JP2005055998A - Access right setting device, access right setting method, and program therefor - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide an access right setting device for supporting the setting of consistent access rights. <P>SOLUTION: When a plurality of access rights for a document file are set, the access right setting device 2 preliminarily stores priority information to designate the priority order of the access rights, detects the overlapped part where the setting conditions of the plurality of access rights overlap, decides whether or not the contents of the access rights are inconsistent for the detected overlapping part, and decides which access right should be validated on the basis of the stored priority information when they are inconsistent. <P>COPYRIGHT: (C)2005,JPO&NCIPI

Description

[0001]
BACKGROUND OF THE INVENTION
The present invention relates to an access right setting device that sets a plurality of access rights for a document file, an access right setting method, and a program therefor.
[0002]
[Prior art]
A plurality of access rights may be set for a plurality of areas included in the document file. For example, an access right that designates two or more types of authority (permission / non-permission such as browsing, editing, or copying) is set for a plurality of document areas. In addition to the document area, an access right may be set by specifying a target person, a validity period, and the like.
In this way, when the access right is set with multiple conditions (area, target person, validity period, etc.) intermingled with each other, if these conditions are simply listed and displayed, It is difficult to grasp and there may be a discrepancy between the set access rights.
[0003]
[Problems to be solved by the invention]
The present invention has been made from the above-described background, and an object thereof is to provide an access right setting device, an access right setting method, and a program thereof that support setting of access rights without contradiction.
[0004]
[Means for Solving the Problems]
[Access right setting device]
In order to achieve the above object, an access right setting device according to the present invention is an access right setting device that sets a plurality of access rights for a document file, and stores priority information that specifies the priority order of the access rights. Storage means, an overlap detection means for detecting an overlap portion where a plurality of access right setting conditions overlap, and an overlap portion detected by the overlap detection means based on priority information stored by the storage means. And determining means for determining whether to enable the access right.
[0005]
Preferably, it further includes a match determination unit that determines whether or not the authority given by the access right matches the overlapping portion detected by the overlap detection unit, and the determination unit includes the match determination unit. It decides which access right is to be validated for the overlapped portion determined to have different rights.
[0006]
Preferably, the access right setting condition includes a condition for designating an area in the document, the duplication detection means detects an overlapping area where the respective access right setting areas overlap, and the determination means It decides which access right is to be validated for the overlap area detected by the overlap detection means.
[0007]
Preferably, the setting condition of the access right includes a condition for designating a target person of the access right, the duplication detection means detects a duplication target person in which the respective right of access right overlaps, and the determination means And determining which access right to validate for the duplication target person detected by the duplication detection means.
[0008]
Preferably, the access right setting condition includes a condition for designating an effective period of the access right, the duplication detecting unit detects an overlapping period in which the effective periods of the respective access rights overlap, and the determining unit includes: Which setting condition is to be validated is determined for the overlap period detected by the overlap detection means.
[0009]
Preferably, when an overlapping part of the setting condition is detected by the duplication detection unit, the storage unit further includes an input unit that receives input of priority information for the access right of the overlapping part. The input priority information is stored, and the determination unit determines which access right is to be validated based on the priority information stored by the storage unit.
[0010]
Preferably, the apparatus further comprises notification means for notifying the access right setter of the detected overlapping portion when the overlapping portion is detected by the overlapping detection means, and the input means detects the overlapping portion by the notification means. When notified, input of priority information is accepted.
[0011]
Preferably, the storage means stores priority information for activating the access right with the least right to be granted, and the determining means is based on the priority information for the duplicate portion detected by the duplicate detection means. And decide to enable the access rights with the fewest privileges.
[0012]
Preferably, the storage means stores priority information for activating an access right having the highest authority to be granted, and the determining means is based on the priority information for the duplicate portion detected by the duplicate detection means. And decide to enable the access rights that have the most privileges.
[0013]
Preferably, the storage unit stores priority information for activating the access right having the most authority to be granted for the access right having the overlap area or the overlap period, and the determination unit stores the priority information in the priority information. Based on this, it is determined to enable the access right having the most authority to be granted for the overlap area or the overlap period.
[0014]
[Access right setting method]
The access right setting method according to the present invention is an access right setting method for setting a plurality of access rights for a document file, and detects and detects an overlapping portion where a plurality of access right setting conditions overlap. For the overlapped portion, a database storing priority information for specifying the priority order of access rights is referred to, and which access right is to be validated is determined based on the priority information stored in advance in this database.
[0015]
[program]
Further, a program according to the present invention includes a step of detecting an overlapping portion where a plurality of access right setting conditions overlap in an access right setting device that includes a computer and sets a plurality of access rights to a document file. A step of referring to a database in which priority information for specifying the priority order of access rights is stored for the overlapping portion, and determining which access right is to be validated based on the priority information stored in advance in the database; Is executed by the computer of the access right setting device.
[0016]
DETAILED DESCRIPTION OF THE INVENTION
[background]
First, in order to help understanding of the present invention, the background will be described with specific examples.
For example, in the case where a document file includes a plurality of confidential parts, permission / prohibition (authority) such as browsing (View), printing (Print), copying (Copy), and editing (Edit) for these confidential parts. ) Is set as the access right. In addition, the access right may be set for each confidential portion of the document file by designating a viewer and a valid period.
In this way, when access rights are set for multiple confidential parts included in a document file under multiple conditions (target person and validity period, etc.), the conditions for the set access rights are mixed, Confirmation becomes difficult. Therefore, even if a plurality of set access rights contradict each other in the overlapping part, there is a possibility that this is not noticed.
[0017]
Therefore, the access right setting device 2 according to the present embodiment detects an overlapping portion of the setting conditions, and determines which access right is to be validated according to the pre-registered priority information for the detected overlapping portion. In addition, when it is impossible to determine which access right should be validated with the pre-registered priority information, the access right setting device 2 notifies the access right setter of the overlapping portion and prompts the input of the priority information. .
[0018]
[Embodiment]
Next, an embodiment of the present invention will be described.
FIG. 1 is a diagram illustrating a hardware configuration of an access right setting device 2 to which an access right setting method according to the present invention is applied.
As shown in FIG. 1, the access right setting device 2 includes a control device 20 including a CPU 202 and a memory 204, a communication device 22, a printer 23, a recording device 24 such as an HDD / CD device, and an LCD display device or a CRT display. A user interface device (UI device) 26 including a device and a mouse / keyboard / touch panel.
[0019]
[Access right setting program 5]
FIG. 2 is a diagram showing the configuration of the access right setting program 5 that is executed by the control device 20 (FIG. 1) and implements the access right setting method according to the present invention.
2, the access right setting program 5 includes a user interface unit (UI unit) 510, a setting input unit 520, a setting condition database (setting condition DB) 530, a duplication detection unit 540, a coincidence determination unit 550, a priority. An information database (priority information DB) 560 and a determination unit 570 are included.
The access right setting program 5 is supplied to the control device 20 via, for example, the recording medium 240 (FIG. 1) or the network, loaded into the memory 204, and executed.
[0020]
In the access right setting program 5, the UI unit 510 controls the mouse or keyboard of the UI device 26 (FIG. 1), accepts input of access right setting conditions, and outputs it to the setting input unit 520. In addition, the UI unit 510 controls the display device of the UI device 26 to display a “setting screen” (not shown) or a “fogging notification screen” (described later), and accepts an input of an access right setter for this. .
[0021]
The setting input unit 520 sets an access right for the selected document file in accordance with the setting condition input from the UI unit 510, and updates a setting table (described later) in the setting condition DB 530.
[0022]
The duplication detection unit 540 refers to the setting table stored in the setting condition DB 530, detects an overlapping portion of the setting conditions, and outputs it to the coincidence determination unit 550. An overlapping part of setting conditions is a part where access right setting conditions (area in document, target person, validity period, etc.) are common, for example, a plurality of access rights are set in the same document area. Or when multiple access rights are set for the same target person. In particular, if the scope of the target is treated as a group that overlaps with each other such as employee category (managerial positions, general employees, etc.), job type (technical, sales, general affairs, personnel, etc.), gender, age, etc. Overlap is likely to occur.
[0023]
The coincidence determination unit 550 determines whether the authority given by the access right matches or does not coincide with the overlapping portion input from the duplication detection unit 540, and outputs the determination result to the UI unit 510 and the determination unit 570. When there are a plurality of authorities such as browsing, printing, copying, and editing, the coincidence determination unit 550 determines, for example, whether or not all authorities coincide. Note that the match determination unit 550 may determine match / mismatch only for a part of authority specified in advance.
[0024]
The priority information DB 560 stores priority information of access rights. The access right priority information is information for designating which access right should be validated for overlapping portions of setting conditions, and is input in advance by an access right setter.
For example, the priority information DB 560 stores priority information for activating the access right with the least right to be granted when the confidentiality of the document file is high and it is necessary to carefully set the access right. Further, the priority information DB 560 stores priority information for validating the access right having the most authority to be granted when importance is attached to the facilitation of work.
[0025]
When it is input from the match determination unit 550 that there is a mismatch, the determination unit 570 refers to the priority information DB 560 to determine an access right to be validated for the overlapping portion of the setting condition, and determines the determined access right. In order to validate, the setting table in the setting condition DB 530 is updated.
[0026]
FIG. 3 is a diagram illustrating a setting table 532 stored in the setting condition DB 530.
As illustrated in FIG. 3, the setting condition DB 530 includes an access right setting number (access right No), an area in the document in which the access right is set (confidential part), and a range of subjects to which the access right is set (target A setting table 532 that associates the authority granted by the access right (authority contents) and the validity period of the access right.
“Access right No” is a serial number assigned in the order of input of access right setting information (right and setting conditions), and is used as identification information of the access right.
The “confidential part” indicates an area in the document to which an access right is set.
“Target person range” indicates the range of the target person to whom the access right is set, and is input as a group to which the target person belongs, for example, “manager A” or “technical staff A”. The target group may be classified based on different criteria. For example, a group such as “manager” or “general employee” classified by job rank and “technology” classified by job type A group such as “responsible” or “sales representative” may coexist as a group.
“Authority content” indicates specific contents of the authority given by the access right. For example, “V” and “E” indicate that browsing is possible and editing is possible, and “ALL” is browsing, printing, Indicates that all duplication and editing is possible.
“Effective period” indicates the effective period of the set access right. When the effective period is not specified (in the case of “null”), it indicates that the access right is valid indefinitely. The validity period is indefinite with no start and end dates, only with the start date of the period, only with the end date of the period, and with the start and end dates of the period. Including things.
[0027]
FIG. 4 is a diagram illustrating the priority information stored in the priority information DB 560. (A) illustrates the priority information corresponding to each area in the document, and (B) corresponds to the target person group. The priority information is illustrated, and (C) illustrates the priority information corresponding to the valid period.
As illustrated in FIG. 4A, the priority information DB 560 stores priority information that specifies an access right (a combination of authorities) to be prioritized in association with an area in a document. Thereby, it is possible to define an access right setting policy according to the sensitivity of each area.
The determining unit 570 refers to the priority information corresponding to the area in the document, and validates the access right that gives the authority with a higher priority for the overlapping portion.
Note that the priority information DB 560 may store priority information that determines an access right to be activated in accordance with the inclusion relationship of the areas in the document. For example, when the first area is included in the second area, the priority information DB 560 activates the access right set in the first area (that is, the access right set in a narrower area). Store priority information.
[0028]
As illustrated in FIG. 4B, the priority information DB 560 stores priority information for designating an access right to be prioritized in association with the target person's group. Thereby, an access right setting policy can be defined for each group of target persons.
The determination unit 570 refers to the priority information corresponding to the group of the target person, and validates the access right that grants the authority with a high priority for the overlapping portion.
[0029]
As illustrated in FIG. 4C, the priority information DB 560 stores priority information for designating an access right to be given priority in association with an effective period of the access right. Thereby, an access right setting policy can be defined for each period. For example, when the effective period is longer than a predetermined value, the confidentiality is often high, and thus the access right with the least authority is enabled.
The determination unit 570 refers to the priority information corresponding to the group of the target person, and validates the access right that grants the authority with a high priority for the overlapping portion.
[0030]
FIG. 5 exemplifies priority information between subject groups stored by the priority information DB 560.
As illustrated in FIG. 5, the priority information DB 560 stores a priority order between target person groups that overlap each other. Thereby, even if the same subject belongs to a plurality of groups, the access right can be set without contradiction. For example, when the access right setting condition set for the “technical staff” and the access right setting condition set for the “general employee” overlap, the determination unit 570 determines the priority of this example. For the target person who is “technical staff” and “general employee” with reference to the information, the access right set as “technical staff” is validated.
[0031]
[Access right setting operation]
Hereinafter, the overall operation of the access right setting device 2 will be described.
FIG. 6 is a flowchart showing the operation (S10) of the access right setting device 2 (access right setting program 5).
As shown in FIG. 6, in step 100 (S100), the setting person who sets the access right to the document file uses the UI device 26 (FIG. 1), and the area (confidential part) in the document, the coping person, and When the authority content (V, E, etc.) is input with the effective period specified, the in-document area, the target person, the effective period, and the authority content are output to the setting input unit 520 as access right setting information.
The setting input unit 520 sets an access right for the document file according to the input access right setting information, and updates the setting table 532 of the setting condition DB 530.
[0032]
In step 105 (S105), when detecting the update of the setting table 532 in the setting condition DB 530, the duplication detection unit 540 detects an overlapping portion of the setting condition and outputs it to the coincidence determination unit 550. Specifically, the duplication detection unit 540 detects a portion in which all of the in-document region, the target person, and the effective period are common as an overlapping portion.
[0033]
In step 110 (S110), the coincidence determination unit 550 selects one of the overlapping portions input from the duplication detection unit 540, and specifies the content (authority) of each access right set in the overlapping portion. Subsequently, the matching determination unit 550 determines whether or not the specified authorities match each other.
In step 115 (S115), when at least one authority set for the overlapping portion is different, the coincidence determination unit 550 outputs information indicating the overlapping portion to the UI unit 510 and the determination unit 570. Transition to processing. In addition, the match determination unit 550 proceeds to the process of S150 when all of the authorities set in the overlapping portion match.
[0034]
In step 120 (S120), the UI unit 510 (notification unit) displays the “fog notification screen” on the UI device 26 (FIG. 1) when information indicating the overlapping portion is input from the match determination unit 550. Notify the setter of the overlap.
[0035]
In step 125 (S125), when information indicating an overlapping portion is input from the coincidence determination unit 550, the determining unit 570 searches the priority information corresponding to the overlapping portion with reference to the priority information DB 560.
The access right setting program 5 shifts to the process of S140 when priority information is found, and shifts to the process of S130 in other cases.
[0036]
In step 130 (S130), when the UI unit 510 (notification unit) inputs from the priority information DB 560 that priority information has not been found, the UI unit 510 (notification unit) displays a message prompting the user to input priority information on the “cover notification screen”. To do.
In step 135 (S135), the UI unit 510 (input means) accepts input of priority information and writes it in the priority information DB 560.
[0037]
In step 140 (S140), the determination unit 570 refers to the priority information stored in the priority information DB 560 and determines an access right to be validated for this overlapping portion.
In step 145 (S145), the determination unit 570 notifies the setting condition DB 530 of the access right that has been determined to be enabled, and updates the setting condition or authority in the setting table 532. Further, the UI unit 510 notifies the setter of the activated access right on the “cover notification screen”.
In step 150 (S150), the access right setting program 5 determines whether or not the access right to be validated for all the overlapping parts has been determined, and if it has been determined for all the overlapping parts, the process is terminated. In other cases, the process returns to S110, and then an overlapping portion is selected.
[0038]
In this way, the access right setting program 5 detects the overlapping part of the setting condition, selects the overlapping part where the access right contradicts from the detected overlapping part, and determines the access right to be activated for this overlapping part. To do.
[0039]
[Cover notification screen]
FIG. 7 is a diagram illustrating a fog notification screen 600 displayed by the UI unit 510.
As illustrated in FIG. 7, the UI unit 510 displays a fog notification screen 600 including a preview screen 610, a detailed information area 620, and a result display area 630.
A document file is displayed on the preview screen 610. The UI unit 510 displays the range of the area 612a and the area 612b in which the access right is set in the preview screen 610, and reverse-displays the overlapping portion. Further, the “access right No” set in the reverse display portion is displayed as a duplicate notification message 614.
In addition, the UI unit 510 displays the setting condition and authority for the overlapping portion in the detailed information area 620. The detailed information area 620 is a clickable area, and receives designation of priority access rights as priority information in response to a click. When the UI unit 510 detects a setting person's click in the detailed information area 620, the UI unit 510 reverses the display to indicate that the access right has been preferentially applied. Also, the UI unit 510 displays the priority-applied access right in the result display area 630.
[0040]
As described above, the access right setting device 2 according to the present embodiment detects an overlapping part of setting conditions, selects an overlapping part having an inconsistent access right from the detected overlapping parts, and enables the overlapping part. Determine access rights In addition, the access right setting device 2 displays the fog notification screen 600, notifies the overlapping portion, and accepts input of priority information.
[0041]
【The invention's effect】
As described above, the access right setting device according to the present invention supports setting of access rights without contradiction.
[Brief description of the drawings]
FIG. 1 is a diagram illustrating a hardware configuration of an access right setting device 2 to which an access right setting method according to the present invention is applied.
FIG. 2 is a diagram showing a configuration of an access right setting program 5 that is executed by the control device 20 (FIG. 1) and implements the access right setting method according to the present invention.
FIG. 3 is a diagram illustrating a setting table 532 stored in a setting condition DB 530;
FIGS. 4A and 4B are diagrams illustrating priority information stored in the priority information DB 560, in which FIG. 4A illustrates priority information corresponding to each area in the document, and FIG. 4B corresponds to a target person group; The priority information is illustrated, and (C) illustrates the priority information corresponding to the valid period.
FIG. 5 is a diagram illustrating priority information between subject groups stored in a priority information DB 560;
FIG. 6 is a flowchart showing an operation (S10) of the access right setting device 2 (access right setting program 5).
7 is a diagram illustrating a fog notification screen 600 displayed by a UI unit 510. FIG.
[Explanation of symbols]
2 ... Access right setting device 5 ... Access right setting program 510 ... UI unit 520 ... Setting input unit 530 ... Setting condition database 540 ... Duplicate detection unit 550 ... Match determination unit 560 ... Priority information database 570 ... Determination unit 600 ... Cover notification screen

Claims (13)

An access right setting device for setting a plurality of access rights for a document file,
Storage means for storing priority information for specifying the priority order of access rights;
A duplication detection means for detecting an overlapping portion where a plurality of access right setting conditions overlap;
An access right setting device comprising: a determination unit that determines which access right is to be validated based on the priority information stored in the storage unit for the overlapping portion detected by the duplication detection unit. For the duplicate portion detected by the duplicate detection means, further comprises a match determination means for determining whether or not the authority given by the access right is matched.
The access right setting device according to claim 1, wherein the determining unit determines which access right is to be validated with respect to an overlapping portion that is determined to have different authority by the match determination unit. The access right setting condition includes a condition for specifying an area in the document,
The duplication detection means detects an overlapping area where the setting areas of the respective access rights overlap,
The access right setting device according to claim 1, wherein the determining unit determines which access right is to be validated for the overlapping area detected by the duplication detecting unit. The storage means stores priority information that associates the inclusion relationship of the areas in the document with the priority order, and
The determination unit determines which access right is to be validated based on a priority associated with the inclusion relationship when an area in the inclusion relationship is detected by the duplication detection unit. The access right setting device described in 1. The access right setting condition includes a condition for specifying a target person of the access right,
The duplication detection means detects a duplication target person who overlaps each access right target person,
The access right setting device according to claim 1, wherein the determination unit determines which access right is to be validated for the duplication target person detected by the duplication detection unit. The access right setting condition includes a condition for designating a validity period of the access right,
The duplicate detection means detects an overlap period in which valid periods of respective access rights overlap,
The access right setting apparatus according to claim 1, wherein the determination unit determines which setting condition is to be validated for the overlap period detected by the overlap detection unit. In the case where an overlapping part of the setting condition is detected by the duplication detection means, it further has an input means for receiving input of priority information for the access right of the overlapping part,
The storage means stores the priority information input by the input means,
The access right setting device according to any one of claims 1 to 6, wherein the determination unit determines which access right is to be validated based on the priority information stored by the storage unit. A notification means for notifying the access right setter of the detected overlapping portion when an overlapping portion is detected by the overlapping detection means;
The access right setting device according to claim 7, wherein the input unit receives input of priority information when an overlapping part is notified by the notification unit. The storage means stores priority information for activating an access right with the least right to be granted,
7. The determination unit according to claim 1, wherein, based on the priority information, the determination unit determines to enable the access right with the least amount of authority for the overlapping portion detected by the duplication detection unit. Access right setting device. The storage means stores priority information that activates an access right having the most authority to be granted,
7. The determination unit according to claim 1, wherein the determination unit determines to activate the access right having the highest authority to be granted based on the priority information for the overlapping portion detected by the duplication detection unit. Access right setting device. The storage means stores priority information for activating the access right having the most authority to be granted for the access right having the overlap area or the overlap period,
The access right setting device according to claim 3 or 6, wherein the determining means determines to activate an access right having the highest authority to be granted for the overlapping area or the overlapping period based on the priority information. An access right setting method for setting multiple access rights for a document file,
Detect overlapping parts where multiple access rights setting conditions overlap,
For the detected overlapping portion, a database in which priority information for specifying the priority order of access rights is stored is referred to, and which access right is to be validated based on the priority information stored in advance in this database. Access right setting method. In an access right setting device including a computer and setting a plurality of access rights to a document file,
Detecting an overlapping portion where a plurality of access right setting conditions overlap; and
For the detected overlapping portion, a database in which priority information for specifying the priority order of access rights is stored is referred to, and which access right is to be validated based on the priority information stored in advance in this database. A program for causing the computer of the access right setting device to execute the step.

Images