JP2008198125A - Information processing terminal and information management system - Google Patents

Abstract

User management is realized with a relatively simple configuration.
A user with a user ID “UID-A” logs in to a host device 10 (SA1), a user with a user ID “UID-X” logs in to an information processing terminal 20 (SA2), and these are connected. (SA3). The host device 10 transmits user information including the terminal ID and the user ID “UID-A” (SA4), and the information processing terminal 20 transmits user information including the terminal ID and the user ID “UID-X” ( SA5). Then, the host device 10 and the information processing terminal 20 generate a user management table in which the user ID “UID-A” is associated with the user ID “UID-X” (SA6, SA7). In this way, the information management system 1 manages accessible information according to the user ID, so that user management can be easily realized.
[Selection] Figure 10

Description

  The present invention relates to a technique for performing user management.

Various mechanisms have been proposed as techniques for managing functions and services provided to users in units of users or groups. For example, in Patent Document 1, in order to prevent information managed for each user from leaking to an unauthorized third party, a user to be used is set in advance for each device on the network. A technology is disclosed in which only a user can use a corresponding device or only a corresponding function can be used.
JP 2001-31474 A

However, in the method of Patent Document 1, it is necessary to separately provide a device for managing devices on the network, and there is a problem that the configuration of the system becomes complicated or the cost increases.
The present invention has been made in view of such circumstances, and an object thereof is to realize user management with a relatively simple configuration.

  In order to achieve the above-described object, the present invention provides an authentication information storage that stores first user identification information assigned to each user and authentication information for authenticating each user in association with each other. Means, input means for inputting authentication information, authentication information input in the input means and authentication information stored in the authentication information storage means, and the first information corresponding to the matched authentication information Authentication means for specifying user identification information, and receiving means for receiving second user identification information different from the first user identification information during a period in which the first user identification information is specified by the authentication means. And management information storage for storing the first user identification information specified by the authentication means and the second user identification information received by the reception means in association with each other And the second user identification information stored in the management information storage means is assigned while the processing permitted for the user of the first user identification information specified by the authentication means is executed. An information processing terminal comprising: an execution unit that executes processing permitted to the user of the first user identification information corresponding to the second user identification information. To do.

  The execution means permits the user of the first user identification information specified by the authentication means to access information associated with the first user identification information, and performs processing according to the access. On the other hand, a user assigned with the second user identification information stored in the management information storage means is associated with the first user identification information corresponding to the second user identification information. It is desirable to permit access to information and execute processing according to the access.

  In addition, the storage unit includes a plurality of storage areas, and each storage area includes storage means associated with different first user identification information, and the execution means is the first specified by the authentication means. The user of the user identification information is allowed to access the storage area associated with the first user identification information, and the process corresponding to the access is executed while being stored in the management information storage means Access to the storage area associated with the first user identification information corresponding to the second user identification information is permitted for a user to which the second user identification information is assigned, and the user is allowed to respond to the access. Alternatively, the process may be executed.

  Further, when the receiving means receives the second user identification information during a period in which the first user identification information is specified by the authentication means, the first user identification information is associated with the first user identification information. When the second user identification information is already stored, the management information storage means stores the second user identification information stored in association with the first user identification information and the received first user identification information. Even if the user identification information is different from the second user identification information, when it can be confirmed that the users to which the second user identification information is assigned are the same, the user identification information is associated with the first user identification information. Instead of the second user identification information, the second user identification information received by the receiving means may be stored.

  Further, when the receiving means receives the second user identification information during a period in which the first user identification information is specified by the authentication means, the first user identification information is associated with the first user identification information. When the second user identification information is already stored, the management information storage means receives the second user identification information stored in association with the first user identification information and the reception means. When the second user identification information is different from the second user identification information, the second user identification information received by the receiving unit may not be stored.

  The receiving means receives the second user identification information different from each of a plurality of information processing terminals to which different terminal identification information is assigned, and the management information storage means is specified by the authentication means. The first user identification information is associated with the second user identification information received by the receiving unit and the terminal identification information assigned to the information processing terminal that is the transmission source of the second user identification information. And the execution means executes a process permitted for the user of the first user identification information specified by the authentication means, while a plurality of second information stored in the management information storage means 2 to which the user identification information of 2 is assigned, the user of the first user identification information corresponding to each of the second user identification information is permitted. It may be executed a process are.

  Further, it is desirable that the receiving means receives the second user identification information in accordance with a USB (Universal Serial Bus) standard.

  Also, the input means for inputting authentication information corresponding to the second user identification information, the authentication information input by the input means, and the first user identification information specified by the authentication means. Collating means for collating authentication information, and the management information storage means, when it is determined by the collating means that the respective authentication information matches, the first user identification information and the second user identification It is desirable to store information in association with each other.

  The present invention is also an information management system comprising an information processing terminal and a host device, wherein the information processing terminal authenticates the first user identification information assigned to each user and each user. Authentication information storage means for storing the authentication information in association with each other, input means for inputting authentication information, authentication information input in the input means, and authentication information stored in the authentication information storage means The first user identification information is verified during the period when the first user identification information is identified by the authentication means, and the authentication means for identifying the first user identification information corresponding to the matched authentication information. Receiving means for receiving second user identification information different from the first user identification information specified by the authentication means, and the first user identification information specified by the authentication means. Management information storage means for storing the user identification information in association with each other and processing permitted for the user of the first user identification information specified by the authentication means, while the management information storage For a user assigned with the second user identification information stored in the means, an execution for executing a process permitted by the user of the first user identification information corresponding to the second user identification information And the host device uses, as the second user identification information, an authentication unit that performs user authentication, and user identification information assigned to the user authenticated by the authentication unit as the second user identification information. And an information management system characterized by comprising a transmission means for transmitting data.

Next, the best mode for carrying out the present invention will be described.
(1) Configuration of Embodiment FIG. 1 is a block diagram showing a configuration of an information management system 1 according to an embodiment of the present invention. As shown in FIG. 1, the information management system 1 includes a host device 10 and an information processing terminal 20. The host device 10 is a personal computer, for example. The information processing terminal 20 may be any terminal that can be connected to the host device and stores information. For example, the information processing terminal 20 may be an auxiliary storage terminal called a USB memory or a display terminal called electronic paper. Further, it may be a portable computer device such as a PDA (Personal Digital Assistants) or a notebook computer. The information processing terminal 20 includes a connection interface such as a USB connector. By connecting this USB connector to the USB port on the host device 10 side, both can exchange data with each other in accordance with the USB standard.

Next, the configuration of the host device 10 will be described.
FIG. 2 is a block diagram illustrating a hardware configuration of the host device 10. As shown in FIG. 1, the host device 10 includes a CPU (Central Processing Unit) 11, a ROM (Read Only Memory) 12, a RAM (Random Access Memory) 13, a storage unit 14, a USB controller 15, and a USB. A port 16, an operation unit 17, a display unit 18, and a fingerprint reading device 19 are provided. The storage unit 14 is, for example, a hard disk, and performs user management with a group of files such as various computer programs and document files, fingerprint data for performing user authentication, a host authentication table, and the information processing terminal 20. A host user management table for common use is stored. The CPU 11 reads out a computer program stored in the ROM 12 or the storage unit 14, loads it into the RAM 13, and executes it to control each unit of the host device 10.

  The USB controller 15 transmits / receives data to / from a USB controller 21 provided in the information processing terminal 20 described later under the control of the CPU 11. The USB port 16 is connected to a USB connector 23 of the information processing terminal 20 described later directly or via a USB cable. The operation unit 17 includes various keys and outputs a signal corresponding to the pressed key to the CPU 11. The display unit 18 is, for example, a liquid crystal display, and displays a menu screen for operating the host device 10 and various screens such as file contents and profile information stored in the storage unit 14 under the control of the CPU 11. To do. The fingerprint reading device 19 reads a user's fingerprint and supplies the fingerprint data to the CPU 11 as authentication information for user authentication. That is, the fingerprint reading device 19 is a means for inputting authentication information. The CPU 11 performs user authentication using the authentication information, the host authentication table and fingerprint data stored in the storage unit 14. And if a user is specified by this user authentication, CPU11 will perform the process permitted beforehand with respect to the user. For example, when the access authority of the user is determined for each file, the CPU 11 permits the authenticated user to access a file that is permitted in advance, and displays or edits the file according to the access. Processing will be executed.

FIG. 3 shows an example of the contents of the host authentication table.
As shown in FIG. 3, in the host authentication table, “user ID” and “fingerprint ID” are described in association with each other. “User ID” is identification information assigned to each user by the CPU 11. “Fingerprint ID” is identification information assigned to the fingerprint data representing the fingerprint of each user by the CPU 11. In the following, the user assigned the user ID “UID-A” in the figure is called “user A”, and the fingerprint ID of the fingerprint data is called “fingerprint A”. Similarly, a user assigned with a user ID “UID-B” is called “user B”, a fingerprint ID of the fingerprint data is called “fingerprint B”, and a user ID “UID-C” is assigned. The user is called “user C”, and the fingerprint ID of the fingerprint data is called “fingerprint C”.

  Fingerprint data corresponding to the identification information is read by the fingerprint reading device 19 at the time of fingerprint registration, and is stored in the storage unit 14 in association with each fingerprint ID by the CPU 11. The CPU 11 collates the fingerprint data stored in the storage unit 14 with the fingerprint data read by the fingerprint reading device 19 at the time of user authentication. If the fingerprint data stored in the storage unit 14 includes fingerprint data read by the fingerprint reading device 19, the CPU 11 identifies the user ID corresponding to the fingerprint ID, and identifies the user with the user ID. The login is permitted.

Profile information is associated with each file stored in the storage unit 14. In this profile information, in addition to various attributes of the file, an access right to the own file is described.
Here, FIG. 4 exemplifies profile information of the file name “file a”, for example. The content of FIG. 4 represents that the users A and B have the access right to the file a, while the user C does not have the access right. When a user having access rights requests processing such as reading from the storage unit 14 and writing to the storage unit 14 for the file a, the host device 10 performs the requested processing. Even if the above request is made by a user who does not have the password, the host device 10 does not respond to the request and does not perform processing.

Next, FIG. 5 is a diagram illustrating the contents of the host user management table.
Each of the host device 10 and the information processing terminal 20 assigns a user ID to a new user according to a unique method. In the host user management table, “user ID” assigned to each user by the host device 10 and “user ID” assigned to each user by the information processing terminal 20 are described in association with each other. The users assigned the corresponding user ID are the same person. Furthermore, the “user ID” assigned to each user by the information processing terminal 20 is associated with the “terminal ID” assigned to the information processing terminal 20. For example, the terminal ID “01” is a terminal ID assigned to the information processing terminal 20. In FIG. 5, the user A managed by the host device 10 is the user X managed by the information processing terminal 20, and the user B managed by the host device 10 is managed by the information processing terminal 20. In this example, the user Y is a user Y and the user C managed by the host device 10 is the user Z managed by the information processing terminal 20.

Next, the configuration of the information processing terminal 20 will be described.
FIG. 6 is a block diagram illustrating a hardware configuration of the information processing terminal 20. As shown in FIG. 6, the information processing terminal 20 includes a USB controller 21, a flash ROM 22, a USB connector 23, a controller 24, a fingerprint reading device 25, a dedicated flash ROM 26, a RAM 27, and a bus 28. . The USB controller 21 transmits and receives data to and from the USB controller 15 provided in the host device 10 while complying with the USB standard under the control of the CPU 11. The flash ROM 22 includes a plurality of nonvolatile memory devices (hereinafter referred to as “memory devices”) 221 such as an EEPROM (Electrically Erasable and Programmable Read Only Memory) and a flash memory, and a memory switching module 222.

Here, FIG. 7 is a diagram schematically showing the configuration of the flash ROM 22.
As shown in FIG. 7, the memory module 221 includes a shared memory device 221P, a user X dedicated memory device 221X, a user Y dedicated memory device 221Y, and a user Z dedicated memory device 221Z, which are memory switching modules 222. Is connected to the bus 28. A file FP is stored in the storage area of the shared memory device 221P, and all users who log in to the host device 10 or the information processing terminal 20 can access the file FP. The file FX is stored in the storage area of the user X dedicated memory device 221X. The user X dedicated memory device 221X is associated with the user ID “UID-X”, and only the user to which the user ID is assigned can access the file FX. Similarly, the file FY is stored in the “user Y dedicated memory device 221Y”, and only the user with the user ID “UID-Y” can access the file FY, and the “user Z dedicated memory device 221Z” is accessible. The file FZ is stored in the storage area, and only the user with the user ID “UID-Z” can access the file FZ.

  The memory switching module 222 connects or disconnects any one of the shared memory device 221P, the user X dedicated memory device 221X, the user Y dedicated memory device 221Y, and the user Z dedicated memory device 221Z to the bus 28. It has a function. That is, the user of the host device 10 can refer to the file stored in the memory device connected to the bus 28 by the memory module 22, but cannot access the memory device disconnected from the bus 28. The memory switching module 222 always connects the shared memory device 221 </ b> P and the bus 28, and connects the memory device assigned to the user who has logged in to the information processing terminal 20 and the bus 28. Thereby, for example, the user with the user ID “UID-Y” can access the file FP stored in the shared memory device 221P and the file FY stored in the user Y dedicated memory device 221Y. Access to FX and FZ is impossible.

The shared memory device 221P of the flash ROM 22 stores a terminal user management table having the same structure as the host user management table of the host device 10.
FIG. 8 is a diagram illustrating the contents of the terminal user management table stored in the flash ROM 22. In this terminal user management table, a “user ID” assigned to each user by the information processing terminal 20 and a “user ID” assigned to each user by the host device 10 are described in association with each other. The “user ID” assigned to each user by the host device 10 is associated with the “terminal ID” assigned to the host device 10. For example, the terminal ID “02” is a terminal ID assigned to the host device 10. FIG. 8 illustrates an example in which the user with the user ID “UID-X” managed by the information processing terminal 20 is the user with the user ID “UID-A” managed by the host device 10. The same applies to users with user IDs “UID-Y” and “UID-Z”.

  The USB connector 23 is detachable from the USB port 16 of the host device 10. The controller 24 controls the fingerprint reading device 25 and the dedicated flash ROM 26 in order to authenticate the user by fingerprint authentication. The RAM 27 is a work area for work of the controller 24. The fingerprint reading device 25 has the same configuration as the fingerprint reading device 19 of the host device 10. The dedicated flash ROM 26 is a nonvolatile memory device such as an EEPROM or a flash memory, and stores a terminal authentication table and fingerprint data.

FIG. 9 shows an example of the contents of the terminal authentication table.
As shown in FIG. 9, in the terminal authentication table, “user ID” and “fingerprint ID” are described in association with each other. “User ID” is identification information assigned to each user by the controller 24. “Fingerprint ID” is identification information assigned to fingerprint data representing the fingerprint of each user by the controller 24. In the following, the user assigned the user ID “UID-X” in the figure is called “user X”, and the fingerprint ID of the fingerprint data is called “fingerprint X”. Similarly, a user assigned with user ID “UID-Y” is called “user Y”, a fingerprint ID of the fingerprint data is called “fingerprint Y”, and a user assigned with user ID “UID-Z” is called It is called “user Z”, and the fingerprint ID of the fingerprint data is called “fingerprint Z”.

  Fingerprint data corresponding to these identification information is read by the fingerprint reading device 25 at the time of fingerprint registration, and is stored in the dedicated flash ROM 26 in association with each fingerprint ID by the controller 24. The controller 24 collates the fingerprint data stored in the dedicated flash ROM 26 with the fingerprint data read by the fingerprint reading device 25 at the time of user authentication. Then, if there is fingerprint data read by the fingerprint reading device 25 in the fingerprint data stored in the dedicated flash ROM 26, the controller 24 identifies the user ID corresponding to the fingerprint ID, and the user of the user ID Will be allowed to log in.

(2) Operation of Embodiment Next, the operation of the embodiment will be described. The authentication table shown in FIGS. 3 and 9 is used.
(2-1) Operation example 1
FIG. 10 is a sequence diagram showing a flow of processing executed by the host device 10 and the information processing terminal 20 in the information management system 1.
In FIG. 10, the operator (user) logs in to the host device 10 and the information processing terminal 20, respectively. First, when the operator logs in to the host device 10, the fingertip of the operator is brought into contact with the fingerprint reading device 19 of the host device 10. In response to this, the CPU 11 of the host device 10 causes the fingerprint reading device 19 to read the fingerprint of the fingertip. Then, the CPU 11 collates the fingerprint data stored in the storage unit 14 with the fingerprint data supplied from the fingerprint reading device 19. When the CPU 11 confirms that there is matching fingerprint data, the CPU 11 identifies the user ID “UID-A” in accordance with the contents of the host authentication table of FIG. 3, and permits login of the user with the user ID ( Step SA1).

On the other hand, when the operator logs in to the information processing terminal 20, the fingertip of the operator is brought into contact with the fingerprint reading device 25 of the information processing terminal 20. In response to this, the controller 24 of the information processing terminal 20 causes the fingerprint reading device 19 to read the fingerprint of the fingertip. Then, the controller 24 collates the fingerprint data stored in the dedicated flash ROM 26 with the fingerprint data supplied from the fingerprint reading device 25 based on the terminal authentication table. When the controller 24 confirms that there is matching fingerprint data, the controller 24 identifies the user ID “UID-X” in accordance with the terminal authentication table of FIG. 9, and permits the login of the user with the user ID (step). SA2).
In this way, the same operator logs in to the host device 10 and the information processing terminal 20 as users with different user IDs. Note that the login timing of both of them does not have to be the host device 10 side first and the information processing terminal 20 side later, and may be in the reverse order (the same applies to operation examples 2 and 3 described later).

  In a state in which the host device 10 and the information processing terminal 20 are logged in (that is, in a period in which a user ID logged in by user authentication in the host device 10 and the information processing terminal 20 is specified), the host device 10 When the USB connector 23 of the information processing terminal 20 is attached to the USB port 16, the host device 10 and the information processing terminal 20 recognize that they are connected to each other, and become communicable (step SA3). Then, the CPU 11 of the host device 10 transmits user information including the terminal ID “02” of the own device and the user ID “UID-A” logged in at the own device to the information processing terminal 20 (step SA4). . On the other hand, the USB controller 21 of the information processing terminal 20 transmits user information including the terminal ID “01” of the own device and the user ID “UID-X” logged in to the own device to the host device 10 (step SA5). ). Then, the CPU 11 uses the field of the terminal ID “01” in the host user management table as shown in the first line of FIG. 5 to use the user ID “UID-A” and the user ID “UID-X”. ”In association with each other (step SA6). Similarly, the controller 24 uses the field of the terminal ID “02” in the terminal user management table as shown in the first line of FIG. 8 to use the user ID “UID-X” and the user ID “UID”. -A "is described (updated) in association with it (step SA7). In response to this update processing, the controller 24 controls the memory switching module 222 to connect the user X dedicated memory device 221X and the bus 28.

Here, it is assumed that the operator operates the operation unit 17 of the host device 10 to instruct to transmit the file a stored in the storage unit 14 to the information processing terminal 20. When accepting this operation (step SA8), the CPU 11 reads the profile information of the file a from the storage unit 14 and determines whether or not the user to whom the user ID “UID-A” is assigned has the access right (step S11). SA9). As shown in FIG. 4, since the user with the user ID “UID-A” has an access right to the file a (step SA9; YES), the CPU 11 permits the user A to access the file a, and this is information. It transmits to the processing terminal 20 (step SA10). On the other hand, in the information processing terminal 20, since the user ID “UID-A” and the user “UID-X” are associated with each other in step SA7, the shared memory device 221P or the user ID “UID-X” is associated. The file a is stored in one of the user X dedicated memory devices 221X accessible by the user (step SA11).
In step SA10 described above, if the CPU 11 determines that the user A does not have access rights to the file for which the transmission instruction has been accepted (step SA9; NO), the process is terminated without transmitting the file.

  As described above, the host device 10 can transmit a file to which the logged-in user has access rights to the information processing terminal 20, while the information processing terminal 20 assigns the file to the logged-in user. Stored in the designated storage area. That is, in the information processing terminal 20, the user ID “UID-A” corresponding to the user ID “UID-A” is assigned to the user A assigned the user ID “UID-A” (second user identification information). The process permitted to the user X of “X” (first user identification information) is executed.

  Further, it is assumed that the operator operates the operation unit 17 of the host device 10 to instruct to request reading of a file stored in the flash ROM 22 of the information processing terminal 20. When accepting this operation (step SA12), the CPU 11 transmits a file read request to the information processing terminal 20 (step SA13). In the information processing terminal 20, since the user ID “UID-X” and the user “UID-A” are associated with each other in Step SA7 described above, the user with the user ID “UID-A” can share the shared memory device 221P. The user X dedicated memory device 221X accessible by the user with the user ID “UID-X” can be accessed, and the file FP and the file FX stored therein can be read out. However, the file FP stored in the shared memory device 221P is limited to the file FP that is allowed to be accessed by the user X according to the profile information described with reference to FIG. 4 (the same applies to operation examples 2 and 3 described later). When the controller 24 reads a file in accordance with a user instruction from an accessible memory device in the flash ROM 22 (step SA14), the controller 24 transmits the file to the host device 10 (step SA15). The CPU 11 of the host device 10 displays characters and images representing the contents of this file on the display unit 18 (step SA16).

  As described above, the host device 10 reads the file from the memory device in the information processing terminal 20 to which the user who has logged in to the device has the access right, and displays the file on the display unit 18 or stores the file in the storage unit 14. can do. That is, in the host device 10, the user ID “UID-X” corresponding to the user ID “UID-A” is assigned to the user A assigned the user ID “UID-A” (second user identification information). ”(First user identification information) is permitted to the user X.

(2-2) Operation example 2
Next, one of the user ID of the user who has logged into the host device 10 and the user ID of the user who has logged into the information processing terminal 20 is already different from another user ID in the host user management table and the terminal user management table. The operation at the time of matching will be described.

FIG. 11 is a sequence diagram showing a flow of processing executed by the host device 10 and the information processing terminal 20 in the information management system 1.
In the following description, after the user ID “UID-A” is assigned in the information processing terminal 20, the operator discards the user ID and newly assigns a user ID “UID-B”. Shall be. Then, while the user ID “UID-A” is assigned to the operator, “UID-A” and user ID “UID-X” are already associated with each other in the procedure described in the operation example 1. It shall be. After that, it is assumed that the operator logs in to the host device 10 as the user with the user ID “UID-B”.

  When the fingertip of the operator touches the fingerprint reading device 19, the CPU 11 of the host device 10 causes the fingerprint reading device 19 to read the fingerprint. Then, the CPU 11 reads the fingerprint data stored in the storage unit 14 according to the host authentication table, and collates it with the fingerprint data supplied from the fingerprint reading device 19. If the CPU 11 confirms that there is matching fingerprint data, the CPU 11 identifies the user ID “UID-B” in accordance with the host authentication table of FIG. 3 and permits the login of the user with the user ID. (Step SB1).

  On the other hand, when the operator logs in to the information processing terminal 20, the fingertip of the operator is brought into contact with the fingerprint reading device 25 of the information processing terminal 20. In response to this, the controller 24 of the information processing terminal 20 causes the fingerprint reading device 19 to read the fingerprint of the fingertip. Then, the controller 24 collates the fingerprint data stored in the dedicated flash ROM 26 with the fingerprint data supplied from the fingerprint reading device 25 based on the terminal authentication table. When the controller 24 confirms that there is matching fingerprint data, the controller 24 identifies the user ID “UID-X” in accordance with the terminal authentication table of FIG. 9, and permits the login of the user with the user ID (step). SB2).

  When the USB connector 23 of the information processing terminal 20 is attached to the USB port 16 of the host device 10 while the host device 10 and the information processing terminal 20 are logged in, the host device 10 and the information processing terminal 20 are connected. Is recognized and communication is possible (step SB3). Then, the CPU 11 of the host device 10 transmits user information including the terminal ID “02” of the own device and the user ID “UID-B” logged in at the own device to the information processing terminal 20 (step SB4). . On the other hand, the USB controller 21 of the information processing terminal 20 transmits user information including the terminal ID “01” of the own device and the user ID “UID-X” logged in to the own device to the host device 10 (step SB5). ).

  Next, the CPU 11 starts a process of associating the user ID “UID-B” with the user ID “UID-X”. First, the CPU 11 checks whether or not the user ID “UID-B” or the user ID “UID-X” is already associated with another user ID in the host user management table (step SB6). Here, since it is confirmed that the user ID “UID-X” is already associated with the user ID “UID-A”, the user A to which the user ID “UID-A” is assigned, There is a possibility that the user B to which the user ID “UID-B” is assigned is not the same person. Similarly, the controller 24 checks whether or not the user ID “UID-X” or the user ID “UID-B” is already associated with another user ID in the terminal user management table (step SB7). ). Here, since it is confirmed that the user ID “UID-X” is already associated with the user ID “UID-A”, the user A to which the user ID “UID-A” is assigned, There is a possibility that the user B to which the user ID “UID-B” is assigned is not the same person.

  Therefore, the host device 10 and the information processing terminal 20 collate the fingerprints used for the respective authentication processes in order to determine whether or not the logged-in users are the same person (step SB8). At this time, the CPU 11 of the host device 10 extracts the feature point of the fingerprint data read by the own device, and obtains a hash value corresponding to the feature point. Similarly, the controller 24 of the information processing terminal 20 also extracts fingerprint data and obtains a hash value. Then, the host device 10 and the information processing terminal 20 obtain the matching degree of the respective fingerprint data by exchanging the respective hash values and comparing each other.

If the CPU 11 of the host device 10 determines that the fingerprint data match based on the comparison result, the CPU 11 deletes the description about the user ID “UID-X” and the user ID “UID-A” from the host user management table (step SB9). On the other hand, if the controller 24 of the information processing terminal 20 also determines that the fingerprint data match each other based on the comparison result, the description relating to the user ID “UID-X” and the user ID “UID-A” is deleted from the terminal user management table. (Step SB10). Then, the CPU 11 of the host device 10 corresponds the user ID “UID-B” and the user ID “UID-X” to the user management table of the host device 10 as shown in the first row of FIG. A description is added (step SB11). On the other hand, the controller 24 of the information processing terminal 20 corresponds the user ID “UID-X” and the user ID “UID-B” to the terminal user management table as shown in the first row of FIG. Add and describe (step SB12). That is, instead of the user ID “UID-A”, the user ID “UID-B” is associated with the user ID “UID-X”.
After the user B and the user X are associated in this way, the user B and the user X are handled as the same user as in step SA8 and subsequent steps in FIG. Perform authorized processing.

(2-3) Operation example 3
Next, the operation when the PDA 30 as another information processing terminal in addition to the information processing terminal 20 is connected to the host device 10 will be described.
FIG. 13 is a sequence diagram illustrating a flow of processing executed by the host device 10, the information processing terminal 20, and the PDA 30 in the information management system 1. The PDA 30 includes a CPU, a ROM, a RAM, a storage unit, a USB controller, an operation unit, a display unit, and the like, and further has a function of authenticating a user with a predetermined password. The terminal ID assigned to the PDA 30 is “03”. In addition, there are a plurality of USB ports 16 of the host device 10, and the PDA 30 is connected to the USB port 16 of the host device 10 via a USB cable.

  When the operator touches the fingerprint reading device 19 of the host apparatus 10, the CPU 11 of the host apparatus 10 causes the fingerprint reading device 19 to read the fingerprint. Then, the CPU 11 reads the fingerprint data stored in the storage unit 14 according to the host authentication table, and collates it with the fingerprint data supplied from the fingerprint reading device 19. If the CPU 11 confirms that there is matching fingerprint data, the CPU 11 permits the login of the user with the user ID “UID-A” in accordance with the host authentication table of FIG. 3 (step SC1). On the other hand, when the fingertip of the operator touches the fingerprint reading device 25, the controller 24 of the information processing terminal 20 causes the fingerprint reading device 19 to read the fingerprint. Then, the controller 24 reads the fingerprint data stored in the dedicated flash ROM 26 based on the authentication table, and collates it with the fingerprint data supplied from the fingerprint reading device 25. If the controller 24 confirms that there is matching fingerprint data, the controller 24 permits the login of the user with the user ID “UID-X” in accordance with the terminal authentication table of FIG. 9 (step SC2). Further, when the password is input by the operator and the authentication is successful, the PDA 30 permits the login of the user assigned the user ID specified by the impression (here, the user ID “UID-M”) (step S30). SC3).

  The USB connector 23 of the information processing terminal 20 is attached to one of the USB ports 16 of the host device 10 in a state where the host device 10, the information processing terminal 20 and the PDA 30 are logged in, respectively (step SC4). One USB cable attached to a USB connector (not shown) of the PDA 30 is attached (step SC5). As a result, the host device 10, the information processing terminal 20, and the PDA 30 recognize that they are connected to each other and become communicable.

  Then, the CPU 11 of the host device 10 transmits user information including the terminal ID “02” of the own device and the user ID “UID-A” logged in at the own device to the information processing terminal 20 (step SC6). . On the other hand, the USB controller 21 of the information processing terminal 20 transmits user information including the terminal ID “01” of the own device and the user ID “UID-X” logged in to the own device to the host device 10 (step SC7). ).

  Further, the CPU 11 of the host device 10 transmits user information including the terminal ID “02” of the own device and the user ID “UID-A” logged in by the own device to the PDA 30 (step SC8). On the other hand, the CPU of the PDA 30 transmits user information including the terminal ID “03” of the own device and the user ID “UID-M” logged in to the own device to the host device 10 (step SC9).

  Further, the CPU 11 of the host device 10 transmits user information including the user ID “UID-X” logged in to the information processing terminal 20 received in step SC7 to the PDA 30 (step SC10). Further, the CPU 11 transmits user information including the user ID “UID-M” logged in to the PDA 30 received in step SC9 to the information processing terminal 20 (step SC11).

  Next, the CPU 11 uses the field of the terminal ID “01” in the host user management table as shown in the first line of FIG. 14A, and uses the user ID “UID-A” and the user ID. “UID-X” is described in association with the terminal ID “03”, and the user ID “UID-A” and user ID “UID-M” are described in association with each other (update). (Step SC12).

  Similarly, the controller 24 uses the terminal ID “02” field in the terminal user management table, as shown in the first row of FIG. 14B, and the user ID “UID-X” and the user. The ID “UID-A” is described in association with the user ID “UID-X” and the user ID “UID-M” in association with the field of the terminal ID “03” (updated) (Step SC13).

  Similarly, the PDA 30 describes the user ID “UID-M” and the user ID “UID-A” in association with each other using the terminal ID “02” field of the PDA user management table of the own device. Then, using the field of the terminal ID “01”, the user ID “UID-M” and the user ID “UID-X” are described (updated) in association with each other (step SC14).

  In this way, the user A, the user X, and the user M are associated with each other in each device. Here, it is assumed that the operator operates the operation unit 17 of the host device 10, for example, and instructs the PDA 30 to transmit the file a stored in the storage unit 14. In this case, the host device 10 and the PDA 30 perform the processing of steps SA8 to SA11 in FIG. That is, the CPU 11 reads the profile information of the file from the storage unit 14, determines whether the user assigned the user ID “UID-A” has the access right, and determines that the user has the access right to the file. User A's access to the file is permitted and sent to the PDA 30. On the other hand, since the user ID “UID-M” and the user “UID-A” are associated with each other in the PDA 30, the file a is stored in, for example, a memory device assigned to the user with the user ID “UID-M”. Is done.

  Further, it is assumed that the operator operates, for example, an operation unit (not shown) of the PDA 30 to instruct to request reading of a file stored in the flash ROM 22 of the information processing terminal 20. In this case, the PDA 30 and the information processing terminal 20 perform the processing of steps SA12 to SA15 in FIG. That is, since the user ID “UID-M” and the user “UID-X” are associated with each other in the PDA 30, the user with the user ID “UID-M” has the shared memory device 221P and the user ID “UID-X”. Can access the user X dedicated memory device 221X that can be accessed by the user, and read the file FP and the file FX stored in the memory device 221X and display them on a display unit (not shown) or store them in the storage unit be able to.

  According to the embodiment described above, when a plurality of information processing terminals (the host device 10, the information processing terminal 20, and the PDA 30) perform communication, each terminal ID and the user ID of the logged-in user are shared to be the same. By associating different user IDs assigned to the user, user management can be performed even with a simple configuration.

(3) Modifications The embodiment described above may be modified as follows.
In the operation example 2 of the above-described embodiment, when the information processing terminal 20 to which the user X has logged in associates the user ID “UID-X” with the user “UID-A”, the host device to which the user B has logged in 10, after confirming the identity of the fingerprint, the description relating to the association is deleted, and the user ID “UID-B” and the user “UID-X” are newly associated with each other. In addition to confirming the identity of the fingerprint at this time, any means may be employed as long as it is a means for confirming the identity between the operator logged in the host device 10 and the operator logged in the information processing terminal 20. Can do.
Although it is not necessary to provide a means for confirming identity with such an operator, in that case, each user can freely access information of other users. Users should be careful when operating this system.
In addition, once the host device 10 or the information processing terminal 20 writes the correspondence relationship of the user ID of each device into the host user management table or the terminal user management table, the relationship between these devices is not changed thereafter. Also good. Specifically, the CPU 11 discards the received user information including the user ID “UID-X” after the processing of steps SB6 and SB8 in FIG. 11, and an error such as “cannot access the display unit 18”. Display a message and end the process. In this way, it is possible to prevent a situation where information is unintentionally leaked.

  In the above-described embodiment, the host apparatus 10 and the information processing terminal 20 are connected by a wired communication path (USB cable) for performing communication according to the USB standard. However, the communication path method is not limited to this. Alternatively, for example, a wireless communication path such as Bluetooth (registered trademark) or infrared light may be used. In short, the present invention is applicable to any communication path capable of exchanging information between a plurality of devices. However, the use of USB has the following advantages. That is, since the USB cable has a power supply line, power is supplied from the host device 10 to the information processing terminal 20 via the USB port. Therefore, as long as the host device 10 and the information processing terminal 20 are connected via USB, the user can use the information processing terminal 20 without worrying about running out of the battery.

The information processing terminal of the present invention may be any device that can store information, and is applied to a portable computer such as a PDA in addition to a portable display such as an electronic paper. You can also. The host device of the present invention may be a device that performs communication via a communication path connected to the information processing terminal, and may be a desktop computer, a mobile computer, a printer, a multifunction device, or the like. . In the operation example 3, the case where three devices are connected has been described. However, even if more devices are provided, if each device supplies user information to other devices, the same method is used. A user management table can be generated for user management.
The programs executed by the CPU 11 and the controller 24 described above are a magnetic tape, a magnetic disk, a floppy (registered trademark) disk, an optical recording medium, a magneto-optical recording medium, a CD (Compact Disk), a DVD (Digital Versatile Disk), and a RAM. It can provide in the state recorded on recording media, such as.

In the embodiment described above, each of the connected host device 10 and the information processing terminal 20 is a user in which the user ID of the user who has logged into the host device 10 is associated with the user ID of the user who has logged into the information processing terminal 20 A management table was generated. However, in such a method, each user ID is associated even if the user who logged in to each device is actually different. For this reason, for example, when highly confidential information is stored in the memory device associated with each user, there is a possibility that the information may be extracted by other users. Therefore, after confirming that the users logged in to the host device 10 and the information processing terminal 20 are the same person, these user IDs may be associated with each other. For example, as in step SB8 of FIG. 11, the hash values generated by extracting the feature points of the fingerprint data read by the host device 10 and the fingerprint data read by the information processing terminal 20 are compared, and they match. Only in some cases, each user ID is associated. The reason why the fingerprint data is not directly exchanged between the devices at this time is that, if fingerprint data is leaked for some reason during the transmission / reception process, it may be misused and cause a serious problem. If fingerprint data is compared with higher accuracy, the fingerprint data may be exchanged by encrypting it with a public key.
In the above-described embodiment, fingerprint data is used as the authentication information. However, for example, authentication using a password may be used, and any method may be used as long as it can authenticate a user.

It is a block diagram which shows the structure of an information management system. It is a block diagram which shows the structure of a host apparatus. It is a figure explaining the authentication table which a host apparatus has. It is a figure explaining an example of the profile information of a file. It is a figure explaining the user management table which a host apparatus has. It is a block diagram which shows the structure of an information processing terminal. It is a block diagram which shows the structure of flash ROM. It is a figure explaining the user management table which an information processing terminal has. It is a figure explaining the authentication table which an information processing terminal has. It is a sequence diagram explaining operation | movement of the information management system in the operation example 1. FIG. It is a sequence diagram explaining operation | movement of the information management system in the operation example 2. FIG. It is a figure explaining the user management table after the operation | movement of the operation example 2. FIG. It is a sequence diagram explaining operation | movement of the information management system in the operation example 3. FIG. It is a figure explaining the user management table after the operation | movement of the operation example 3. FIG.

Explanation of symbols

DESCRIPTION OF SYMBOLS 1 ... Information management system, 10 ... Host apparatus, 11 ... CPU, 12 ... ROM, 13 ... RAM, 14 ... Memory | storage part, 15 ... USB controller, 16 ... USB port, 17 ... Operation part, 18 ... Display part, 19 ... Fingerprint reading device, 20 ... information processing terminal, 21 ... USB controller, 22 ... flash ROM, 221P ... shared memory device, 221X ... user X dedicated memory device, 221Y ... user Y dedicated memory device, 221Z ... user Z dedicated memory device, 222 ... Memory switching module, 23 ... USB connector, 24 ... Controller, 25 ... Fingerprint reading device, 26 ... Dedicated flash ROM, 27 ... RAM, 28 ... Bus.

Claims (9)

Authentication information storage means for storing first user identification information assigned to each user and authentication information for authenticating each user in association with each other;
An input means for entering authentication information;
Authentication means for collating the authentication information input in the input means with the authentication information stored in the authentication information storage means and identifying the first user identification information corresponding to the matched authentication information;
Receiving means for receiving second user identification information different from the first user identification information in a period in which the first user identification information is specified by the authentication means;
Management information storage means for storing the first user identification information specified by the authentication means and the second user identification information received by the receiving means in association with each other;
While executing the process permitted for the user of the first user identification information specified by the authentication means, the second user identification information stored in the management information storage means is assigned to the user. On the other hand, an information processing terminal comprising: execution means for executing processing permitted to the user of the first user identification information corresponding to the second user identification information. The execution means includes
While allowing the user of the first user identification information specified by the authentication means to access information associated with the first user identification information, and executing processing according to the access,
Access to the information associated with the first user identification information corresponding to the second user identification information is made to the user assigned the second user identification information stored in the management information storage means. The information processing terminal according to claim 1, wherein the processing is permitted and processing corresponding to the access is executed. A plurality of storage areas, each storage area comprising storage means associated with different first user identification information;
The execution means includes
While allowing the user of the first user identification information specified by the authentication means to access the storage area associated with the first user identification information, and executing a process according to the access ,
For a user assigned with the second user identification information stored in the management information storage means, the storage area associated with the first user identification information corresponding to the second user identification information The information processing terminal according to claim 1, wherein access is permitted and processing corresponding to the access is executed. When the receiving means receives the second user identification information during the period in which the first user identification information is specified by the authentication means, the second user identification information is associated with the second user identification information If user identification information is already stored,
The management information storage means is configured so that the second user identification information stored in association with the first user identification information is different from the received second user identification information. When the user to which the second user identification information is assigned can be confirmed to be the same, the reception is performed instead of the second user identification information associated with the first user identification information. The information processing terminal according to claim 1, wherein the second user identification information received by a means is stored. When the receiving means receives the second user identification information during the period in which the first user identification information is specified by the authentication means, the second user identification information is associated with the second user identification information If user identification information is already stored,
In the management information storage means, the second user identification information stored in association with the first user identification information is different from the second user identification information received by the receiving means. The information processing terminal according to claim 1, wherein the second user identification information received by the receiving unit is not stored. The receiving means receives the different second user identification information from a plurality of information processing terminals to which different terminal identification information is assigned, respectively.
The management information storage means includes the first user identification information specified by the authentication means, the second user identification information received by the reception means, and the transmission source of the second user identification information. Storing the terminal identification information assigned to the information processing terminal in association with it,
The execution means executes a process permitted for the user of the first user identification information specified by the authentication means, while a plurality of second user identifications stored in the management information storage means The process for which the user of the said 1st user identification information corresponding to each said 2nd user identification information is performed with respect to the user to whom the information was allocated is performed. Information processing terminal. The information processing terminal according to claim 1, wherein the receiving unit receives the second user identification information in accordance with a USB (Universal Serial Bus) standard. Collating means for collating whether or not the user to which the first user identification information is assigned and the user to which the second user identification information is assigned are the same;
The management information storage means, when it is confirmed that the user assigned the first user identification information and the user assigned the second user identification information are the same by the collating means, The information processing terminal according to claim 1, wherein the first user identification information and the second user identification information are stored in association with each other. An information management system comprising an information processing terminal and a host device,
The information processing terminal
Authentication information storage means for storing first user identification information assigned to each user and authentication information for authenticating each user in association with each other;
An input means for entering authentication information;
Authentication means for collating the authentication information input in the input means with the authentication information stored in the authentication information storage means and identifying the first user identification information corresponding to the matched authentication information;
Receiving means for receiving second user identification information different from the first user identification information in a period in which the first user identification information is specified by the authentication means;
Management information storage means for storing the first user identification information specified by the authentication means and the second user identification information received by the receiving means in association with each other;
While executing the process permitted for the user of the first user identification information specified by the authentication means, the second user identification information stored in the management information storage means is assigned to the user. On the other hand, it comprises execution means for executing processing permitted to the user of the first user identification information corresponding to the second user identification information,
The host device is
An authentication means for performing user authentication;
An information management system comprising: transmission means for transmitting user identification information assigned to a user who has been authenticated by the authentication means to the information processing terminal as the second user identification information.

Images