JP2011003131A - Access right management device, document management system, and access right management program - Google Patents

Abstract

PROBLEM TO BE SOLVED: To share document data to be shared, including reference documents referred to by the document data, with other users, even when the access right of the reference document data referred to by the document data to be shared is limited.SOLUTION: The document management device 12 includes: a sharing information receiving part 22 for receiving an identification code for identifying the document data to be shared, a sharing user, and access right designation information for designating access right to be given; a reference document detecting part 26 for detecting a reference document identification code showing reference document data referred to in the document data to be shared; access right information 38 about the access right of the document data to be shared; an access right acquiring part 24 for acquiring the access right information 38 of the reference document data; and an access right changing part 28 for rewriting the access right information of the document data to be shared and the reference document data so as to allow the sharing user to read at least the document data to be shared on the basis of the access right designation information.

Description

  The present invention relates to an access right management device, a document management system, and an access right management program.

  In Patent Document 1, in a document registration method for registering a stored document file in a registration destination, an access right is associated with each document file including the document file to be registered in order to use each document file before registration. The information is set in advance, and prior to document registration, the document location information and registration destination information of the document file to be registered are set, and the document location information and registration destination information set at the time of document registration are set. All the document files are extracted from the document location indicated by the document location information, and the retrieved document file is registered in the registration destination indicated by the registration destination information, and the access is performed at the time of document registration or after document registration. A technique for automatically setting right information as access right information of a document file registered at a registration destination is disclosed.

  Patent Document 2 discloses a technique for detecting a specific image format (character data) when registering image data, determining whether it contains a secret matter, and automatically granting an access right. ing.

  Patent Document 3 discloses a technique for setting an automatic setting rule for an object as means for automatically changing the access right of an object for which no access right is set.

  Patent Document 4 discloses a technique for referring to access right information of an object stored in a relatively higher hierarchy when determining whether to access an object whose access right information is not set.

JP 2001-222455 A JP 2002-269093 A JP 2006-92075 A JP 2000-215095 A

  Even if the access right of the reference document data referenced from the document data to be shared is limited, the document data to be shared including the reference document referenced from the document data to be shared It is an object of the present invention to provide an access right management device, a document management system, and an access right management program that can be shared by other users.

  In order to achieve the above object, the access right management device according to the first aspect of the present invention provides identification information for identifying sharing target document data that is to be shared among document data stored in the first storage means, A share target user for sharing the share target document data, a reception unit for receiving access right designation information for designating an access right to be given to the share target user for the share target document data, and the reception unit The access authority information related to the access right of the share target document data is acquired, and the reference is accessed from the second storage means in which the access right information related to the access right of the reference document data referred to in the share target document data is stored. An acquisition means for acquiring the access authority information of the document data; and the account received by the reception means. Based on the access rights specified information, the so shared audience is at least readable the shared object document data, and a rewriting means for rewriting the access permission information to be shared document data and the reference document data.

  According to the second aspect of the present invention, the reference document identification information indicating the reference document data referred to in the sharing target document data is detected from the sharing target document data and associated with the sharing target document data. Detection means for storing the information in the storage means is further provided, wherein the acquisition means stores the access authority information of the reference document data based on the reference document identification information associated with the sharing target document data in the third storage means. Obtained from the second storage means.

  According to a third aspect of the present invention, in the case where the reference document identification information associated with the sharing target document data stored in the third storage unit is not available, the acquisition unit is configured to detect the detection unit. The access authority information of the reference document data is acquired from the second storage means based on the reference document identification information detected from the sharing target document data.

  According to a fourth aspect of the present invention, there is provided a document management system comprising: first storage means for storing document data; second storage means for storing access authority information relating to access authority for the document data; and the first storage. Identification information for identifying the sharing target document data to be shared among the document data stored in the means, a sharing target user for sharing the sharing target document data, and the sharing target user for the sharing target document data Designating means for designating an access right to be granted, receiving means for receiving access right designation information relating to the access right designated by the designation means, and access authority information relating to the access right of the document data to be shared received by the accepting means. Reference that is acquired and referenced in the shared document data from the second storage means Acquisition means for acquiring the access right information of the document data, and based on the access right designation information received by the reception means, the sharing target user can at least read the sharing target document data. Rewriting means for rewriting access authority information of target document data and reference document data.

  The invention according to claim 5 is a calculation means for calculating a hash value of the sharing target document data based on the sharing target document data specified by the specifying means, and a reference document referred to in the sharing target document data. The reference document identification information indicating data is detected from the share target document data and a hash value of the share target document data is obtained, and the detected reference document identification information is obtained from the share target document data and the obtained hash value And further comprising detection means for associating and storing the third document in the third storage means, wherein the acquisition means stores the reference document data based on the reference document identification information associated with the share target document data in the third storage means. The access authority information is acquired from the second storage means, and the shared information stored in the third storage means When the hash value associated with the target document data is different from the hash value calculated by the calculation means, the reference document is based on the reference document identification information detected from the share target document data by the detection means. The access authority information of data is acquired from the second storage means.

  According to a sixth aspect of the invention, an access right management program causes a computer to function as each means constituting the access right management device according to any one of the first to third aspects.

  According to the first, fourth, and sixth aspects of the invention, even when the access right of the reference document data referred to from the document data to be shared is restricted, the document data to be shared is determined from the document data to be shared. This has the effect that other users including the referenced document can be shared.

  According to the second aspect of the invention, there is an effect that it is not necessary to detect the reference document identification information indicating the reference document data referred to in the sharing target document data every time.

  According to the third and fifth aspects of the present invention, when the sharing target document data is changed while eliminating the waste of detecting the reference document identification information indicating the reference document data referred to in the sharing target document data every time. However, there is an effect that the access right of correct reference document data can be changed.

It is a schematic block diagram of a document management system. It is a functional block diagram of a document management apparatus. It is a schematic block diagram of a user terminal device. It is a figure which shows an example of account information. It is an example figure of document data. It is a figure which shows an example of access authority information. It is a figure which shows an example of reference document list information. It is a flowchart of the process performed with a user terminal device. It is a flowchart of the process performed with a document management apparatus. It is a schematic block diagram at the time of comprising a document management apparatus with a computer.

  Hereinafter, embodiments of the present invention will be described.

  FIG. 1 shows a schematic configuration of a document management system 10 according to the present embodiment. As shown in the figure, the document management system 10 has a configuration in which a document management device 12 is connected to a plurality of user terminal devices 14 via a communication line 16 as an example.

  As shown in FIG. 2, the document management apparatus 12 includes a document management unit 18, an account management unit 20, a shared information reception unit 22, an access right acquisition unit 24, a reference document detection unit 26, an access right change unit 28, and a communication unit 30. , And a storage unit 32.

  As shown in FIG. 3, the user terminal device 14 includes a computer 50, a monitor 52, an operation unit 54, a hard disk 56, a communication unit 58, and the like.

  The computer 50 includes a CPU (Central Processing Unit) 50A, a ROM (Read Only Memory) 50B in which basic programs such as an OS are stored, a RAM (Random Access Memory) 50C in which various data are temporarily stored, and a data rewrite. A non-volatile memory 50D that can hold data even when power is not supplied and an input / output interface (I / O) 50E are connected via a bus 50F.

  The storage unit 32 stores account information 34, document data 36, access authority information 38, reference document list information 40, and the like.

  The document management system 10 is used by, for example, a user registered in advance. A user inputs a user ID assigned to each user and a password set by the user using the user terminal device 14, and the use is permitted when the user is authenticated by the account management unit 20 of the document management device 12. .

  As shown in FIG. 4, the account information 34 stored in the storage unit 32 includes user ID, group ID, password, e-mail address, telephone number, name as information on users who are permitted to use the document management system 10. Etc. are included. The account information 34 includes at least a user ID that is an identification code for identifying the user, but other information is not limited to the information shown in FIG.

  When the account management unit 20 receives user information including a user ID and password from the user terminal device 14, the account management unit 20 determines whether or not the account information 34 includes user information that matches the received user information. Certify.

  Further, the account management unit 20 performs management of the account information 34, that is, processing such as addition, change, and deletion of the account information 34 in response to a user request such as addition of a user who desires to use the document management system 10.

  For example, when the user wants to share the document data stored in the hard disk 56 of the user terminal device 14 with another user, for example, the user uploads the document data to the document management device 12 via the communication line 16. The data is stored in the storage unit 32 of the document management apparatus 12.

  As shown in FIG. 5, the document data 36 includes attribute data indicating attributes of the document data and document body data that is data of the document body.

  The attribute data includes, for example, the user ID of the user of the document data, the group ID of the group to which the user belongs, the document ID of the document data, the title, the outline, the creation date / time, the update date / time, and the size. The type is an example and is not limited to this.

  Each document data is associated with access authority information 38 as shown in FIG. As shown in the figure, the access authority information 38 includes a user ID, a group ID, and access authority of each user for the document data. In this embodiment, the attribute read authority, data read authority, attribute write authority, data write authority, Information indicating the presence or absence of management rights is included.

  Here, the attribute write right is an authority to read only the attribute data of the document data 36, the data read right is an authority to read the document data of the document data 36, and the attribute write right is an attribute of the document data 36. Only the attribute data is rewritten (edited), and the data write right is the right to rewrite the document data such as adding a version of the document data. The management right is the deletion of the document data 36 and the attribute read right. The right to change the data read right, attribute write right, data write right, and management right.

  In this embodiment, “sharing” a document means that at least one of the above-mentioned attribute read right, data read right, attribute write right, data write right, and management right is assigned to another document. This is given to the user.

  In the document management unit 18, when the document data 36 is uploaded from the user terminal device 14, the document data 36 is registered in the storage unit 32, or the access authority information 38 of the document data 36 is created to store the storage unit 32. For example, the document data 36 and the access authority information 38 are managed. When the document data 36 is registered, for example, the access authority information 38 to which all access rights are given is generated for the creator of the document data 36.

  The shared information receiving unit 22 receives information related to a shared target document, information related to a shared target user, information on the type of access right to be given to the shared target user, and the like transmitted from the user terminal device 14.

  The reference document detection unit 26 detects a document ID (hereinafter referred to as a reference document ID) of a reference document referred to in the document based on the document data 36 to be shared received by the shared information reception unit 22. Reference document list information is generated and stored in the storage unit 32.

  As shown in FIG. 7, the reference document list information is information that is created for each document ID and includes the reference document IDs of all reference documents that are referred to in the document data indicated by the document ID.

  The detection of the reference document ID is performed by, for example, determining a document ID assigning rule in advance and detecting whether or not a document ID according to the predetermined rule exists in the document data. As a rule of the document ID assigning method, for example, the type of code that can be assigned to the document ID (numerals, Roman characters, etc.), the number of code of the document ID, or a predetermined code at the beginning of the document ID must be assigned. However, the present invention is not limited to this as long as the document ID can be easily detected.

  Further, as the document ID, if it is a document stored in the document management system 10, it is not necessary to include a code for specifying a document management apparatus, for example, a server apparatus, in the document ID. . For example, the document ID may be a document ID such as “F524AD71” by simply combining numbers and Roman letters.

  On the other hand, if the document is stored not in the document management system 10 but in, for example, the same type of document management system existing outside, a code for specifying the document management apparatus of the document management system needs to be included in the document ID. There is. In this case, for example, if the code indicating the external document management device is “docserver.department.co.jp” and the document ID itself is “F524AD71”, these are concatenated with “-” (hyphen), for example, May be “docserver.department.co.jp-F524AD71”. Further, “docserver.department.co.jp” may be represented by the IP address itself. For example, if the IP address of “docserver.department.co.jp” is “123.456.789”, the document ID may be “123.456.789-F524AD71”. In addition, the code | symbol used for a connection is not restricted to a hyphen, You may use another code | symbol.

  Based on the reference document list information 40 created by the reference document detection unit 26, the access right acquisition unit 24 acquires the access right information 38 of the reference document that is referenced in the document to be shared.

  The access right changing unit 28 changes (rewrites) the access right information 38 acquired by the access right acquiring unit 24 so that the access right specified by the user is given to the sharing target document. As a result, the document to be shared is shared with other users.

  Next, as operations of the present embodiment, processing executed by the document management apparatus 12 and the user terminal apparatus 14 will be described.

  First, processing executed by the CPU 50A of the user terminal device 14 will be described with reference to a flowchart shown in FIG. In the present embodiment, it is assumed that the document data 36 of the document to be shared has already been uploaded and stored in the storage unit 32 of the document management apparatus 12.

  The process shown in FIG. 8 is executed when the user performs a predetermined operation using the operation unit 54 and activates application software for specifying a document to be shared.

  First, in step 100, a list of attribute data of the document data 36 stored in the storage unit 32 of the document management apparatus 12 is acquired from the document management apparatus 12, and this is displayed on the monitor 52 to be shared with the user. Let the document be selected. The document data 36 may be managed in a hierarchical structure by creating a folder for storing the document data 36 in the storage unit 32. In this case, the document ID is a document ID including a folder name. In this case, the folder name may be selected. In this case, all the documents belonging to the selected folder are selected.

  In step 102, a list of user information such as the user ID, group ID, and name of the account information 38 stored in the storage unit 32 of the document management apparatus 12 is acquired from the document management apparatus 12, and this is displayed on the monitor 52. Select the sharing target user who wants to share the sharing target document. A group may be selected. In this case, all users belonging to the selected group are selected.

  In step 104, the document ID of the sharing target document selected by the user and the user ID of the sharing target user are transmitted to the document management apparatus 12.

  In step 106, the access authority information 38 set in the sharing target document and the reference document referred to in the sharing target document is received from the document management apparatus 12 and displayed on the monitor 52.

  In step 108, an access right to be set for the sharing target user is accepted. For example, first, the user selects whether to set the access right automatically or manually. If automatic is set here, the document management apparatus 12 grants a predetermined access right, for example, an attribute read item and a data read right, to the sharing target user. On the other hand, when the access right is set manually, the access right to be newly set is designated.

  In step 110, when the access right is automatically set, information indicating that is transmitted to the document management apparatus 12 as access right designation information, and when the access right is set manually, the access designated by the user is sent. The right type information is transmitted to the document management apparatus 12 as access right designation information. As a result, the access right is rewritten by the document management apparatus 12.

  In step 112, the document management apparatus 12 receives the access right change result and displays the result on the monitor 52.

  Next, processing executed by the document management apparatus 12 will be described with reference to a flowchart shown in FIG.

  In step 200, the document management unit 18 responds to a request from the user terminal device 14, that is, in response to the processing in step 100 of FIG. 8, information indicating a list of attribute data of the document data 36 is displayed. Send to.

  In step 202, the account management unit 20 displays a list of user information related to the user who uses the document management system 10 in response to a request from the user terminal device 14, that is, in response to the processing in step 102 in FIG. Transmit to device 14.

  In step 204, the communication unit 30 responds to the processing of the user terminal device 14, that is, in response to the processing of step 104 in FIG. 8, the document ID of the sharing target document transmitted from the user terminal device 14 and the sharing target user. The user ID is received.

  In step 206, the reference document detection unit 26 detects a document referred to by the document with the sharing target document ID, and generates a reference document list. The generated reference document list is stored in the storage unit 32 in association with the sharing target document ID.

  In step 208, the access right acquisition unit 24 acquires access authority information of the sharing target document and the reference document and transmits it to the user terminal device 14.

  In step 210, the communication unit 30 receives the access right designation information transmitted from the user terminal device 14.

  In step 212, the access right changing unit 28 rewrites the access right information of the sharing target document and the reference document based on the access right designation information. That is, when an instruction to automatically set the access right is given by the access right designation information, a predetermined access right for the share target document and the reference document, for example, the attribute read item and the data read right are shared user To be granted. On the other hand, when the access right to be granted is instructed by the access right designation information, the access right designated by the access right designation information is given to the sharing target user with respect to the sharing target document and the reference document. The access authority information 38 is rewritten.

  Since the reference document list referred to in the sharing target document is stored in the storage unit 32, it is not necessary to detect the reference document every time until the document body data of the sharing target document is rewritten. Therefore, the process of step 206 in FIG. 9 is replaced with a process of reading a reference document list that has already been created unless the document body data of the sharing target document is rewritten.

  On the other hand, when the document body data is rewritten, the reference document detection unit 26 may re-create the reference document list each time and store the reference document list in the storage unit 32. Alternatively, the reference document list may be created each time. When the processing shown in FIG. 9 is executed instead of correcting the document body data, that is, when the creation date of the attribute data is updated, a reference document list is created in step 206. You may try again.

  Whether or not the document body data has been rewritten is, for example, stored in association with the reference document list stored in the storage unit 32 for determination data used to determine whether or not the document body data has been rewritten. It is good to make a judgment using it. As the determination data, for example, data indicating the version of the document body data to be shared, a hash value of the document body data, or the like may be used. When the version number is used, the determination is made based on whether or not the version of the document body data to be shared matches the version associated with the reference document list. When the hash value of the document body data is used, the determination is made based on whether or not the hash value of the document body data to be shared matches the hash value associated with the reference document list.

  In the present embodiment, the document management unit 18, the account management unit 20, the shared information reception unit 22, the access right acquisition unit 24, the reference document detection unit 26, the access right change unit 28, and the storage unit 32 are included in one apparatus. However, the present invention is not limited to this. For example, the storage unit 32 may be provided in another device via the communication line 16, and all the functional units are not necessarily provided in the same device. There is no need to provide it.

  Further, the document management apparatus 12 may be configured by a computer 60 as shown in FIG. 10 includes a CPU (Central Processing Unit) 60A, a ROM (Read Only Memory) 60B, a RAM (Random Access Memory) 60C, a non-volatile memory 60D, and an input / output interface (I / O) 60E. The hard disk 60G and the communication unit 60H are connected to the I / O 60E. In this case, a program for causing the computer 60 to execute the processing shown in FIG. 9 is written in, for example, the hard disk 60G, and this is read and executed by the CPU 60A. Thereby, the computer 60 functions as a document management apparatus. The program may be provided by a recording medium such as a CD-ROM.

10 Document Management System 12 Document Management Device (Example of Access Rights Management Device)
14 User terminal device (an example of specifying means)
16 Communication line 18 Document management unit 20 Account management unit 22 Shared information reception unit (an example of reception means)
24 Access right acquisition unit (an example of acquisition means)
26 Reference document detection unit (an example of detection means)
28 Access right change part (an example of rewriting means)
30 communication unit 32 storage unit (an example of first storage unit, second storage unit, third storage unit)
34 Account information 36 Document data 38 Access authority information 40 Reference document list information

Claims (6)

The identification information for identifying the sharing target document data to be shared among the document data stored in the first storage means, the sharing target user for sharing the sharing target document data, and the sharing target document data A receiving means for receiving access right designation information for designating an access right to be given to a sharing target user;
The second access authority information related to the access right of the reference document data referred to in the share target document data is stored while acquiring the access right information related to the access right of the share target document data received by the receiving means. Obtaining means for obtaining the access authority information of the reference document data from the storage means;
Rewriting to rewrite access authority information of the sharing target document data and the reference document data so that the sharing target user can at least read the sharing target document data based on the access right specifying information received by the receiving unit Means,
An access right management device. Detecting means for detecting reference document identification information indicating reference document data referred to in the sharing target document data from the sharing target document data and storing the reference document identification information in association with the sharing target document data in a third storage means; In addition,
The acquisition unit acquires the access authority information of the reference document data from the second storage unit based on the reference document identification information associated with the sharing target document data in the third storage unit.
The access right management device according to claim 1. When the reference document identification information associated with the sharing target document data stored in the third storage unit is not available, the acquisition unit is detected from the sharing target document data by the detection unit. Obtaining the access authority information of the reference document data from the second storage means based on the reference document identification information that has been
The access right management apparatus according to claim 2. First storage means for storing document data;
Second storage means for storing access authority information relating to the access authority of the document data;
Identification information for identifying sharing target document data to be shared among document data stored in the first storage means, a sharing target user for sharing the sharing target document data, and the sharing target document data A designation means for designating an access right to be given to the sharing target user;
Receiving means for receiving access right designation information related to the access right designated by the designation means;
The access authority information related to the access right of the sharing target document data received by the receiving unit is acquired, and the access authority information of the reference document data referred to in the sharing target document data is obtained from the second storage unit. Acquisition means for acquiring;
Rewriting to rewrite access authority information of the sharing target document data and the reference document data so that the sharing target user can at least read the sharing target document data based on the access right specifying information received by the receiving unit Means,
Document management system with Calculation means for calculating a hash value of the sharing target document data based on the sharing target document data specified by the specifying means;
The reference document identification information indicating the reference document data referred to in the sharing target document data is detected from the sharing target document data, a hash value of the sharing target document data is obtained, and the detected reference document identification information is detected. Further comprising a detecting means for storing the information in association with the shared document data and the obtained hash value in a third storage means,
The acquisition unit acquires the access authority information of the reference document data from the second storage unit based on the reference document identification information associated with the sharing target document data in the third storage unit. Yes, if the hash value associated with the share target document data stored in the third storage unit is different from the hash value calculated by the calculation unit, the detection unit calculates the share target document. Obtaining the access authority information of the reference document data from the second storage means based on the reference document identification information detected from the data;
The document management system according to claim 4.   The access right management program for functioning a computer as each means which comprises the access right management apparatus of any one of Claims 1-3.

Images