JPH11161536A - User limiting device and method therefor - Google Patents

Abstract

PROBLEM TO BE SOLVED: To prevent the unauthorized utilization of a database by a simple mechanism by providing a means for limiting the authetication of a user and a job range to the user of a client-server system. SOLUTION: In this user limiting device, a server device 2 is provided a usable person confirmation information file 15 for registering the authentication information of the user and a database connection information and a selecting function information file 16 for registering the function name and application program of the job range of the user. Further, a client device 1 is provided with an input reception means 10 for receiving a person-in-charge code and a password, a user authentication confirmation means 11 for sending the person- in-charge code and the password to the server device 2, a user retrieval means 12 for obtaining the job range and the database connection information, a utilization function selection means 13 for inquiring the function name and the application program of a utilization job to the server device 2 and a function activation request transfer means 14 for transferring the database connection information to the application program by a job activation request.

Description

DETAILED DESCRIPTION OF THE INVENTION

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a client-server system in which a plurality of users use a database of a server device from a client device, and in particular, by transferring database connection information to an application based on user authentication information. And a user restriction device for restricting use of a database.

[0002]

2. Description of the Related Art Conventionally, regarding the security of a database used by a plurality of users, in order to prevent a person who is not authorized to use the database from using the database illegally, user authentication is performed. Has incorporated a mechanism in the system to protect the security of the database. According to JP-A-4-245550,
Reference to a database used by a plurality of users is limited by a reference constraint for each user who has usage rights. A right-of-use management unit that authenticates a user; a reference condition registration unit that registers a reference condition of a database; and a reference condition determination unit that determines whether data retrieved from the database satisfies the reference condition. However, restrictions are imposed by the user's reference restrictions. The usage right managing means authenticates a person who inputs the database usage right control command, and transfers the database usage right to the user. The reference condition registration means,
A reference range of the database that is permitted in advance is registered in the user to whom the usage right has been transferred. When a user issues a database search request, the reference condition registration unit extracts data from the database according to the search condition, checks whether the reference constraint condition is satisfied, and provides a reference to the authenticated user. The database is allowed to be referenced within the conditions to prevent unauthorized use of the database.

[0003]

A first problem is that it is impossible to set a collectively managed usage right for a plurality of databases required for a user's business. The reason is that the conventional reference constraint condition determination means determines the data range to be referred to by the data value in the database, so when the user refers to a plurality of databases, the reference range of the user is determined for each use database. It is necessary to define.

[0004] The second problem is that the right to use the database cannot be set for various tasks. The reason is,
Conventional means for determining the usable range are defined for each database, so when defining a usage right for an individual task, a reference constraint condition is defined for the database required for the task. Also, since multiple databases are usually used for business, referential constraints must be set for the number of databases,
Not only does this require a lot of man-hours for maintenance work, but also makes database security management complicated.

[0005] It is an object of the present invention to authenticate a user in a client server system in which a plurality of users participate and each execute a task on a client device, and to store database connection information in an application program of the task started by the user. To limit the use of the database.

[0006]

Therefore, a user restriction device according to the present invention provides a user confirmation information file for registering user authentication information and a work range and database connection information, and a business included in the work range. The server device having a function name and a selection function information file for registering an application program, an input receiving unit for inputting authentication information of a person-in-charge and a password input by the user, and a request transmitted from the input receiving unit. Means for sending the authentication information to the server device, and user authentication means for authenticating the user; and user search means for obtaining the business scope and database connection information of the authenticated user from the user information file. , Based on the business scope, the function name and application of the usage business in the selection function information file A client device comprising: a use function selecting unit for querying an application program; and a function start request transfer unit for transferring database connection information to an application program in response to a user's business start request. I do.

[0007] The user confirmation information file includes a person-in-charge code for identifying the user himself, a password as a registration number of the user, a work range indicating work permitted to the user, and a database connection. The information includes a connection host name and a connection password.

Further, the selection function information file is characterized by including a function name indicating a business, a business range including the function name, and an application program for executing the business.

[0009]

BEST MODE FOR CARRYING OUT THE INVENTION
This will be described with reference to the drawings. Referring to FIG. 1, a user restriction device according to the present invention includes a client device 1, a server device 2, and a client device 1 and a server device 2 connected via a communication line (not shown). The client device 1 includes an input receiving unit 10 for inputting a person-in-charge code and a password input by a user, a use authentication confirming unit 11 for transmitting user authentication information to the server device 2, a user authentication and a business scope. User search means 12 for obtaining database connection information, use function selection means 13 for selecting whether or not the user's business request is within a usable business range; Function activation request delivery means 14 to be delivered to
And.

The server device 2 includes a user confirmation information file 15 for storing user authentication information, database connection information, and a work range, a function name and an application indicating a work within a work range permitted to the user. A selection function information file 16 for registering a program. The usable user confirmation information file 15 registers a person-in-charge code and a password for authenticating the user, and stores the business scope of the authenticated user and the host name and password of the database connection information used in the business. to manage. The selection function information file 16 registers a task range indicating a function name and a use right of a task, and an application program to be started in the task.

Next, a procedure for restricting a user executed in this embodiment will be described with reference to FIG. 2. The input receiving means 10 receives a person-in-charge code and a password input by the user (see FIG. 2). 2 step 21). The use authentication confirmation unit 11 searches whether or not the input character string received from the input reception unit 10 is registered in the user confirmation information file 15 (Step 22). When the character string is registered (YES in step 22), a response for authenticating the user is notified to the user search means 12.
When the character string is not registered (N in step 22)
O) Assuming that the user is an unauthorized user, the subsequent processing ends (step 26). The user search means 12 acquires from the user confirmation information file 15 the business range, the connection host name, and the connection password representing the use right of the user authenticated by the use authentication confirmation means 11 (step 24). The used function selecting unit 13 extracts a function name corresponding to the business range obtained by the user searching unit 12 from the selected function information file 16 (step 25). When the user requests the business permitted by the used function selection unit 13 (YES in step 27), the function activation request delivery unit 14 stores the connection host name and the connection password of the database necessary for the activation of the business in the activation application. The program is delivered to the program and started (step 28). The user of the database is restricted according to the above procedure.

Next, the operation of this embodiment will be described using a specific example with reference to FIG. The user confirmation information file 15 includes a person-in-charge code “100” indicated by the item number 152, a password “k4f3k2m1t0”,
A business range “B”, a connection host name “CST”, and a connection password “MTSC” are registered. In the selection function information file 16, a function name and an application program that match the work range “B” indicated by the item number 161 are registered. The person in charge code “10” indicated by the user in item number 151
0 "and a password" k4f3k2m1t0 ". The input receiving means 10 outputs the person in charge code “100”
And the password “k4f3k2m1t0].
The use authentication check unit 11 checks whether or not the user is registered in the user check information file 15 with the person-in-charge code “100” and the password “k4f3k2m1t0”. Person in charge code “100” and password “k4f3k”
2m1t0] is registered as shown in the item number 152, and the user search means 12 called in accordance with the result stores the person in charge code “100” and the password “k”.
4f3k2m1t0], the connection scope “B”, the connection host name “CSTM”, and the connection password “MTS”.
C ". The use function selection unit 13 selects only the function names having the same business range “B” as the business range “B” acquired by the use search unit 13 and selects the function name information file 16.
Remove from When the user issues an activation request to “inventory management” among the selected function names, the connection host name acquired by the user search means 12 in the “stock.exe” application program “store.exe” Deliver “CSTM” and connection password “MTSC” and activate.

[0013]

According to the first effect of the present invention, by registering a user in advance, an unauthorized user cannot use the client device, thereby preventing unauthorized use. The reason is that, by authenticating the user from the user confirmation file with the user's person-in-charge code and password, an unauthorized user can be excluded.

A second effect is that it is possible to prevent an unauthorized user from starting a business and illegally using a database. The reason is that, by judging, from the selection function information file, the work within the work range authorized to the authenticated user, the database connection information required for the start-up work is delivered to the application program,
This is because only the database required for business can be used.

A third effect is that unauthorized use can be prevented in a simple manner by restricting the use of the database according to the user's use business. The reason is that reference constraints are not given to a plurality of databases required for business execution, but restrictions are placed on business functions.

[Brief description of the drawings]

FIG. 1 is a diagram showing a configuration of an embodiment of the present invention.

FIG. 2 is a flowchart showing a procedure of a method performed in this embodiment.

FIG. 3 is a diagram illustrating a procedure executed in this embodiment.

[Explanation of symbols]

 DESCRIPTION OF SYMBOLS 1 Client apparatus 2 Server apparatus 10 Input receiving means 11 Use authentication confirmation means 12 User search means 13 Use function selection means 14 Function activation request delivery means 15 User confirmation information file 16 Selection function information file

Claims (6)

[Claims] 1. A client-server system in which a client apparatus that allows a user to execute an application program and a server apparatus having a database are connected by a communication line. The use of the database is restricted by authentication of itself, a work range permitted to the user, and delivery of database connection information to an application program in response to a work request included in the work range. User restriction device. 2. The user restriction device registers a user confirmation information file for registering user authentication information and a business range and database connection information, and a function name and an application program of a business included in the business range. The server device, comprising: a selection function information file to be input to the server device; an input receiving unit for authentication information of a staff code and a password input by the user; and the server device receiving the authentication information sent from the input receiving unit. And a user authentication means for authenticating the user, a user search means for obtaining the business scope and database connection information of the user who is authenticated from the available user confirmation information file, based on the business scope, Inquiry of the function name and application program of the use business in the selection function information file 2. A client device comprising: a use function selecting unit; and a function start request transfer unit that transfers database connection information to an application program in response to a user's business start request. User restriction device. 3. The user confirmation information file includes a person-in-charge code for identifying a user, a password as a registration number of the user, a work range indicating work permitted to the user, and a database connection. 3. The user restriction device according to claim 2, further comprising: a connection host name and a connection password of the information. 4. The selection function information file according to claim 2, wherein the selection function information file includes a function name indicating a task, a task range including the function name, and an application program for executing the task. User restriction device. 5. Authentication of a user and restriction on the use of the database in a client server system in which a client apparatus that allows a user to execute an application program and a server apparatus having a database are connected by a communication line. In the method of a user restriction device, a user inputs his / her own staff code and password from the client device and sends it to a server device, and the staff code and password are registered in an available user confirmation information file. Searching for whether or not the user is an unauthorized user, determining that the user is an unauthorized user, and stopping the use of the client device; and when the user is registered in the search. From the user confirmation information file, the business scope and data Acquiring a connection host name and a connection password, which are database connection information, and obtaining, by a client device, a function name and an application program of the business included in the business range from the selection function information file based on the business range. Sending a connection host name and a connection password, which are database connection information, to an application program for the starting operation when the user starts the operation from the client device. Method. 6. A computer-readable recording medium on which a program for executing the method of the user restriction device is recorded.