Abstract:
A sharing management method for sharing a terminal with plural users includes: after completion of login to an operating system of the terminal or after booting up the operating system, starting to record log data for predetermined events; and after the completion of the login to the operating system or after booting up said operating system, prohibiting an operation other than predetermined operations including user authentication in a sharing management program, wherein the user authentication is other than authentication in the operating system. Then, the log data after the user authentication succeeded includes a user identifier in the sharing management program, which relates to a user whose user authentication succeeded. As a result, while ensuring the security in the terminal apparatus shared by plural users, it is possible to rapidly carry out user switching.

Description:
CROSS-REFERENCE TO RELATED APPLICATIONS 
     This application is a continuing application, filed under 35 U.S.C. section 111(a), of International Application PCT/JP2005/012832, filed Jul. 12, 2005. 
    
    
     TECHNICAL FIELD OF THE INVENTION 
     This invention relates a resource utilization management technique in a case where a terminal apparatus is shared by plural users. 
     BACKGROUND OF THE INVENTION 
     For example, in a counter business in a store, in which rapid measures for customers are sought, there is a case where the use of necessary business applications is enabled in one terminal apparatus, and plural users share such a terminal apparatus. However, from the viewpoint of the security, such a utilization mode is not preferable, and based on the authority of the user who firstly booted up and logged into the terminal apparatus, various operations are carried out. Namely, even when a user other than the user who firstly booted up and logged into the terminal apparatus carries out an operation, which cannot be carried out based on his or her authority, such an operation cannot be prevented, and furthermore, only an operation log representing that a proper operation was carried out is recorded. Therefore, a method is considered that settings of the user authorities or the like are carried out in an operating system for each user, the login and log-off to the operating system are carried out every time when the user uses the terminal apparatus, and a log representing what user carries out what operation is saved. 
     However, there is a problem that the time unacceptable from the viewpoint of the customer service in the counter business in the store in which the rapid measures for the customers are sought is required for the login to the operating system. Therefore, the login and log-off to the operating system are not actually carried out even if they are required. In addition, although a solution exists that settings of the user authorities are carried out in the business application and the operations of the login and log-off are made to be mandatory, the cost for the change of the business application and the like is required. 
     Incidentally, for example, JP-A-H09-259274 discloses a fingerprint recognition apparatus having a fingerprint input unit that reads the fingerprint, a judgment unit that compares the input data obtained from the fingerprint input unit with the fingerprint data stored in a database, and is connected with them, and when the fingerprint judgment result is normal, the screen of the display device is turned ON, and the locked screen is returned to a usable state, and when the fingerprint judgment result is abnormal, the screen of the display device is turned OFF, and the screen is kept locking. However, this is insufficient for the leakage prevention of the secret information, which is a large problem in recent years. 
     SUMMARY OF THE INVENTION 
     Therefore, an object of this invention is to provide a technique enabling rapid user switching while securing the security in the terminal apparatus shared by plural users. 
     A sharing management method according to this invention is a sharing management method to share one terminal by a plurality of users, and includes: after completion of login to an operating system of the terminal or after booting up the operating system, starting to record log data for predetermined events (activation of a program, change of window display content, user operation or the like); and after the completion of the login to the operating system or after activating the operating system, prohibiting an operation other than predetermined operations including user authentication in a sharing management program, which is other than authentication in the operating system. Then, the log data after the aforementioned user authentication succeeded includes a user identifier in the sharing management program, wherein the user identifier relates to a user whose user authentication succeeded. 
     By carrying out such a processing, because the login and log-off for the operating system are not required, it is possible to shorten the time necessary for the user switching. Furthermore, because the login by the user authentication in the sharing management program and the log-off from the sharing management program are carried out, the user ID of the sharing management program is identified by the log data. Therefore, what user carries out what operation can be identified later from the log data. The security is also secured with the prohibiting the operation other than the predetermined operations including the aforementioned user authentication. 
     In addition, this invention may further include prohibiting an operation other than operations allowed to the user relating to the user authentication after the user authentication succeeded. Thus, it is possible to manage the operations of the user by reflecting the policy for each user, and the security is improved. 
     In addition, this invention may further include terminating an application program defined in a setting file in advance when the log-off from the sharing management program, which is different from the log-off from the operating system, is carried out. When there is no need to carry out a setting of the user authority for the business application, it is sufficient to identify what user uses what business application and carries out what operation after the user authentication by using the log data. However, for example, in a case where the user authentication is carried out further in the business application, when the business application is left activated, the access restriction according to the user authority for the business application becomes nominal. Thus, when the business application is terminated in addition to the log-off from the sharing management application, such a program does not occur. 
     Furthermore, the log-off from the sharing management program may be executed when the log-off is explicitly instructed, when a no-operation time exceeds a timeout period defined in the setting file in advance, or when termination of an application program defined in the setting file in advance is instructed. When the business of the user is tightly coupled to the application program, the log-off from the sharing management program may be automatically carried out in response to the termination of the application program. 
     Furthermore, an environment in the operating system may be shared with a plurality of users except a setting portion of the policy data necessary for the prohibiting an operation other than operations allowed to the user relating to the user authentication after the user authentication succeeded. Thus, the user authentication for the sharing management program enables to use the business application more rapidly than the login to the operating system. 
     In addition, this invention may further include activating an application program defined in the setting file in advance after the user authentication succeeded. This is because the user&#39;s convenience is considered. 
     A terminal apparatus according to this invention is a terminal apparatus shared by a plurality of users, and has an operating system, and a sharing management program. Then, the aforementioned sharing management program causes to record log data for predetermined events after completion of login to the operating system of the terminal apparatus or after booting up operating system, and prohibits an operation other than predetermined operations including user authentication in the sharing management program, which is different from authentication in the operating system after the completion of the login to the operating system or after booting up the operating system. In addition, the log data after the user authentication succeeded includes a user identifier in the sharing management program, which relates to the user whose user authentication succeeded. 
     In addition, a sharing management system including such a terminal apparatus and a server including a storage device to store the log data. Furthermore, the sharing management system may include an authentication server. 
     It is possible to create a program causing a computer to execute the aforementioned method, and this program is stored, for example, in a storage medium or a storage device such as a flexible disk, CD-ROM, magneto-optical disk, a semiconductor memory, a hard disk or the like. In addition, the program may be distributed as digital signals through a network or the like. Incidentally, the intermediate processing result is temporarily stored into a storage device such as a memory. 
    
    
     
       BRIEF DESCRIPTION OF THE DRAWINGS 
         FIG. 1  is a system outline diagram in an embodiment of this invention; 
         FIG. 2  is a functional block diagram of a terminal in the embodiment of this invention; 
         FIG. 3  is a diagram showing a processing flow of the embodiment of this invention; 
         FIG. 4  is a diagram showing a processing flow of the embodiment of this invention; 
         FIG. 5  is a diagram showing an example of a setting file in the embodiment of this invention; 
         FIG. 6  is a diagram showing a processing flow of the embodiment of this invention; and 
         FIG. 7  is a diagram showing an example of data stored in the log DB. 
     
    
    
     DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS 
       FIG. 1  shows a system outline diagram of a sharing management system in one embodiment of this invention. In the sharing management system according to this embodiment, a terminal use management server  3 , one or plural terminals  5  shared by plural users, an authentication server  7 , and one or plural business server  9  are connected to a network  1  such as the Intranet. The terminal use management server  3  manages a policy DB  31  storing policy data for each user of the terminal  5 , and a log DB  33  storing log data concerning events, which occurred in the terminal  5 . The terminal use management server  3  reads out the policy data for the user who uses the terminal  5  from the policy DB  31  in response to a request from the terminal  5 , and transmits the policy data to the terminal  5  of the requesting source through the network  1 . In addition, the terminal use management server  3  receives the log data from the terminal  5  through the network  1 , and stores the log data into the log DB  33 . The authentication server  7  receives authentication data for the sharing management program described later, which is inputted into the terminal  5 , carries out an authentication processing by using the received authentication data and the authentication DB  71 , and transmits the authentication result to the terminal  5  of the transmission source through the network  1 . The business server  9  is a server that provides various business services, and it is possible to use the business server  9  in this embodiment without any change. 
       FIG. 2  shows a functional block diagram of the terminal  5 . In the functional block diagram of  FIG. 2 , only a portion relating to this embodiment is shown, and in order to make it easy to understand, the hardware, which is actually connected to the terminal  5  and is also built into the terminal  5 , is shown outside of the terminal  5 . The terminal  5  is connected to or includes inside of it, an external storage medium recorder  501 , which is a drive device of the external recording medium such as the flexible disk, a Compact Dick (CD), a Digital Versatile Disk (DVD) or a memory card conforming with any standard or storage device, a printer  502 , a fingerprint sensor  503 , keyboard and mouse  504 , a display device  505 , and a communication device  506  to connect with the network  1 . The external storage medium recorder  501  may be a Universal Serial Bus (USB) memory or portable hard disk drive conforming with any connection standard. 
     In addition, the user terminal  5  includes an operating system  53  in which the authority can be set for each user and the user can login through the authentication, one or plural business applications  54  that are executed on the operating system  53  and carries out a business processing while cooperating with, for example, the business server  9 , a sharing management program  51  that carries out the main processing in this embodiment, and a setting file  52  including setting data for the sharing management program  51 . Although it is not shown in the diagram, various programs are included in the terminal  5  and executed. The sharing management program  51  includes an initial and end processing unit  511 , an event monitoring recorder  512 , an operation manager  513  and policy data  514  obtained from the terminal use management server  3 . Incidentally, a portion of the policy data is set from the sharing management program  51  into the registry of the operating system  53  as policy data  531 . 
     Next, an operation of the sharing management system shown in  FIGS. 1 and 2  will be explained by using  FIGS. 3 to 7 . Firstly, the operating system (which will be abbreviated as “OS” in the following)  53  is booted up in the terminal  5  according to the operation of the user, and the login is carried out as a predetermined user in the OS  53  (step S 1 ). This processing is similar to conventional one. Furthermore, a setting to automatically activate the sharing management program  51  when the OS  53  is booted up is made in the OS  53 , and the sharing management program  51  is activated next to the step S 1  (step S 3 ). When the sharing management program  51  is activated, the event monitoring recorder  512  starts monitoring and recording of events of predetermined kinds (step S 5 ). The event monitoring recorder  512  transmits data of the detected event as log data to the terminal use management server  3  through the network  1 , and the terminal use management server  3  receives the log data, and stores the log data into the log DB  33 . The data registered in the log DB  33  will be explained later. 
     Moreover, the operation manager  513  prohibits all operations except the operation for the login to the sharing management program  51  and the shutdown or log-off operation of the OS  53  (step S 7 ). That is, an operation prohibition state is started. Thus, the user of the terminal  5  cannot carry out any operations such as activation and use of the business application  54  until he or she carries out the login to the sharing management program  51 . 
     After that, the initial and end processing unit  511  accepts an operation input by the user, and judges whether or not the operation input means the login to the sharing management program  51  (step S 9 ). When the operation input does not mean the login to the sharing management program  51 , the processing returns to the step S 7 . Incidentally, the shutdown or log-off operation of the OS  53  or the like is accepted, but in order to simplify the explanation, here, a case is indicated that only the login to the sharing management program  51  is accepted. 
     When the operation input means the login to the sharing management program  51 , the initial and end processing unit  511  accepts, for example, an input of the user ID, reads the fingerprint of the user by the fingerprint sensor  503 , and transmits the user ID and fingerprint data as the authentication data to the authentication server  7  through the network  1  (step S 11 ). 
     The authentication server  7  reads out the authentication data from the authentication DB  71  by using the user ID, and carries out a well-known authentication processing by using the received authentication data and the read authentication data. The authentication server  7  transmits the authentication result to the terminal  5 , which is the transmission source of the authentication data. 
     The initial and end processing unit  511  of the sharing management program  51  in the terminal  5  receives the authentication result from the authentication server  7  (step S 13 ), and judges whether or not the authentication is successful (step S 15 ). When the authentication is failed, the processing returns to the step S 7 . However, because the event monitoring and recording have already been started, they continue as they do. Incidentally, when the authentication is failed, a counter is incremented by 1 to count the number of sequential failure times, and when the authentication is failed sequentially a predetermined number of times, the user ID may be revoked. 
     When the authentication is successful, the initial and end processing unit  511  transmits a policy request including the user ID of the user who carried out the login to the terminal use management server  3  (step S 17 ). The terminal use management server  3  receives the policy request including the user ID from the terminal  5 , reads out the policy data to be applied by searching the policy DB  31  by the received user ID, and replies the policy data to the terminal  5  of the requesting source. The policy data comprises a list of the business applications, which are allowed to be executed by the user who carried out the login, or a list of the business applications, which are prohibited from executing by the user, a list of the hardware (e.g. the external storage medium recorder  501 , the printer  502  and the like), which is prohibited from using by the user who carried out the login, and the like. 
     Incidentally, although it is not shown in the diagrams, because the recording of the log data is started at the step S 5 , the user ID of the user who carried out the login to the sharing management program  51  is also included into the log data, and registered into the log DB  33 . Therefore, even in a state where the user of the OS  53  is not changed, it is recorded that the user in the sharing management program  51  is changed. 
     The initial and end processing unit  511  of the sharing management program  51  in the terminal  5  receives the policy data corresponding to the user ID, and sets the policy data into the sharing management program  51  and the OS  53  (step S 19 ). For example, the policy data  514  for the business applications, which are allowed to be executed by the user who carried out the login or the business application, which are prohibited from executing is set to the sharing management program  51 , and the policy data  531  for the hardware is set to the OS  53 . Such sharing is a mere example, and all policy data may be set to the sharing management program  51 . The processing shifts to step S 21  of  FIG. 4  through a terminal A. 
     Next, the operation manager  513  shifts to a management state according to the policy data from the operation prohibition state (step S 21 ). For example, the operation manager  513  hooks a message in the OS  53 , which is generated by carrying out an operation to activate the business application  54 , to judge whether or not an activation of the allowed or prohibited business application, which is defined in the policy data, is instructed, and when it is judged that the activation of the business application, which is not allowed to be executed or is prohibited from executing, is instructed, the activation of the business application is suppressed. The activated application programs may be periodically identified, and when the business application  54 , which is prohibited from executing, is detected among them, the business application  54  may be terminated. The OS  53  also handles the hardware, which is prohibited from using, as being disabled, according to the set policy data. For example, when the push of the screen copy (i.e. Print Screen) key is prohibited, the push of the key is ignored in a case where the push of the key is detected. In addition, when the copy of the file or the like to the external storage medium is prohibited, for example, the copy operation to the external storage medium, which is prohibited, is ignored in a case where the copy operation is detected. In certain circumstances, the OS  53  makes the pertinent external storage medium recorder  501  unable to see from the user, or the OS  53  does not recognize the recorder  501 . In addition, even when the copy is allowed, a predetermined encryption may be carried out for the file. Furthermore, the output to the printer  502  may be prohibited. 
     Furthermore, the initial and end processing unit  511  reads the setting file  52  held in the storage device of the terminal  5 , and carries out an initial processing according to the settings in the setting files  52  (step S 23 ). One example of the setting file  52  is shown in  FIG. 5 . In the example of  FIG. 5 , the setting items include an authentication retry count (the permissible number of sequential times of the authentication failure), a no-operation monitoring time-out period (time until the log-off is automatically carried out), a dialog display position X (X coordinate in the previous display position of the dialog window of the sharing management program  51 ), a dialog display position Y (Y coordinate in the previous display position of the dialog window of the sharing management program  51 ), a login activation program (the business application  54 , which is automatically activated at the step S 23 ), a logout compulsive termination program (the business application  54 , which is compulsively terminated at the logout), a compulsive logout program (the business application  54  whose termination causes to automatically carry out the logout of the sharing management program  51 ), or the like, and values for each item are set. At the step S 23 , “IEXPLOR.EXE”, which is designated as the login activation program, is automatically activated. Plural login activation programs may be designated, and all designated business applications are activated in such a case. 
     By carrying out the processing until here, the user who carried out the login to the sharing management program  51  can freely carry out any allowed operations by using the keyboard and mouse  504 , and the log data for the operation, which was carried out, is recorded. That is, the operation manager  513  causes to execute the allowed operation according to the user&#39;s instruction as it is (step S 25 ). Incidentally, when the prohibited operation is carried out, the log data for the operation is recorded. Moreover, as for the window of the activated business application  54 , data of the title is acquired to record the log data indicating what window is opened. Thus, the user who carried out an operation, which leads to the information leakage, can be identified. 
     In addition, the initial and end processing unit  511  judges whether or not the no-operation time exceeds a threshold (specifically, the no operation monitoring time-out period) set in the setting file  52  (step S 27 ). That is, the user leaves the seat without carrying out the logout. When it is judged that the no-operation time exceeds the threshold, the processing shifts to the step S 35 . On the other hand, when it is judged that the no-operation time does not exceeds the threshold, the initial and end processing unit  511  judges whether or not the logout is explicitly instructed by the user (step S 29 ). When it is judged that the logout is explicitly instructed by the user, the processing shifts to the step S 35 . When it is judged that the logout is not instructed, the initial and end processing unit  511  judges whether or not the termination of the business application  54  (i.e. the business application  43  set as the compulsive logout program), which is set in the setting file  52  in advance, is instructed (step S 31 ). When it is judged that the termination of the business application  54 , which is set in the setting file  52  in advance, is not instructed, the processing shifts to the step S 25 . On the other hand, when it is judged that the termination of the business application  54 , which is set in the setting file  52  in advance, is instructed, the initial and end processing unit  511  terminates the business application  54 , which is set in advance, as the normal processing (step S 33 ). Thus, when the main object of sharing the terminal  5  is to use the business application  54 , which is set in the setting file  52  in advance, (or in a case where the execution of other business applications  54  is prohibited), and the system is in a state that the log-off or termination of the business application  54  should be carried out when the users are switched, this processing is effective. 
     When the affirmative judgment is carried out at the steps S 27  and S 29  or after the step S 33 , the operation manager  513  of the sharing management program  51  returns from the management state according to the policy data  514  to the operation prohibition state that any operation other than the predetermined operations such as the login to the sharing management program  51  are prohibited (step S 35 ). As a result, the user cannot have the business application  54  executed. In addition, the operation manager discards the policy data  514  and  531  (step S 37 ). As a result, the setting for the user who has been logged off is released, and the state returns to the default state. 
     Furthermore, the initial and end processing unit  511  carries out an end processing according to the settings of the setting file  52  (step S 39 ). There is a case where the logout compulsive termination program is defined in the setting file  52 . The access authority or the like may be set in the business application  54 , and the function and information the user can use may be different. In such a case, if the business application  54  is left activated when the user carries out the logout of the sharing management program  51 , there is a case where the user who carries out the login later to the sharing management program  51  accesses the information to which the access is prohibited, based on the authority of the user who previously carried out the logout. Thus, when the business application  43  is automatically terminated in response to the logout, the aforementioned problem does not occur. The processing shifts to a processing of  FIG. 6  through a terminal C. 
     When the operation manager  513  is in the operation prohibition state, only the predetermined operations such as the login to the sharing management program  51 , the shutdown of the OS  53  and the log-off of the OS  53  are allowed until another user carries out the login. For example, when the user inputs the shutdown instruction ( FIG. 6 : step S 41 ), the sharing management program  51  is terminated (step S 43 ), and the processing of the event monitoring recorder  512  is also terminated. After that, the OS  53  is shut down (step S 45 ). Incidentally, although it is not shown, when the log-off of the OS  53  is instructed, the processing returns to the boot-up of the OS  53  on the way of the step S 1 . In other cases, the processing returns to the step S 7  through the terminal B. Because the shutdown or the like can be carried out even when the sharing management program  51  is in the operation prohibition state, there is no need to take the trouble to carry out the login before the shutdown or the like. Accordingly, the job of the user is reduced. 
     Although the description is made again, the event monitoring recorder  512  transmits the log data to the terminal use management server  3  in response to the detection of the predetermined events such as the user&#39;s operation, from the step S 5  to the step S 43 , and the log data is stored into the log DB  33 . One example of the log data stored in the log DB  33  is shown in  FIG. 7 . In an example of  FIG. 7 , a terminal name, time, user ID in the sharing management program  51 , domain name, type of the event, distinction of whether or not it is prohibited operation, content of the operation are registered. In the example of  FIG. 7 , it is possible to grasp, from data in the column of the user ID, that the user of the OS  53 , who is “daiko”, exists in default, that the user who is “user01” uses between the thick lines  701  and  702 , and that the user who is “user02” is uses between the thick lines  703  and  704 . In addition, when referring to the column of the type, in this embodiment, it can be understood that such settings that events such as “get window title”, “activate application”, “terminate application”, “operate file” by the application activation or change of the display content are detected are carried out. Furthermore, from the column of the content, it is possible to identify what application program is activated, what window of what application program is displayed, and what file operation is carried out. In addition, from the column of the type and the column of the content, it is possible to identify the activation and termination of the application program and the screen transition. In the example of  FIG. 7 , at the record  705 , an application program, which is “Explorer”, was activated, and further terminated at the record  706 , and the screen transition between them such as “My Documents”, “Start Menu”, and “My Computer” in the record group  707 , “My Computer” in the record  708 , and “My Documents” in the record  709  is identified. As for the file operation, not only the types such as create, delete and change name, but also the file name of the target and the used application programs are recorded. Accordingly, the operation content of the user can be identified in detail. That is, it is possible to identify what user carried out the action, which leads to the information leakage. Incidentally, the sharing management program  51  according to this embodiment is shown as “SLBDTKJoin” in  FIG. 7 . 
     In the example of  FIG. 7 , the log data of the network access to the network  1  is not included, but it is possible to record the log data of the network access. In addition, in the example of  FIG. 7 , although it is described that only the application program name, such as “Explorer” is recorded, the process ID may be recorded, additionally. For example, by additionally recording the process ID like [Explorer (PID=1540)] it is possible to identify each process by the process ID (PID) even when the same program is duplicately activated. Therefore, an effect can be obtained that it is possible to easily identify to what process the operation content, which was additionally recorded, relates. 
     When the aforementioned processing is carried out, there is no need to carry out the login and logout to the OS  53  even in the terminal, which is shared by plural users. Accordingly, the user switching can be rapidly carried out. Although it takes about three minutes for the login of the OS  53 , it is possible to carry out the login in this embodiment by 5 seconds to about 10 seconds. This is because the environment of the OS  53  is shared except the portion set by the policy data  531  without resetting the environment of the OS  53  every user. In addition, there is no need to carry out any special change for the business application  54  when adopting this embodiment. Because, as described above, the log data is saved in detail, it is possible to identify the reason when any problem occurs later. Moreover, when it is made known to the users that the detailed log data is acquired, the prohibited acts can be suppressed. 
     Although one embodiment of this invention is described above, this invention is not limited this. For example, the log data for the change of the hardware configuration of the terminal  5  may be created and stored into the log DB  33 . In addition, when the activation of the service process, which is not the application program, is also managed, it is possible to suppress the activation of the virus and worm. Moreover, at least either of the function of the authentication server  7  and the function of the terminal use management server  3  may be held in the terminal  5 . 
     In addition, the functional blocks of the sharing management program  51  does not always correspond to the actual program modules.