JPH0789351B2 - Security management processing method - Google Patents

Description

DETAILED DESCRIPTION OF THE INVENTION [Overview] Regarding security management of a computer system having resources shared by a plurality of users, a user who executes a job and resources available for the job are managed in a business-oriented manner. In a computer system that has resources that can be shared by multiple users for the purpose of easy security management processing, for each required task, a task identifier, an authorized user identifier, and the sharable resource And a means for searching the permission list corresponding to the permission identification name when the user inputs the user identification name and the permission identification name, The business knowledge specified in the permission list is provided on condition that the input user identification name is specified in the permitted user identification name specified in the retrieved permission list. And means for initiating the execution of the business determined by name, the resources used during execution of the work, be configured to provide a means to limit the scope of said resource distinguished name as specified in 該許 allowed list.

[Industrial application field]

The present invention relates to security management of a computer system having resources shared by a plurality of users, and more particularly to a security management processing method for managing users who execute a job and resources available in the job in a business-oriented manner. Regarding

In a computer system shared by a plurality of users, it is generally necessary to manage so-called security, such as confidentiality of data contents and prevention of unauthorized tampering, for shared resources such as programs and data.

[Conventional technology]

FIG. 2 is a block diagram showing a configuration example of a computer system.

A user of the computer system inputs a required command or the like from the terminal 2 connected to the processing device 1, specifies a program necessary for a job from the program file 4 stored in the storage device 3, and executes the program. Required data of the data file 5 stored in the storage device 3 or data input from the terminal 2 is processed to update the file and the necessary processing result is output to the terminal 2.

When performing security management in such a system, for example, when the user first accesses the system from the terminal 2, the security control unit 6 requests the input of the user identification name and the user password, and the correspondence between the both inputs is made. Only when it can be confirmed by the user management list 7, the start of business processing is permitted, and when the user identification name and the user password do not correspond, access to the system is refused, and thus the user can access the system. It is confirmed that the user is a user registered in advance in the user management list 7.

Next, when the user runs the required program for the business and requests access by specifying those file names in order to access the necessary data files,
If these files are files that require security management, the security control unit 6 requests the file password for each file.

The security control unit 6 checks whether each file password entered by the user corresponds to each file name in the file management list 8 and accesses the file only if the correct file password corresponding to the file name is entered. In this way, a legitimate user registered in the system can manage the file password so that it can access only the file for which he is informed.

[Problems to be Solved by the Invention]

The security management processing method as described above is suitable for a computing center or the like that is used individually by each user, and is flexible in management, but if security management is to be performed in detail, it will be a complicated operation for the user. There is a problem that comes to demand.

In particular, when a medium-sized computer system, which has been increasing in recent years, is used by a person in one office for a relatively wide range of work, the operation required by the user is simple and appropriate. A method capable of effective security management is desired.

The present invention is a security management processing method that is based on the business that each user executes using a computer, and that easily manages the users who execute the business and the resources available for the business in a business-oriented manner. With the goal.

[Means for Solving the Problems]

 FIG. 1 is a block diagram showing the configuration of the present invention.

The figure shows the configuration of a computer system, 11 of a processing device 10 is an access control unit that determines whether or not to execute a task specified by a user who accesses the system by searching a permission list 12 stored in a storage device 15, 13 Is an execution control unit that monitors and controls the use of resources by the permission list 12a corresponding to the business during the execution of the business.

[Work]

In the permission list 12, a business identification name, an authorized user identification name, and a resource identification name of a required resource among sharable computer resources are specified for each predetermined business.

When the user performs a certain task, the user identification name and the permission identification name are input from the terminal 2 and the access control unit 11
Searches the permission list corresponding to the entered authorization identifier, and checks whether the entered user identifier is specified as the authorized user identifier in the authorization list,
If there is a corresponding authorized user identification name, the contents of the permission list are passed to the execution control unit 13 as the permission list 12a to start the work.

The execution control unit 13 starts the execution of the work determined by the work identification name specified in the permission list, and determines the resources used during the execution of the work within the range of the resource identification names specified in the permission list 12a. Control to be limited to.

With the above processing method, when the user always accesses the system, in addition to his or her own user identification name, it is sufficient to know only the authorization identification name for each required job. With the list, it is possible to limit the resources used as necessary to maintain security.

〔Example〕

In the computer system to which the security management according to the present invention is applied, in principle, a user identification name is set for each user. Further, one or more permission identifiers are provided for each job requiring security management, which is classified in consideration of security management, and the permission list 12 is set in correspondence with each job.

As a general rule, those user identifiers and authorized identifiers should not be disclosed, and should be operated so that only necessary users are notified.

Each permission list 12 includes a business identification name for each business, a permitted user identification name composed of one or more user identification names indicating users who are permitted to execute the business, and shareable computer resources. Set the resource identifiers of the required resources for each.

The computer resources in question here are, for example, data files, programs or commands (programs that execute commands), etc., and file names, command names, library names that specify a library that is a set of files, etc. By designating designated files such as the program file 4 and the data file 5, the use of only the resources designated in the permission list 12 is controlled.

When the user executes a certain task, the user identification name and the permission identification name are input from the terminal 2.

The access control unit 11 receives the input and searches the permission list corresponding to the input permission identifier. For this purpose, for example, the access control unit 11 holds a correspondence table of the permission identification name and the storage address of the permission list, and scans the required permission identification name from the correspondence table.

If there is a corresponding permission list, it is checked whether the entered user identification name is used as the permission user identification name in the permission list 12, and if it is permitted, the permission list is used to start the business. Is passed to the execution control unit 13 as the permission list 12a. If there is no corresponding permission list or there is no corresponding authorized user identification name, access is denied to the user.

The execution control unit 13 starts the execution of the work defined by the work identification name specified in the permission list 12a. This job start can be performed by a normal procedure by using the job control information registered with the job identification name as the job name, for example.

When the work is started, the execution control unit 13 is given control in order to monitor the work in progress each time a request for a new resource is generated in the work, and specifies the requested resource in the permission list 12a. Check with reference to the registered resource identification name, and if permitted, return control to proceed with business processing. When an unauthorized resource is requested, a process such as interrupting the execution of the task is performed.

〔The invention's effect〕

As is apparent from the above description, according to the present invention, in a computer system having a shared resource of a plurality of users, a user who executes a job and resources that can be used in the job are managed in a job-oriented manner, Since the user can perform the required level of security management for each job simply by presenting the authorization identification name that specifies the job, there is a remarkable industrial effect of improving the security and usability of the computer system. .

[Brief description of drawings]

 FIG. 1 is a block diagram showing the configuration of the present invention, and FIG. 2 is a block diagram showing a conventional configuration example. In the figure, 1 and 10 are processing devices, 2 are terminals, 3 and 15 are storage devices, 4 are program files, 5 is data files, 6 is a security control unit, 7 is a user management list, 8 is a file management list, 11 is an access control unit, 12 and 12a are permission lists, and 13 is an execution control unit.

Claims (1)

[Claims] 1. A computer system having resources that can be shared by a plurality of users, for each required business, a business identification name, an authorized user identification name,
And a permission list (12) for designating a resource identification name of a required resource among the sharable resources, and corresponding to the permission identification name when the user inputs the user identification name and the permission identification name A means (11) for searching the permission list, and the permission list (11) provided that the input user identification name is designated as the permitted user identification name designated in the retrieved permission list. A means (11, 1) for starting the execution of the business determined by the business identification name specified in 12)
3) and the resources used during the execution of the business are listed in the permission list (12).
And a means (13) for limiting the range of the resource identification name designated by the security management processing method.