JPS63263937A - network management system - Google Patents

Abstract

PURPOSE:To prevent illegal access by the maintenance operator by providing a memory recorded with an ID, access enable area information, and an access enable device or the like as to each of the maintenance operators. CONSTITUTION:The maintenance personnel inputs its own ID number, a pass word, access area information and a device of object to be accessed respectively to a console 4 in accessing prescribed devices CS, PS, MMM in networks 10-30. A network managing device 1 compares respectively the information sets with the ID number, pass word, access area information and access enable device for each maintenance operator stored in advance in the operator file 2 and permits the access to the maintenance operator when the both are coincident and inhibits the accessing in case of dissidence. Thus, illegal access by the maintenance operator can be prevented.

Description

DETAILED DESCRIPTION OF THE INVENTION [Field of Industrial Application] The present invention relates to a network management system, and particularly to a network management system that controls and monitors exchanges, transmission control equipment, terminals, etc. in a network.

[Conventional technology]

In recent years, as the amount of information has increased and become larger, networks have also spread to various regions. A network management system is required to control and monitor various devices within such a network. Maintenance operators will use this network management system to control and monitor various devices in various regions.

[Problem that the invention seeks to solve]

However, traditional network management systems have
There is a problem in that unauthorized access by maintenance operators is easy. In conventional network management systems, each maintenance operator must enter a predetermined password when starting work.

However, if this password is correct, all devices in all regions connected to this network management system can be accessed freely, and any business can be performed. As mentioned above, networks are likely to expand rapidly in the future, and it is a major problem that all access to these networks can be accessed by just one person who maintains and operates them. Even maintenance operators who only have jurisdiction over a specific region can physically access networks in other regions, so they can easily steal billing information, subscriber data, etc. from other regions. can.・Furthermore, it is also possible for a maintenance operator who is given only certain business authority to perform work that is not within his or her authority. The possibility of such unauthorized access impairs network security and poses a major social problem.

Therefore, an object of the present invention is to provide a network management system that can prevent unauthorized access and ensure the safety of information.

[Means for solving problems]

The present invention provides a work management system for controlling and monitoring various devices in a network that spans multiple regions. a storage device that stores accessible regional information and accessible device information; a console that performs human output for each operator to access the network;
ID input from this console
fication) The storage device is searched based on the number, password, accessible area information, and accessible device information, and only if the entered information matches the stored information, the entered area information is searched. The system is equipped with a network management device that enables access to devices corresponding to the input device information in the region corresponding to the region.

〔Example〕

The present invention will be described below based on illustrated embodiments.

FIG. 1 is a block diagram of a network management system according to an embodiment of the present invention. The network management device 1 manages networks within a first region 10, a second region 20, and a third region 30. A basket switch PS, a circuit switch C8, and a multimedia multiplexer MMM are connected to the network within each region. The network management device 1 has a function of controlling and monitoring these devices. An operator file 2 and a business security file 3 are connected to this network management device 1 as a storage device, and a console 4 is connected as an input/output device (man-machine interface). Each maintenance operator (hereinafter referred to as an operator) operates this console 4 to access the network.

In the operator file 2, for example, FIGS. 2(a) and (b)
Information as shown in FIG. 2(C) is stored in the business security file 3, for example, as shown in FIG. 2(C).

FIG. 2(a) is a table showing the correspondence between each operator's ID number, password, and work level. For example, the first operator has the ID number "ID 1",
Password “A AΔΔΔ″, Business level ゛' 02
In addition, FIG. 2(b) is a table showing accessible area information for each operator. Here, the second operator given the ID number "I D 2 '" A regional information table is shown for each region, i.e. accessible for each region.”
"Y" or "N" is not accessible.
In this example, the second operator can access areas 1, 5, and 6 (in Figure 1, areas 4 to 6).
(areas not shown).

On the other hand, FIG. 2(C) shows the business content corresponding to the business level j shown in FIG. 2(a), that is, the names of accessible devices. For example, work level "01"'
is a service that accesses only the packet switch PS, while service level "05" is a service that accesses the packet switch PS and circuit switch C8.

In addition, each table information in FIG. 2 mentioned above, that is, operator file 2 and business security file 3
The contents of the memory will be determined in advance by taking into consideration the area of jurisdiction and business authority of each operator.

FIG. 3 is a flowchart showing the management operation of the network management system shown in FIG. When an operator wishes to access some device using this network management system, he or she will enter a predetermined input into the console 4. That is, first, the operator's ID number is input in step (2), then the password is input in step (2), and then the object to be accessed is selected in step (2).

Now, for example, an operator who has jurisdiction over the region 1.5.6 and has business authority to access the packet switch PS and the circuit switch CS (the second operator in the file in Figure 2)
An explanation will be given of a case where an operator of the network accesses the packet switch PS in the first region 10. in this case,
In step ■, the ID number "ID 2" is input, and in step ■, the password ``' B B B B
B” is input, and in step ■, the first region 10
The packet switch PS within is selected as the object of access.

Based on these inputs, the network management device 1 first searches the table shown in FIG. 2(a) in the operator file 2. Then, in step (2), it is determined whether the input operator ID number is registered. Subsequently, in step (2), it is determined whether the password corresponding to this ID number and the input password match. In either case, a negative judgment (
If N) is performed, the operation must be restarted from the beginning.

In this example, since the ID number "ID 2" and the password "B B B B B"' match those in the operator file 2, further step
It is determined whether the area where the object is located can be controlled.

That is, as shown in FIG. 2(b), the table for the second operator is searched, and it is determined whether the first area is accessible. In this example, since the determination is affirmative (Y), it is further determined in step (2) whether or not work on the object is permitted. That is, the network management device 1 has the operator file 2!
Therefore, by recognizing that the business level of this operator is '05' and further searching the business security file 3, it is possible to identify the business whose business level '05' can access the packet switch @Ps and the circuit switch C8. δ is aware that it is. Since the device selected in step ■ is the packet switch PS, in this example, the judgment in step S7 is affirmative, and the process proceeds to step ■, where the control and monitoring process of the object is performed, that is, the device is transferred to the packet switch PS. is accessed.

However, when this operator tries to gain unauthorized access, he is unable to do so. for example,
If you are trying to access a device in a second region 20 that is outside your jurisdiction, and you select the second region 20 in step ■, the table in Figure 2 (b) is referenced in step ■, and this The area will be deemed out of control and operations will have to start over from the beginning. Furthermore, if you are attempting to access a multimedia multiplexing device M 114 M to which you are not given business authority and select this multimedia multiplexing device M 114 M in step (2), then in step (2), the access shown in FIG. The table in (C) is referenced, and it is determined that this work is not permitted.
You will have to start over from the first operation.

In this way, operators are always able to access the network only within the scope of jurisdiction and business content registered in advance in operator file 2 and business security file 3, and unauthorized access is physically prohibited. .

Note that the table in FIG. 2 is shown as an example for convenience of explanation, and the present invention is not limited to such a file structure. In the block diagram of FIG. 1, devices to be accessed include a packet switch PS, a circuit switch O8, and a multimedia multiplexer MM.
Although an example using M is shown, the present invention is also applicable to controlling and monitoring various devices connected to a network.

〔Effect of the invention〕

As described above, according to the present invention, the network management system j is provided with a storage device for storing ID numbers, passwords, accessible area information, and accessible device information, and is configured to match information input from an operator. Since the information is determined before access is performed, unauthorized access can be prevented and the security of information can be ensured.

[Brief explanation of drawings]

Fig. 1 is a block diagram of a network management system according to an embodiment of the present invention, Fig. 2 is a table showing an example of file contents of the device shown in Fig. 1, and Fig. 3 shows the operation of the device shown in Fig. 1. This is a flowchart. 1...Network management device, 2...
Operator file, 3...Business security file, 4...
...Console, 10...First region, 20.
...Second region, 30...Third region,
C8...Line switching equipment, MMM...Multimedia multiplexing device, PS/
...Packet switch. Applicant: NEC Corporation, Japan Telecommunications Systems Co., Ltd., Agent

Claims (1)

[Claims] A network management system for controlling and monitoring various devices in a network spanning multiple regions, and for each operator accessing the network, ID number, password, accessible region information, and a storage device that stores accessible equipment information; a console that performs input/output for each operator to access the network; and an ID number, password, accessible area information input from the console, and accessible information. The storage device is searched based on the device information, and only when the input information and the stored information match, the device information corresponding to the input device information in the region corresponding to the input region information is searched. A network management system comprising: a network management device that enables access to devices.