the user does not have the authority to use the SaaS, when it is determined that the user has the authority to use the SaaS, or regardless of the determination result of whether the user has the authority to use the SaaS.

[0133] For example, the control unit 203 may identify the plan of the account that the user is using in the SaaS related to the user's processing, as shown below.

[0134] (Determined by the presence or absence of advertisements) In some SaaS provision formats, advertisements are displayed in the free plan, but the advertisements are hidden by subscribing to a paid plan. Therefore, the control unit 203 determines whether the plan used by the user is a free plan or a paid plan by determining whether or not there are advertisements on the web page related to the SaaS.

[0135] For example, the control unit 203 acquires the source code of a web page associated with a URL received from the terminal device 10 and determines whether or not advertising content is present on the web page. If the control unit 203 detects the presence of advertising content, it determines that the web page associated with the URL accessed by the user is a web page for a free plan, and that the user is using the free plan to use the SaaS. On the other hand, if the control unit 203 cannot detect the presence of advertising content, it determines that the user is using a paid plan to use the SaaS.

[0136] For example, the control unit 203 determines whether or not there is advertising content on a web page by detecting predetermined elements that are likely to be related to advertising content. Examples of predetermined elements are listed below. - Words related to advertising (such as "advertising," "sponsor," "promotion," and "commercial"). For example, they may be included in the text or comment strings. - Advertising-related strings (such as "ad", "advertisement", "sponsored", "promotion", "commercial", and abbreviations of these). For example, they may be included in strings related to external resources in source code or in strings indicating class names. Other strings related to access destinations (URLs, domains, etc.) of external resources related to advertising, as determined in advance by users such as administrators

[0137] The control unit 203 may input the text or source code of a web page related to a URL received from the terminal device 10 into the trained model constructed by machine learning, thereby causing the trained model to output a determination result as to whether or not advertising content is present on the web page. The trained model may be constructed, for example, by performing machine learning using the source code of a web page that actually contains advertising content as training data.

[0138] The control unit 203 may also cause any artificial intelligence system to output a determination result as to whether or not a web page contains advertising content by inputting a prompt including the text or source code of the web page related to the URL received from the terminal device 10 and an instruction to determine whether or not the web page contains advertising content. Examples of the artificial intelligence system include ChatGPT, Google Bard, and Bing AI.

[0139] (Determined based on number of uses) In some SaaS provision forms, there is a limit on the number of times the service can be used under a free plan, but there is no limit on the number of times the service can be used by subscribing to a paid plan. Therefore, the control unit 203 determines whether the plan the user has used is a free plan or a paid plan based on the number of times the user has used the SaaS.

[0140] For example, the control unit 203 determines that the plan used by the user is a free plan in at least one of the following cases: The control unit 203 can identify the number of times a user has used a specific SaaS in a specific period or cycle by referring to the items "Time," "Detected SaaS," and "User ID" in the determination result table 2026, for example. If the total number of uses by the user during a specified period is equal to or exceeds a specified number, and the number of uses is zero after the specified period has elapsed, it will be deemed that the number of free uses has been exceeded and that subsequent use has ceased. If the number of times the user uses the service per specified cycle is less than the specified number of times. In this case, since the free plan limits the number of times the service can be used per specified cycle (e.g., per day), it is determined that the user cannot use the service more than the specified number of times.

[0141] The control unit 203 may present the administrator user with the results of identifying the plan of the account used by the user in the SaaS related to the user's processing. This allows the administrator user to understand that the user is using a free plan of the specified SaaS. Therefore, the administrator user can consider introducing a paid plan of the SaaS to the user. Therefore, the introduction of a paid plan of the SaaS can be efficiently considered.

[0142] The control unit 203 may present the result of identifying the plan for the account to the user.

[0143] The control unit 203 may also aggregate the identification results by SaaS type (for example, by SaaSID) and present the aggregated results to the administrator user. This allows the administrator user to grasp, for example, the total number of users using a free plan for a specific SaaS and the total number of uses. This allows the administrator user to efficiently consider introducing a paid plan for the SaaS.

[0144] The control unit 203 may also receive, from the terminal device 10, information regarding a request to introduce a paid plan in the SaaS related to the user's processing. Specifically, for example, the control unit 203 may display a request button regarding the introduction of the paid plan of the SaaS on the display 141 of the terminal device 10. In this case, when the user presses the request button, the terminal device 10 transmits information regarding the request to introduce the paid plan to the first server 20. The control unit 203 may present the request to the administrator user via the administrator user's terminal. This allows the administrator user to know that the user wishes to introduce a paid plan. Therefore, the introduction of a paid plan of the SaaS can be efficiently considered.

[0145] The control unit 203 may also aggregate requests for introducing paid plans for SaaS related to user processing by SaaS type (for example, by SaaSID) and present the aggregation results to the administrative user. This allows the administrative user to understand the need to introduce a paid plan for the SaaS within the organization. Therefore, the administrative user can efficiently consider introducing a paid plan for the SaaS within the organization.

[0146] <4 Basic computer hardware configuration> 13 is a block diagram showing the basic hardware configuration of a computer 90. The computer 90 includes at least a processor 91, a main memory device 92, an auxiliary memory device 93, and a communication IF (interface) 99. These are electrically connected to each other by a bus.

[0147] The processor 91 is hardware for executing an instruction set written in a program, and is composed of an arithmetic unit, registers, peripheral circuits, and the like.

[0148] The main storage device 92 is used to temporarily store programs, data to be processed by the programs, etc. For example, it is a volatile memory such as a DRAM (Dynamic Random Access Memory).

[0149] The auxiliary storage device 93 is a storage device for saving data and programs, such as a flash memory, a hard disk drive (HDD), a magneto-optical disk, a CD-ROM, a DVD-ROM, or a semiconductor memory.

[0150] The communication IF 99 is an interface for inputting and outputting signals for communicating with other computers via a network using wired or wireless communication standards. The network is composed of the Internet, a LAN, various mobile communication systems constructed by wireless base stations, etc. For example, the network includes 3G, 4G, and 5G mobile communication systems, LTE (Long Term Evolution), and wireless networks (e.g., Wi-Fi (registered trademark)) that can connect to the Internet via a predetermined access point. In the case of a wireless connection, communication protocols include, for example, Z-Wave (registered trademark), ZigBee (registered trademark), and Bluetooth (registered trademark). In the case of a wired connection, the network also includes a direct connection using a USB (Universal Serial Bus) cable, etc.

[0151] It should be noted that the computer 90 can be virtually realized by distributing all or part of each hardware configuration across multiple computers 90 and interconnecting them via a network. In this way, the computer 90 is a concept that includes not only a computer 90 housed in a single housing or case, but also a virtualized computer system.

[0152] <Basic functional configuration of computer 90> A description will be given of the functional configuration of a computer realized by the basic hardware configuration of a computer 90 shown in Fig. 13. The computer includes at least the functional units of a control unit, a storage unit, and a communication unit.

[0153] The functional units of the computer 90 can also be realized by distributing all or part of the functional units among multiple computers 90 interconnected via a network. The computer 90 is a concept that includes not only a single computer 90 but also a virtualized computer system.

[0154] The control unit is realized by the processor 91 reading various programs stored in the auxiliary storage device 93, expanding them in the main storage device 92, and executing processing in accordance with the programs. The control unit can realize functional units that perform various types of information processing depending on the type of program. In this way, the computer is realized as an information processing device that processes information.

[0155] The storage unit is realized by a main storage device 92 and an auxiliary storage device 93. The storage unit stores data, various programs, and various databases. Furthermore, the processor 91 can allocate a storage area corresponding to the storage unit in the main storage device 92 or the auxiliary storage device 93 in accordance with the programs. Furthermore, the control unit can cause the processor 91 to execute processes for adding, updating, and deleting data stored in the storage unit in accordance with the various programs.

[0156] A database refers to a relational database, which manages data sets called tables, which are structured by rows and columns, by relating them to each other. In a database, a table is called a table, a column in a table is called a column, and a row in a table is called a record. In a relational database, relationships between tables can be set and associated. Typically, each table has a column set as a key for uniquely identifying a record, but setting a key to a column is not essential. The control unit can cause the processor 91 to add, delete, or update records in a specific table stored in the storage unit according to various programs.

[0157] The communication unit is realized by the communication IF 99. The communication unit realizes the function of communicating with other computers 90 via a network. The communication unit can receive information transmitted from other computers 90 and input the information to the control unit. The control unit can cause the processor 91 to execute information processing on the received information in accordance with various programs. In addition, the communication unit can transmit information output from the control unit to other computers 90.

[0158] The functions performed by the components described herein may be implemented in circuitry or processing circuitry, including general-purpose processors, application-specific processors, integrated circuits, ASICs (Application Specific Integrated Circuits), a CPU (a Central Processing Unit), conventional circuits, and / or combinations thereof, programmed to perform the described functions. A processor includes transistors and other circuits and is considered to be circuitry or processing circuitry. A processor may also be a programmed processor that executes programs stored in memory. In this specification, a circuitry, unit, or means is hardware that is programmed to realize or performs the described functions, which may be any hardware disclosed herein or any hardware known to be programmed to realize or perform the described functions. If the hardware is a processor considered to be a type of circuitry, the circuitry, means, or unit is a combination of the hardware and software used to configure the hardware and / or processor.

[0159] Although several embodiments of the present disclosure have been described above, these embodiments can be embodied in various other forms, and various omissions, substitutions, and modifications can be made without departing from the spirit of the invention. These embodiments and modifications are intended to be included in the scope of the inventions and their equivalents as defined in the claims, as well as in the scope and spirit of the inventions.

[0160] <Additional Notes> The matters described in the above embodiments will be supplemented below. (Appendix 1) A program to be executed by a computer having a processor and memory, the program causing the processor to execute the following steps: acquiring information regarding a process of a terminal device that is executed by a user operating the terminal device; acquiring information regarding the attributes of the user in the organization to which the user belongs and information regarding the service related to the process based on the acquired information regarding the process; and determining whether the user has authority to use the service based on the information regarding the attributes and the information regarding the service related to the process. (Appendix 2) 2. The program according to claim 1, wherein the program causes the processor to execute a step of presenting the result of the judgment to a user via a terminal device. (Appendix 3) The program according to claim 1, wherein the program causes the processor to execute a step of presenting the result of the judgment to an administrator user who manages at least one of the user and the user's terminal device via the administrator user's terminal device. (Appendix 4) 2. The program of claim 1, wherein the program causes the processor to execute a step of restricting access to resources related to the service on the user's terminal if it is determined in the determining step that the user does not have authorization to use the service. (Appendix 5) 2. The program of claim 1, wherein the program causes the processor to execute a step of restricting the operation of an application related to the service on the user's terminal if it is determined in the determining step that the user does not have permission to use the service. (Appendix 6) The program described in Appendix 1 causes a processor to execute the steps of acquiring information regarding the attributes of a specified user in an organization to which the specified user belongs, acquiring information regarding services for which the specified user has access rights based on the information regarding the attributes of the specified user, and presenting the acquired information regarding services for which the specified user has access rights to an administrator user who manages at least one of the specified user and the specified user's terminal device via the administrator user's terminal device. (Appendix 7) The program described in Appendix 6 causes a processor to execute the steps of acquiring information regarding changes in the attributes of a specified user, acquiring information regarding changes in the usage rights of the specified user resulting from the attribute changes, and presenting the acquired information regarding changes in the usage rights of the specified user to an administrator user via the administrator user's terminal device. (Appendix 8) A method executed by a computer having a processor, the method comprising the steps of: acquiring information about a process of a terminal device that is executed by a user operating the terminal device; acquiring information about the user's attributes in the organization to which the user belongs and information about the service related to the process based on the acquired information about the process; and determining whether the user has permission to use the service based on the information about the attributes and the information about the service related to the process. (Appendix 9) An information processing device having a control unit, wherein the control unit executes the steps of: acquiring information regarding a process of a terminal device that is executed by a user operating the terminal device; acquiring information regarding the attributes of the user in the organization to which the user belongs and information regarding the service related to the process based on the acquired information regarding the process; and determining whether the user has authorization to use the service based on the information regarding the attributes and the information regarding the service related to the process. (Appendix 10) A system having a control unit and a memory unit, comprising the steps of: acquiring information regarding processing of a terminal device that is executed by a user operating the terminal device; acquiring information regarding the attributes of the user in the organization to which the user belongs and information regarding the service related to the processing based on the acquired information regarding the processing; and determining whether the user has authority to use the service based on the information regarding the attributes and the information regarding the service related to the processing. [Explanation of symbols]

[0161] 1. System 10...Terminal device 120…Communications Department 13...Input device 131...Touch-sensitive devices 14...Output device 15...Memory 16…Storage 19...Processor 20...First server 22...Communication IF 23...Input / output interface 25…Memory 26…Storage 29...Processor 30...Second server

Claims

1. A program to be executed by a computer having a processor and a memory, the program causing the processor to: acquiring information about a process of a terminal device that is executed by a user operating the terminal device; acquiring information about the attributes of the user in the organization to which the user belongs and information about a service related to the process based on the acquired information about the process; determining whether the user has authorization to use the service based on the information about the attribute and the information about the service related to the processing; A program that executes the following.

2. The program causes the processor to: presenting the result of the determination to the user via the terminal device; The program according to claim 1, which causes the program to execute the following.

3. The program causes the processor to: a step of presenting the result of the determination to an administrator user who manages at least one of the user and the user's terminal device via the administrator user's terminal device; The program according to claim 1, which causes the program to execute the following.

4. The program causes the processor to: a step of restricting access to resources related to the service from the user's terminal when it is determined in the determining step that the user does not have authorization to use the service; The program according to claim 1, which causes the program to execute the following.

5. The program causes the processor to: a step of restricting the operation of an application related to the service on the user's terminal when it is determined in the determining step that the user does not have the authority to use the service; The program according to claim 1, which causes the program to execute the following.

6. The program causes the processor to: acquiring information about attributes of a predetermined user in an organization to which the predetermined user belongs; acquiring information about services for which the predetermined user has a usage right based on information about the attributes of the predetermined user; presenting the acquired information about the service for which the predetermined user has a usage right to an administrator user who manages at least one of the predetermined user and the terminal device of the predetermined user via the terminal device of the administrator user; The program according to claim 1, which causes the program to execute the following.

7. The program causes the processor to: obtaining information regarding changes in the attributes of the predetermined user; acquiring information regarding a change in the user's authorization resulting from the change in the attribute; presenting the acquired information regarding the change of the usage authority of the predetermined user to the administrator user via a terminal device of the administrator user; The program according to claim 6, which causes the program to execute the following.

8. 1. A computer-implemented method comprising a processor, the processor comprising: acquiring information about a process of a terminal device that is executed by a user operating the terminal device; acquiring information about the attributes of the user in the organization to which the user belongs and information about a service related to the process based on the acquired information about the process; determining whether the user has authorization to use the service based on the information about the attribute and the information about the service related to the processing; How to do it.

9. An information processing device including a control unit, the control unit acquiring information about a process of a terminal device that is executed by a user operating the terminal device; acquiring information about the attributes of the user in the organization to which the user belongs and information about a service related to the process based on the acquired information about the process; determining whether the user has authorization to use the service based on the information about the attribute and the information about the service related to the processing; An information processing device that executes the above.

10. A system including a control unit and a storage unit, acquiring information about a process of a terminal device that is executed by a user operating the terminal device; acquiring information about the attributes of the user in the organization to which the user belongs and information about a service related to the process based on the acquired information about the process; determining whether the user has authorization to use the service based on the information about the attribute and the information about the service related to the processing; A system comprising:

Images