JP2008243172A - Access authority control system - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide an access authority control system, making determination by referring to an operational log information of a file in determining the access authority of the file. <P>SOLUTION: This access authority control system includes: an inquiry accepting part for accepting an inquiry about user's access permission/non-permission to a file and file identification information of the file; an operational log information storage part for storing an operation log information at least to the file; an operational log information acquiring part for acquiring corresponding operation log information from the operational log storage part based on the accepted file identification information; an access permission/non-permission determination part for determining the user's access authorization to the file using at least the acquired operation log information; and a result transmission part for transmitting control instruction based on the determination result to an access control part. <P>COPYRIGHT: (C)2009,JPO&INPIT

Description

The present invention relates to an access authority control system that controls access authority of files and the like. In particular, the present invention relates to an access authority control system that performs the determination by referring to the operation log information of the file when determining the access authority of the file.

  When a file is used in an organization such as a company, since there are files including confidential information, it is common that access authority is set for each file. For example, general files such as company newsletters are set to the lowest access level (for example, all employees) because there is no particular problem for anyone to see, and files such as personnel appraisal are evaluated for individual employees. Because it is included, it is set to an access authority level that can be seen only by the human resources department or the responsible manager, and the file related to the top secret project is set to an access authority level that can be accessed only by those who are involved in the project.

  As described above, management of access authority to a file is very important, and there are Patent Document 1 and Patent Document 2 described below as systems for automatically managing the access authority.

  The invention of Patent Document 1 records both log information and access authority with respect to access authority when referring to log information that is a file, and log information only for a user having access authority included in the log information. It is a system that permits reference to

  In the invention of Patent Document 2, the access authority when referring to log information that is a file is recorded in different files so that the access authority is referred to when referring to the log information. It is a system that reflects even if it is changed.

JP 2000-29751 A JP 2006-23924 A

  It is advantageous in that the access authority can be managed by using the systems of Patent Document 1 and Patent Document 2 described above.

  However, if the contents of a file subject to access authority, such as the file name, have been changed, the access authority of the original file cannot be confirmed, and the file can be opened as it is.

  For example, when the “reference file” is opened after changing the file name “HR evaluation” to a file name “reference file” by some method, the inventions of Patent Document 1 and Patent Document 2 may be used. Because the access authority corresponding to the “reference file” is not set, even if the file is the same as the “Personnel Review” file, even if the user does not have access authority You can refer to the file.

  In order to prevent such a situation, processing related to a file, such as a file name change by a user who does not have access authority, cannot be executed. However, for example, a user with access authority leaves the file while using the file, and a third party without access authority changes the file name during that time, or a user with access authority mistakes the file name. May be changed and saved. In such a case, it is not possible to cope with the conventional method.

  Therefore, the present inventor does not simply check the access authority as in the past, but checks the operation history for the file by referring to the log information of the file to be referred to, and the progress of the process for the file. Based on this, we invented an access authority control system that determines access authority.

  The invention of claim 1 is an access authority control system for determining access authority using operation log information for a file, the access authority control system including an inquiry about whether or not the user can access the file and the file An inquiry receiving unit that receives file identification information, an operation log information storage unit that stores at least operation log information for a file, and corresponding operation log information based on the received file identification information from the operation log information storage unit The operation log information acquisition unit to be acquired, and the access for determining the access authority to the file by the user according to the operation log information acquisition result corresponding to the received file identification information in the operation log information acquisition unit A control instruction based on the determination unit and the determination result, A result transmitting unit that transmits to the access control unit that performs an access control process for Airu, the access authorization control system having a.

  By using the present invention, instead of simply determining whether or not there is an access right as in the prior art, processing is performed after confirming operation log information which is an operation history for the file. As a result, the access authority can be determined in consideration of the progress of the processing for the file.

  In the invention of claim 2, the access permission determination unit has an access authority when the operation log information acquisition unit cannot acquire operation log information corresponding to the received file identification information from the operation log information storage unit. It is an access authority control system that judges that there is no.

  There are various methods for determining access authority using operation log information, and the method of the present invention can be used. When the operation log information of the file does not exist, it is assumed that the file is brought in from the outside by a portable storage medium such as a USB memory. Accordingly, there is a possibility that a file infected with a virus, a file that should not be permitted to be used, such as a key logger or file exchange software, may be executed on the user's client terminal. However, as in the present invention, a file without operation log information does not have access authority and can be disabled at the client terminal, so that it is possible to prevent the file from being brought in from the outside.

  In the invention of claim 3, when there is information indicating a change in file identification information in the operation log information acquired by the operation log information acquisition unit from the operation log information storage unit, First, the access authority is determined using the file identification information after the change. If the access authority cannot be determined using the file identification information after the change, the access authority is determined using the file identification information before the change. , An access authority control system.

  There are various methods for determining access authority using operation log information, and the method of the present invention can be used. The file name may be changed by some method. In such a case, the conventional access privilege control method can only set the access privilege with a new file name, or change the original file name to a new file name and update the access privilege. . However, setting the access authority is complicated and may be forgotten. In that case, no access authority is set for the new file name after the change, and anyone can access it. However, according to the present invention, the operation log information can identify the operation history indicating that the file identification information such as the file name has been changed, so that the conventional work as described above need not be performed.

  In the invention of claim 4, the access authority control system further includes a user information storage unit that stores at least user identification information and access authority level information of each user, and the access permission determination unit includes: In the operation log information acquired from the operation log information storage unit by the operation log information acquisition unit, if there is information indicating a change in file identification information, the user information storage is performed using the changed file identification information. If the access authority level is stored, the access authority level is determined using the access authority level, and if not stored, the user authority is determined using the file identification information before the change. It is determined whether it is stored in the information storage unit, and if it is stored, the access authority level is determined using the access authority level. Cormorant, which is the access authority control system.

  There are various methods for determining access authority using operation log information, and the method of the present invention can be used. The invention of claim 3 can obtain the same effect even if it is configured as in the present invention.

  In the invention of claim 5, the inquiry receiving unit further receives information on the creation date / time or update date / time of the file at the time of the inquiry, and the access permission determination unit is configured to determine whether the file in the acquired operation log information An access authority control system that compares information on creation date / time or update date / time with information on file creation date / time or update date / time received by the inquiry reception unit, and determines access authority based on whether or not they match. It is.

  There are various methods for determining access authority using operation log information, and the method of the present invention can be used. If the received file creation date and update date information does not match the file creation date and update date information in the file operation log information, it is inferred that some operation other than the client terminal has been performed. And it is guessed that the user brought the file after the operation from the outside with a portable storage medium such as a USB memory. Therefore, the file may be infected with a virus. However, as in the present invention, a file without operation log information does not have access authority and can be disabled at the client terminal, so that it is possible to prevent the file from being brought in from the outside.

  In the invention of claim 6, the access permission determination unit stores an access authority determination method for each user identification information, and the access authority determination method is based on the user identification information received by the inquiry reception unit. It is an access authority control system to identify.

  Although the above-described determination methods can be used for the determination of access authority, the present invention is not limited to this, and a plurality of determination methods may be used. In that case, the determination method may be changed for each user. For example, in the case of a user who has a history of bringing files from the outside using a USB memory or the like, a determination method that can determine such a situation (for example, the method of the invention of claim 1) is used, and the determination of the access authority level is simply simplified When it is desired to make it, it may be a determination method capable of determining it.

  8. The access authority control system according to claim 7, wherein the access control unit controls the file based on a control instruction received from the result transmission unit.

  The client terminal desirably performs file control based on a control instruction from the management server.

  According to a ninth aspect of the present invention, there is provided an inquiry reception unit for receiving an inquiry as to whether or not a user can access the file and file identification information of the file, wherein the computer stores at least operation log information for the file in a storage device. Based on the file identification information, the operation log information acquisition unit for acquiring the corresponding operation log information from the storage device, and the operation log information acquisition result corresponding to the received file identification information in the operation log information acquisition unit Accordingly, an access permission determination unit that determines access authority to the file by the user, and a result transmission unit that transmits a control instruction based on the determination result to an access control unit that executes an access control process for the file. This is an access authority control program to be executed.

  By executing the program of the present invention on a predetermined computer, the above-mentioned access authority control system can be realized.

According to the present invention, instead of simply determining access authority as in the past, the operation history for the file is confirmed by referring to the log information of the file to be referred to, and the progress of processing for the file is also taken into consideration In addition, the access authority is determined. This allows you to check the original file name from the operation history of the log information, even if a user with access rights accidentally changes and saves the file name. It is possible to prevent a user who does not have a file from being referred to.

  FIG. 1 shows an overall conceptual diagram of the present invention, and FIG. 2 shows a conceptual diagram of a system configuration. In the description of the access authority control system 1 of the present invention, the user accesses information on any file or folder (generically referred to as “file” in this specification) on the client terminal 3 (opens a file, etc.). At this time, a case will be described in which it is determined whether or not the user has access authority to the file in the management server 2 and the result is returned to the client terminal 3 used by the user.

  The management server 2 includes an inquiry reception unit 4, an operation log information storage unit 5, an operation log information acquisition unit 6, a user information storage unit 7, an access permission determination unit 8, and a result transmission unit 9. The management server 2 can exchange information with the client terminal 3 used by the user. Although only one client terminal 3 is shown in FIGS. 1 and 2, there are actually a plurality of client terminals 3.

  The means in the present invention are only logically distinguished in function, and may be physically or virtually the same area. Further, as a storage method of each storage means (storage unit), various methods such as a database and a data file can be used.

  The inquiry reception unit 4 receives an inquiry from the client terminal 3 as to whether or not the user has access authority to the file when the user accesses the file at the client terminal 3. When the client terminal 3 accesses a file, the inquiry is accepted from the client terminal 3, but when the user tries to access a file in the file server from the client terminal 3, the client terminal 3 or the file server Inquiries may be accepted. At the time of this inquiry, from a predetermined computer terminal such as the client terminal 3 or the file server, the identification information (file name etc.) of the file to be accessed by the user and the user identification information (user name, login name, etc.) are obtained. Receive together.

  The operation log information storage unit 5 stores operation log information for a file that can be referred to by the client terminal 3. For example, file name, file creator (identification information of file creator), creation date / time, editor (identification information of file editor), editing date / time, new file creation, file update, file deletion, file name change, Stores operation log information for the file, such as access authority change, copy creation, and file movement. These operation log information records operations performed by the user at each client terminal 3, and each client terminal 3 transmits to the management server 2 regularly or irregularly, and acquires it by the management server 2. And stored in the operation log information storage unit 5. The operation log information storage unit 5 preferably stores each operation log information for each client terminal 3.

  The operation log information storage unit 5 stores, as operation log information, operation histories of operations performed on various files in each client terminal 3.

  When the inquiry reception unit 4 receives an inquiry, the operation log information acquisition unit 6 refers to the operation log information storage unit 5 based on the file identification information, and the operation log information storage unit 5 stores the operation log information for the file. Get from. A unique ID (individual identification information) in hardware such as a portable storage medium or a hard disk is acquired as part of the operation log information and stored in the operation log information storage unit 5, and an inquiry is received in the inquiry reception unit 4. When the file identification information and the unique ID are received, the operation log information for the file may be acquired by referring to the operation log information storage unit 5 using them.

  The user information storage unit 7 stores attribute information for each user, for example, user identification information such as a user name and login name, information such as an access authority level and affiliation. The access authority level may be one for each user, or may be stored for each file.

  The access permission determination unit 8 uses the operation log information acquired by the operation log information acquisition unit 6 (preferably further using the identification information of the user received by the inquiry reception unit 4) for the file. It is determined whether the user has access authority. There are various methods for this determination. For example, there are the following four methods. In each of the following judgment methods, what operation is performed in the operation log information is determined in advance by the OS, etc., so it is specified what operation has been performed by identification information for identifying the operation. I can do it.

  As a first method, based on the file creator information (file creator user identification information) in the operation log information of the file acquired by the operation log information acquisition unit 6 from the operation log information storage unit 5 (created) The user's access authority level information extracted from the file creator stored in the user information storage unit 7 and received by the inquiry reception unit 4 Based on the user identification information of the user, information on the access authority level of the user stored in the user information storage unit 7 is extracted. Then, the access authority level of the file creator is compared with the access authority level of the user. If the access authority level of the user is equal to or higher than the access authority level of the file creator, it is determined that there is an access authority. On the other hand, if the access authority level of the user is lower than the access authority level of the file creator, it is determined that there is no access authority.

  As a second method, when the operation log information acquisition unit 6 cannot acquire the operation log information based on the identification information of the file received by the inquiry reception unit 4 from the operation log information storage unit 5, the client terminal 3 It is determined that there is no access authority regardless of the access authority level of the user as a file that is not permitted to be used. On the other hand, when the operation log information is acquired, it is determined by another three methods or it is determined that the user has access authority. In the case of this method, for example, it is effective when a user brings in a portable storage medium such as a USB memory and restricts access to a file stored therein. In addition to the USB memory, the portable storage medium includes a magnetic disk, a magneto-optical disk, an optical disk, and the like.

  As a third method, as a result of the operation log information acquisition unit 6 acquiring operation log information based on the identification information of the file received by the inquiry reception unit 4 from the operation log information storage unit 5, file name change information If there is, the user's access authority level for the file stored in the user information storage unit 7 is determined using the file name after change and / or the file name before change. First, it is determined whether the access authority level is stored in the user information storage unit 7 based on the changed file name (file identification information), and if it is stored, the access authority level is determined using the information. . If the access authority level based on the changed file name (file identification information) is not stored, it is determined whether the access authority level is stored in the user information storage unit 7 with the file name (file identification information) before the change. If it is stored, the information is used to determine the access authority level. By using such a determination method, the access authority level can be easily determined even if the file name has been changed. This method is effective, for example, when the access authority level is set for each file. If the access authority level for the file is not stored in the user information storage unit 7 and the access authority level is stored in any other storage unit, the above processing is performed on the storage unit. Become.

  As a fourth method, the file creation date and the latest update date and time information acquired from the operation log information storage unit 5 by the operation log information acquisition unit 6 based on the identification information of the file received by the inquiry reception unit 4 Information on the creation date and latest update date and time of the file to be accessed by the user (this information is determined by the inquiry reception unit 4 in accordance with a predetermined computer terminal (client terminal 3, file server, portable storage device). If they do not match, the file is not permitted to be used in the client terminal 3 regardless of the access authority level of the user. It is determined that there is no authority. If they match, it is further determined that each of the above methods is used, or it is determined that the user has access authority. In the case of this method, for example, it is effective when a user brings in a portable storage medium such as a USB memory and restricts access to a file stored therein.

  In addition to the four determination methods exemplified above, the access permission determination unit 8 can determine the access authority using the operation log information, and is not limited to the above method. In addition, the administrator of the management server 2 can arbitrarily set which determination method is adopted by the access permission determination unit 8 and may use a plurality of determination methods instead of a single determination method. In addition, a determination method is set for each user (for each user identification information), the determination method is specified based on the user identification information received by the inquiry reception unit 4, and the access authority determination processing is performed by the specified determination method. It may be configured to execute.

  The result transmission unit 9 transmits the result determined by the accessibility determination unit 8 to an access control unit (not shown) provided in the client terminal 3 or the like. That is, if the access permission determination unit 8 determines that there is access authority, an access permission instruction is transmitted. If the access permission determination unit 8 determines that there is no access authority, an access permission instruction is transmitted. Will be. The access control unit such as the client terminal 3 receives this instruction, and when the access permission instruction is received, the access to the file is permitted, and when the access non-permission instruction is received, the access to the file is not permitted. . The access control unit may be provided in the client terminal 3 as described above, or may be provided in another computer terminal (including a server). Then, the access control unit executes control processing for permitting or not permitting access to the file in the computer terminal equipped with the access controller.

  Next, an example of a processing process in the access authority control system 1 of the present invention will be described with reference to the flowchart of FIG.

  When a user wants to access a file stored in a client terminal 3, a file server, or a portable storage device (such as a USB memory) connected to the client terminal 3, by performing a predetermined operation on the client terminal 3, An instruction to access the file is input to the client terminal 3 (S100). In response to the input, the client terminal 3 transmits an access authority inquiry to the management server 2 before opening the file on the client terminal 3 (S110). As described above, the access authority inquiry may be made to the management server 2 from a predetermined computer terminal such as a file server in addition to the client terminal 3.

  In this inquiry, it is desirable that user identification information, file identification information of a file to be accessed by the user, and the like are transmitted together. Furthermore, information such as the creation date and time or the latest update date and time of the file may be transmitted.

  When the inquiry reception unit 4 receives an access authority inquiry, the operation log information acquisition unit 6 acquires operation log information for the file stored in the operation log information storage unit 5 based on the received file identification information. (S120). At this time, all operation log information for the file may be acquired, or a part of operation log information such as a preset period may be used.

  When the operation log information acquisition unit 6 acquires the operation log information for the file from the operation log information storage unit 5 in this way, the access permission determination unit 8 uses the operation log information to allow the user to access the file. It is determined whether there is an access right (S130).

  In addition to the above four determination methods, various methods can be used for this determination.

  If it is determined that there is access authority as a result of the access authority determination in the access permission determination unit 8, the result transmission unit 9 transmits an access permission instruction to the client terminal 3 (S140). As a result of the determination, if it is determined that there is no access authority, the result transmitting unit 9 transmits an access non-permission instruction to the client terminal 3 (S140).

When this access permission instruction is received by the access control unit of the client terminal 3, the client terminal 3 executes a process for opening the file for which the access instruction has been received in S100. On the other hand, when the access control unit of the client terminal 3 receives an access non-permission instruction, the access control unit of the client terminal 3 cancels the file opening process for the file for which the access instruction has been received in S100, and the “access authority” Notify the user by displaying a message such as "Cannot open because there is no". When the access control unit of the client terminal 3 receives an access non-permission instruction, the process of opening the file is stopped, and the use of the portable storage medium itself such as a USB memory for storing the file is stopped. You can also

Rather than simply determining access privileges as in the past, check the operation history for the file by referring to the log information of the file to be referenced, and access it after taking into account the progress of processing for the file. The authority will be determined. This allows you to check the original file name from the operation history of the log information, even if a user with access rights accidentally changes and saves the file name. It is possible to prevent a user who does not have a file from being referred to.

1 is an overall conceptual diagram of the present invention. It is a conceptual diagram which shows an example of the system configuration | structure of this invention. It is a flowchart which shows an example of the processing process of this invention.

Explanation of symbols

1: Access authority control system 2: Management server 3: Client terminal 4: Inquiry reception unit 5: Operation log information storage unit 6: Operation log information acquisition unit 7: User information storage unit 8: Access permission determination unit 9: Result transmission unit

Claims (9)

An access authority control system for determining access authority using operation log information for a file,
The access authority control system includes:
An inquiry reception unit for receiving an inquiry about whether or not the user can access the file and file identification information of the file;
An operation log information storage unit for storing operation log information for at least the file;
An operation log information acquisition unit that acquires corresponding operation log information from the operation log information storage unit based on the received file identification information;
An access permission determination unit that determines access authority to the file by the user in accordance with an operation log information acquisition result corresponding to the received file identification information in the operation log information acquisition unit;
A result transmission unit that transmits a control instruction based on the determination result to an access control unit that executes an access control process for the file;
An access authority control system comprising: The accessibility determination unit
If the operation log information acquisition unit cannot acquire operation log information corresponding to the received file identification information from the operation log information storage unit, it is determined that there is no access authority.
The access authority control system according to claim 1. The accessibility determination unit
In the operation log information acquired by the operation log information acquisition unit from the operation log information storage unit, when there is information indicating the change of the file identification information, the access authority is first determined using the changed file identification information. If the access authority cannot be determined using the changed file identification information, the access authority is determined using the file identification information before the change.
The access authority control system according to claim 1 or 2, characterized by the above. The access authority control system further includes:
A user information storage unit that stores at least user identification information and access authority level information of each user;
The accessibility determination unit
In the operation log information acquired from the operation log information storage unit by the operation log information acquisition unit, if there is information indicating a change of file identification information, the user information storage unit is used using the changed file identification information. Whether the access authority level is stored, and if it is stored, the access authority level is determined using the access authority level. If not stored, the user information is used using the file identification information before the change. It is determined whether it is stored in the storage unit, and if it is stored, the access authority is determined using the access authority level.
The access authority control system according to any one of claims 1 to 3, wherein The inquiry receiving unit further receives information on the creation date or update date of the file at the time of the inquiry,
The accessibility determination unit
The file creation date or update date information in the acquired operation log information is compared with the file creation date or update date information received by the inquiry reception unit, and the access authority depends on whether or not they match. Judgment of
The access authority control system according to any one of claims 1 to 4, wherein The accessibility determination unit
An access authority determination method is stored for each user identification information, and an access authority determination method is specified based on the user identification information received by the inquiry reception unit.
The access authority control system according to any one of claims 1 to 5, wherein The access control unit
The file is controlled based on the control instruction received from the result transmission unit.
The access authority control system according to any one of claims 1 to 6, wherein The access control unit
Based on the control instruction received from the result transmission unit, the use of the portable storage medium that stores the file is controlled.
The access authority control system according to any one of claims 1 to 7, wherein At least a computer storing operation log information for a file in a storage device,
An inquiry reception unit for receiving an inquiry about whether or not the user can access the file and file identification information of the file;
An operation log information acquisition unit that acquires corresponding operation log information from the storage device based on the received file identification information;
In the operation log information acquisition unit, an access permission determination unit that determines access authority to the file by the user according to an operation log information acquisition result corresponding to the received file identification information,
A result transmission unit that transmits a control instruction based on the determination result to an access control unit that executes an access control process for the file;
An access authority control program characterized by functioning as

Images