JP2008250627A - File management system, file management method and program - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To allow use of a file in a specific permitted place while prohibiting the use thereof in other places. <P>SOLUTION: A user terminal 200 transmits a report for use start of a file to an access management server 100, and the access management server 100 transmits a position authentication request for confirming whether the file is present in a usable place or not to the user terminal 200. The user terminal 200 measures current position information, and generates position authentication information based on the measured current position information. The access management server 100 verifies the generated position authentication information by comparing it with position information of a place for using the file, which is preliminarily registered in a position information database, and issues a file use permission card when the generated position authentication information is matched with the position information of the place for using the file. The user terminal 200 uses the file by use of the file use permission card. <P>COPYRIGHT: (C)2009,JPO&INPIT

Description

  The present invention makes it possible to use a file at a specific authorized place such as a user's home, and to view / modify a file for unauthorized use by a third party due to use in other places or theft. The present invention relates to a file management system, a file management method, and a program that prohibit any operation.

  Currently, with the development of communication networks and electronic data processing, handling of data take-out, duplication, distribution, etc. has become easy. As a result, there are many incidents in which information such as secret data stored as electronic data is leaked, which is a social problem. Such information leaks include internal information exploitation by intrusion via a third-party network and unauthorized distribution from the loss of a laptop with confidential data stored, and recently insiders with data access rights Even taking out and distributing it has been done. Therefore, it is an urgent task to construct an information leakage system regardless of whether it is internal or external.

  On the other hand, recently, terminal authentication is performed between the server and the client via the LAN so that the file cannot be operated unless it is a legitimate terminal, or a key for encrypting the file is generated between the server and the client. A method has been proposed in which a file operation cannot be performed on a terminal that cannot generate a key.

Also disclosed is a technique in which access to an electronic file (including personal information) by a recipient is managed by a file access management server and is restricted within a preset accessible period or within a preset access right. (For example, refer to Patent Document 1).
JP 2006-4189 A

  However, in the above method, processing is performed so that a file cannot be used for taking out any file. For this reason, even if you want to carry out data processing by bringing the file back to a private location such as the client user's home, you cannot perform that processing, and there is a strong restriction that data processing can only be performed within the range that can be authenticated with the result server. In addition, it has become a drag on speeding up business execution.

  Therefore, the present invention has been made in view of the above-described problems, and enables a file to be used at a specific authorized location and prohibits use at other locations, It is an object to provide a file management method and program.

The present invention proposes the following matters in order to solve the above problems.
(1) The present invention is a file management system comprising a user terminal and an access management server for managing access to a specific file, wherein the user terminal obtains position information acquisition means ( For example, a location information acquisition unit (equivalent to the location information acquisition unit 23 in FIG. 1) and registered location information generation means (for example, a location information location for using a file to be registered in the access management server based on the acquired location information) In the registered position information generating unit 1 in FIG. 1, notification means for notifying that at the start of file use (for example, corresponding to the file use start notification transmitting unit 6 in FIG. 1), and the position information acquiring means Based on the acquired position information, position information measuring means for measuring the current position information (for example, corresponding to the current position information measuring unit 12 in FIG. 1), and the measured position information Accordingly, location authentication information generating means for generating location authentication information (for example, equivalent to the location authentication information generation unit 15 in FIG. 1), a file database for storing files (for example, equivalent to the file DB 14 in FIG. 1), Receiving means for receiving a file usage permit from the access management server, and file usage permitting means for permitting the use of a file based on the received file usage permit (for example, equivalent to the file usage permitting section 22 in FIG. 1) ), And the access management server verifies the location information of the place where the file generated by the registered location information generation unit is used (for example, in the registered location information confirmation unit 4 in FIG. 1). And a location information data base for storing location information of a location where a file whose validity is recognized by the registered location information verification means is used. 1 (for example, corresponding to the location information DB 10 in FIG. 1) and at least a location authentication request transmission unit (for example, a location authentication request transmission unit) that transmits a location authentication request to the user terminal when receiving a notification of file use start from the notification unit. 1), location authentication information receiving means for receiving location authentication information from the user terminal (for example, corresponding to location authentication information receiving unit 17 in FIG. 1), and the received Position authentication information verification means for verifying the position authentication information by comparing and verifying the position authentication information and the position information of the place where the file stored in the position information database is used (for example, the position authentication information verification unit 18 in FIG. And when the received location authentication information matches the location information of the place where the file stored in the location information database is used, There has been proposed a file management system comprising a file usage certificate issuing means (for example, equivalent to the file usage certificate issuing unit 19 in FIG. 1) for issuing a file usage certificate.

  According to this invention, the location information acquisition unit of the user terminal acquires the location information, and based on the acquired location information, the location information of the place where the registered location information generation unit uses the file registered in the access management server Is generated. The notification means notifies the access management server to that effect at the start of use of the file, and measures the current position information based on the acquired position information. The position authentication information generating means generates position authentication information based on the measured position information, and the file database stores the file. When the receiving unit receives the file usage certificate from the access management server, the file usage permitting unit permits the use of the file based on the file usage certificate received. On the other hand, the registered location information verification unit of the access management server verifies the location information of the place where the file generated by the registered location information generation unit is used, and the location information database is a file whose validity is recognized by the registered location information verification unit. Stores the location information of the place where is used. The location authentication request transmitting means transmits a location authentication request to the user terminal at least when a notification of file use start is received from the notification means, and the location authentication information receiving means receives the location authentication information from the user terminal. Then, the location authentication information received by the location authentication information verification means and the location information of the place where the file stored in the location information database is compared and verified to verify the location authentication information. When the location authentication information received by the authentication information verification means matches the location information of the place where the file stored in the location information database is used, a file usage permit is issued. Therefore, by verifying the location information of the place where the file is registered in advance and the current location information, a license for using the file is issued to the user terminal, so that the specific authorization It is possible to use a file at a location, and prohibit use at other locations to enable safe file takeout.

  (2) The present invention proposes a file management system according to (1), wherein the location authentication request transmitting unit periodically transmits a location authentication request to the user terminal. .

  According to the present invention, since the location authentication request transmitting means periodically transmits the location authentication request to the user terminal, it is possible to effectively prohibit the use of the file outside a specific authorized place. .

  (3) According to the present invention, in the file management system of (1) or (2), when the location authentication information is not generated for a predetermined time or longer in the location authentication information generation unit, the file use permission unit We propose a file management system characterized by prohibiting the use of.

  According to the present invention, when the location authentication information is not generated in the location authentication information generation unit for a predetermined time or more, the file use permission unit prohibits the use of the file. Effectively prohibiting the use of files even when fraudulently sending information that is completely different from the location authentication information generated by the authentication information generation means to the access management server as location authentication information. can do.

  (4) The present invention proposes a file management system for the file management systems (1) to (3), wherein the position information acquisition means acquires position information acquisition by GPS.

  According to the present invention, since the position information acquisition means acquires position information acquisition by GPS, for example, by using GPS, which is currently a general function in mobile phones and the like, the position information can be easily obtained. Information can be acquired.

  (5) The present invention proposes a file management system for the file management system of (1) to (3), wherein the position information acquisition means acquires position information acquisition from map information.

  According to the present invention, since the position information acquisition means acquires position information acquisition from map information, it is possible to easily register position information while confirming the location on the map.

  (6) The present invention is a file management method in a file management system comprising a user terminal and an access management server that manages access to a specific file, wherein the user terminal sends a file use start notification. A first step (for example, corresponding to step S201 in FIG. 3) to be transmitted to the access management server, and a location authentication request for confirming whether or not the file exists in a location where the file can be used by the access management server Is transmitted to the user terminal (for example, corresponding to step S202 of FIG. 3), and the user terminal is configured to measure the current position information (for example, in step S203 of FIG. 3). And a fourth step (for example, step S in FIG. 3) in which the user terminal generates position authentication information based on the measured current position information. 4), and the access management server compares and verifies the generated location authentication information with the location information of the location where the file registered in advance in the location information database is used (for example, FIG. 3). When the access management server matches the generated location authentication information and the location information of the location where the file is used, the access management server issues a file usage permit. 6 (for example, corresponding to step S207 in FIG. 3), and a seventh step (for example, corresponding to step S209 in FIG. 3) in which the user terminal uses the file by the file usage permit; A file management method characterized by comprising:

  According to the present invention, the user terminal transmits a file use start notification to the access management server, and the access management server issues a location authentication request for confirming whether the file exists in a usable location. Send to the user terminal. The user terminal measures current position information, and generates position authentication information based on the measured current position information. The access management server compares and verifies the generated location authentication information with the location information of the location using the file registered in advance in the location information database, and the generated location authentication information and the location information of the location using the file If it matches, issue a file usage certificate. The user terminal uses the file based on the file usage permit. Therefore, by verifying the location information of the place where the file is registered in advance and the current location information, a license for using the file is issued to the user terminal, so that the specific authorization It is possible to use a file at a location, and prohibit use at other locations to enable safe file takeout.

  (7) The present invention is a program for causing a computer to execute a file management method in a file management system comprising a user terminal and an access management server for managing access to a specific file, the user terminal The first step of transmitting a file use start notification to the access management server (for example, corresponding to step S201 in FIG. 3), and whether or not the access management server exists at a location where the file can be used. A second step (for example, corresponding to step S202 in FIG. 3) for transmitting a location authentication request for confirming the current position information to the user terminal, and a third step (in which the user terminal measures current location information) For example, this corresponds to step S203 in FIG. 3), and the user terminal generates location authentication information based on the measured current location information. In a fourth step (for example, corresponding to step S204 in FIG. 3), the access management server compares the generated location authentication information with the location information of a location that uses a file registered in advance in the location information database. The access management when the generated location authentication information matches the location information of the location where the file is used by the access management server (for example, corresponding to step S206 in FIG. 3). A sixth step in which the server issues a file usage certificate (for example, corresponding to step S207 in FIG. 3), and a seventh step in which the user terminal uses the file with the file usage certificate (for example, , Which corresponds to step S209 in FIG. 3).

  According to the present invention, the user terminal transmits a file use start notification to the access management server, and the access management server issues a location authentication request for confirming whether the file exists in a usable location. Send to the user terminal. The user terminal measures current position information, and generates position authentication information based on the measured current position information. The access management server compares and verifies the generated location authentication information with the location information of the location using the file registered in advance in the location information database, and the generated location authentication information and the location information of the location using the file If it matches, issue a file usage certificate. The user terminal uses the file based on the file usage permit. Therefore, by verifying the location information of the place where the file is registered in advance and the current location information, a license for using the file is issued to the user terminal, so that the specific authorization It is possible to use a file at a location, and prohibit use at other locations to enable safe file takeout.

  According to the present invention, it is possible to use a file at a specific authorized location, and prohibit use at other locations, thereby leaking information, browsing illegal files, or modifying files. It is possible to prevent files accurately and take out files safely.

Hereinafter, embodiments of the present invention will be described in detail with reference to the drawings.
Note that the constituent elements in the present embodiment can be appropriately replaced with existing constituent elements and the like, and various variations including combinations with other existing constituent elements are possible. Therefore, the description of the present embodiment does not limit the contents of the invention described in the claims.

<Configuration of file management system>
As shown in FIG. 1, the file management system according to this embodiment includes an access management server 100 and a user terminal 200.

  Here, the access management server 100 includes a registered position information receiving unit 3, a registered position information verifying unit 4, a registered position information registering unit 5, a file use start notification receiving unit 7, a position authentication request transmitting unit 8, A location information database (DB) 10, a location authentication information receiving unit 17, a location authentication information verification unit 18, a file usage certificate issuing unit 19, and a file usage certificate transmission unit 20 are configured.

  On the other hand, the user terminal 200 includes a registered position information generating unit 1, a registered position information transmitting unit 2, a file use start notification transmitting unit 6, a position authentication request receiving unit 9, a current position information measuring unit 12, The authentication information generating unit 15, the position authentication information transmitting unit 16, the file database (DB) 14, the file usage certificate receiving unit 21, the file use permission unit 22, and the position information acquisition unit 23 are configured. .

  Here, the registered position information receiving unit 3 receives position information (registered position information) of a place where the file generated by the registered position information generating unit 1 is used from the registered position information transmitting unit 2 of the user terminal 200. The registered position information verification unit 4 verifies the validity of the position from the position information (registered position information) of the place where the received file is used, and the position information (registered position) of the place where the file determined to be valid is used. Information) is output to the registered position information registration unit 5.

  The registered position information registration unit 5 registers the position information (registered position information) of the place where the file input from the registered position information verification unit 4 is used in the position information database (DB) 10. The position information database (DB) 10 stores and stores position information (registered position information) of a place where a file determined to be valid by the registered position information verification unit 4 is used.

  The file use start notification receiving unit 7 receives a notification to start using a file from the file use start notification transmitting unit 6 of the user terminal 200. The location authentication request transmitter 8 transmits a location authentication request to the location authentication request receiver 9 of the user terminal 200.

  The location authentication request is transmitted not only when a notification indicating that the file usage is started is received from the file usage start notification transmission unit 6 of the user terminal 200 but also periodically. As a result, it is possible to effectively prohibit the use of files outside a specific authorized location.

  The location authentication information receiving unit 17 receives location authentication information from the location authentication information transmitting unit 16 of the user terminal 200. The location authentication information verification unit 18 compares and verifies the received location authentication information and location information (registered location information) of a place where a file stored in the location information database (DB) is used. The file usage certificate issuance unit 19 issues a file usage certificate when both pieces of position information match as a result of the comparison verification in the position authentication information verification unit 18.

  The file usage certificate transmitting unit 20 transmits the file usage certificate issued by the file usage certificate issuing unit 19 to the file usage certificate receiving unit 21 of the user terminal 200. Note that the user terminal 200 can periodically use the file while receiving the file usage permit after receiving the location authentication by the access management server 100.

  On the other hand, the registered position information generation unit 1 of the user terminal 200 generates position information (registered position information) of a place where the file is used based on the position information obtained from the position information acquisition unit 23. The registered position information transmitting unit 2 transmits the position information (registered position information) of the place where the file generated by the registered position information generating unit 1 is used to the registered position information receiving unit 3 of the access management server 100.

  The file use start notification sending unit 6 sends a notice to start using the file when the use of the file is started. The location authentication request receiving unit 9 receives a location authentication request from the location authentication request transmitting unit 8 of the access management server 100. The current location information measurement unit 12 receives a location authentication request from the access management server 100 and measures the current location information based on the location information acquired by the location information acquisition unit 23.

  The location authentication information generation unit 15 generates location authentication information based on the current location information measured by the current location information measurement unit 12. The location authentication information transmitting unit 16 transmits the location authentication information generated by the location authentication information generating unit 15 to the location authentication information receiving unit 17 of the access management server 100.

  The file database (DB) 14 stores and stores files that are used by users. The file usage certificate receiving unit 21 receives the file usage certificate transmitted from the file usage certificate transmitting unit 20 of the access management server 100. The file usage permission unit 22 permits the user to use the file based on the file usage certificate received by the file usage certificate receiving unit 21.

  The file use permission unit 22 prohibits the use of the file when the position authentication information generation unit 15 does not generate the position authentication information for a predetermined time or longer. As a result, for example, there is a case where fraudulent in which information completely different from the position authentication information generated by the position authentication information generation unit 15 from the user terminal is intentionally transmitted to the access management server as the position authentication information is performed. However, the use of files can be effectively prohibited.

  The position information acquisition unit 23 acquires latitude / longitude information about the position using, for example, GPS (Global Positioning System). Moreover, you may acquire positional information using map information.

<Processing of file management system>
Next, processing of the file management system according to the present embodiment will be described with reference to FIGS. The processing of the file management system will be described separately for registration processing and execution processing.

<Registration process>
First, the user checks the position of the place where the file is to be used using the position information acquisition unit 23 of the user terminal 200, and the registered position information generation unit 1 uses the position information (registered position information) of the place where the file is used. ) Is generated (step S101). The location information (registered location information) of the place where the generated file is used is transmitted to the registered location information receiving unit 3 of the access management server 100 by the registered location information transmitting unit 2 of the user terminal 200 (step S102).

  The registered location information receiving unit 3 of the access management server 100 receives the location information (registered location information) of the location where the sent file is used, and registers the location information (registered location information) of the location where the received file is used. The information is output to the position information verification unit 4. The registered position information verification unit 4 confirms the validity of the position from the position information (registered position information) of the place where the input file is used (step S103). When the registered position information verification unit 4 confirms the validity of the position information, the position information (registered position information) of the place where the file is used is registered in the position information database (DB) 10 (step S104).

<Execution process>
First, the file use start notification transmitting unit 6 of the user terminal 200 transmits a file use start notification to the file use start notification receiving unit 7 of the access management server 100 (step S201). The file use start notification receiving unit 7 of the access management server 100 receives the sent start notification. Then, the location authentication request transmitting unit 8 transmits a location authentication request for confirming whether or not the current location is a place where the file can be used to the location authentication request receiving unit 9 of the user terminal 200 ( Step S202).

  When receiving the sent location authentication request, the location authentication request receiving unit 9 of the user terminal 200 outputs this to the current location information measuring unit 12. The current position information measuring unit 12 measures the current position information based on the position information acquired by the position information acquiring unit 23 (step S203). Then, the current position information measuring unit 12 outputs the measured current position information to the position authentication information generating unit 15, and the position authentication information generating unit 15 generates position authentication information based on the input current position information ( Step S204).

  The location authentication information generation unit 15 transmits the generated location authentication information to the location authentication information reception unit 17 of the access management server 100 via the location authentication information transmission unit 16 (step S205). The location authentication information receiving unit 17 receives the sent location authentication information and outputs the location authentication information to the location authentication information verification unit 18.

  The position authentication information verification unit 18 compares and verifies the input position authentication information and the position information (registered position information) of the location where the file registered in the database is used (step S206). As a result of the comparison verification, if the two match, the file usage certificate issuing unit 19 issues a file usage certificate (step S207).

  Then, the file usage permit transmitting unit 20 transmits the file usage permit issued to the file usage permit receiving unit 21 of the user terminal 200 to the terminal (step S208), and the file usage permitting unit 22 sends the file usage permit. Based on the permit, the corresponding file is searched from the file database (DB) and its use is permitted (step S209).

  In addition, while the user is using the file, the processing from step S202 to step S209 is periodically executed. Then, the user can use the file only when the user terminal 200 receives location authentication periodically. As a result, it is possible to effectively prohibit the use of files outside a specific authorized location.

  On the other hand, when the location authentication is not updated for a predetermined period, control for prohibiting the use of the file is performed. Thereby, for example, in the case where fraudulently intentionally transmitting information that is completely different from the position authentication information generated by the position authentication information generating means from the user terminal as the position authentication information to the access management server is performed. Even the use of files can be effectively prohibited.

  Therefore, according to the present embodiment, a specific authorization is obtained because a license for using a file is issued to the user terminal by collating pre-registered position information with current position information. It is possible to use a file at a different location, and prohibit use at other locations to enable safe file export.

  The file management system of the present invention can be realized by recording the processing of the file management system on a computer-readable recording medium, causing the file management system to read and execute the program recorded on the recording medium. . The computer system here includes an OS and hardware such as peripheral devices.

  Further, the “computer system” includes a homepage providing environment (or display environment) if a WWW (World Wide Web) system is used. The program may be transmitted from a computer system storing the program in a storage device or the like to another computer system via a transmission medium or by a transmission wave in the transmission medium. Here, the “transmission medium” for transmitting the program refers to a medium having a function of transmitting information, such as a network (communication network) such as the Internet or a communication line (communication line) such as a telephone line.

  The program may be for realizing a part of the functions described above. Furthermore, what can implement | achieve the function mentioned above in combination with the program already recorded on the computer system, and what is called a difference file (difference program) may be sufficient.

  The embodiment of the present invention has been described in detail with reference to the drawings. However, the specific configuration is not limited to this embodiment, and includes a design and the like within a scope not departing from the gist of the present invention. For example, in the present embodiment, a case has been described in which the user terminal includes a position information acquisition unit such as GPS. However, in addition to the user terminal, for example, a user uses a mobile terminal having a GPS function. The system may be constructed so that the terminal acquires position information from the mobile terminal.

It is a block diagram of the file management system which concerns on this embodiment. It is a registration processing flow of the file management system concerning this embodiment. It is an execution processing flow of the file management system concerning this embodiment.

Explanation of symbols

DESCRIPTION OF SYMBOLS 1 ... Registration position information generation part, 2 ... Registration position information transmission part, 3 ... Registration position information reception part, 4 ... Registration position information verification part, 5 ... Registration position information registration part, 6... File usage start notification transmission unit, 7... File usage start notification reception unit, 8... Location authentication request transmission unit, 9. DB), 12 ... current position information measuring unit, 14 ... file database (DB), 15 ... location authentication information generating unit, 16 ... location authentication information transmitting unit, 17 ... location authentication information. Receiving unit, 18 ... location authentication information verification unit, 19 ... file usage certificate issuing unit, 20 ... file usage certificate transmitting unit, 21 ... file usage certificate receiving unit, 22 ... File use permission unit, 23... Position information acquisition unit, 10 ... access management server, 200 ... user terminal

Claims (7)

A file management system comprising a user terminal and an access management server that manages access to a specific file,
The user terminal is
Position information acquisition means for acquiring position information;
Based on the acquired position information, registered position information generating means for generating position information of a place where a file to be registered in the access management server is used;
A notification means for notifying that when a file starts to be used;
Position information measuring means for measuring current position information based on the position information acquired by the position information acquiring means;
Position authentication information generating means for generating position authentication information based on the measured position information;
A file database for storing files;
Receiving means for receiving a file usage certificate from the access management server;
File use permission means for permitting use of the file based on the received file use certificate,
The access management server is
Registered location information verification means for verifying location information of a place where the file generated by the registered location information generation means is used;
A location information database for storing location information of a location where a file whose validity is recognized by the registered location information verification means;
A location authentication request transmitting means for transmitting a location authentication request to the user terminal when a notification of the start of file use is received from at least the notification means;
Location authentication information receiving means for receiving location authentication information from the user terminal;
Position authentication information verification means for verifying the position authentication information by comparing and verifying the received position authentication information and the position information of the place where the file stored in the position information database is used;
A file usage certificate issuing unit that issues a file usage certificate when the received location authentication information matches the location information of the location where the file stored in the location information database is used by the location authentication information verification unit; ,
A file management system characterized by comprising:   The file management system according to claim 1, wherein the location authentication request transmitting unit periodically transmits a location authentication request to the user terminal.   The file use permission unit prohibits the use of a file when the position authentication information is not generated in the position authentication information generation unit for a predetermined time or longer. File management system.   4. The file management system according to claim 1, wherein the position information acquisition unit acquires position information acquisition by GPS.   The file management system according to claim 1, wherein the position information acquisition unit acquires position information acquisition from map information. A file management method in a file management system comprising a user terminal and an access management server that manages access to a specific file,
A first step in which the user terminal transmits a file use start notification to the access management server;
A second step in which the access management server transmits a location authentication request for confirming whether or not the file exists in a usable location to the user terminal;
A third step in which the user terminal measures current position information;
A fourth step in which the user terminal generates location authentication information based on the measured current location information;
A fifth step in which the access management server compares and verifies the generated location authentication information with location information of a location using a file registered in advance in a location information database;
When the access management server matches the generated location authentication information and the location information of the location where the file is used, the access management server issues a file usage certificate;
A seventh step in which the user terminal uses the file with the file usage certificate;
A file management method comprising: A program for causing a computer to execute a file management method in a file management system comprising a user terminal and an access management server for managing access to a specific file,
A first step in which the user terminal transmits a file use start notification to the access management server;
A second step in which the access management server transmits a location authentication request for confirming whether or not the file exists in a usable location to the user terminal;
A third step in which the user terminal measures current position information;
A fourth step in which the user terminal generates location authentication information based on the measured current location information;
A fifth step in which the access management server compares and verifies the generated location authentication information with location information of a location using a file registered in advance in a location information database;
When the access management server matches the generated location authentication information and the location information of the location where the file is used, the access management server issues a file usage certificate;
A seventh step in which the user terminal uses the file with the file usage certificate;
A program that causes a computer to execute.

Images