JP2016224709A - File management system, file management method, and file management program - Google Patents

Abstract

PROBLEM TO BE SOLVED: To improve security related to the handling of a confidential file.SOLUTION: A file management system for managing the handling of a file stored in a computer on a network on the basis of a security policy includes: a detection part for detecting that any operation of the copy, movement and upload of the file has been operated; an approval request part for, when the operation is detected by the detection part, generating approval request information for making an approval request concerning the operation to a third person other than an operator who has performed the operation and a policy manager who manages the security policy, and for transmitting the approval request information to the computer of the third person on the network; a reception part for receiving the result of the approval request from the computer of the third person; and an operation control part for, when the result of the approval request is approval, permitting the operation, and for, when the result of the approval request is denial, inhibiting or interrupting the operation.SELECTED DRAWING: Figure 2

Description

  The present invention relates to a file management system, a file management method, and a file management program.

As a file management system that prevents leakage of confidential files including important information such as confidential information in companies, etc., for example, based on the reliability of removable storage devices and a predetermined security policy, A system for controlling a copy operation or the like has already been proposed (see, for example, Patent Document 1).
In the file management system described in Patent Document 1, the security level is set for all files including a confidential file, and when the file is copied to a removable storage device, the security level of the file is high. When a removable storage device that is not registered for use is used, file copy operations are prohibited.

JP 2008-225638 A

  In the above file management system, no measures are taken for the policy administrator who manages the security policy. For this reason, when the policy administrator changes the security policy so that the confidential file is taken out, there is still a risk that the confidential file is leaked to the outside.

  The present invention has been made in view of such circumstances, and an object of the present invention is to provide a file management system, a file management method, and a file management program that can improve security regarding handling of confidential files.

  A file management system according to an aspect of the present invention is a file management system that manages the handling of a file stored in a computer on a network based on a security policy, and includes copying, moving, and uploading the file. A detection unit that detects that any operation has been performed, and when the detection unit detects the operation, the operator who performed the operation and a third party other than the policy manager that manages the security policy An approval request unit for generating approval request information for performing an approval request for an operation, and transmitting the approval request information to the third party computer on the network, and a result of the approval request from the third party computer And the operation when the result of the approval request is approval. And volume, if the result of the approval request is denied is a file management system and a prohibition or suspend the operation control unit of the operation.

  A file management method according to an aspect of the present invention is a file management method for managing the handling of a file stored in a computer on a network based on a security policy, wherein the file is copied, moved, and moved by a detection unit. A detection step for detecting that any operation of uploading has been performed, and a policy for managing the operator who performed the operation and the security policy when the detection unit detects the operation by an approval request unit An approval request process for generating approval request information for requesting approval for the operation to a third party other than the administrator, and transmitting the approval request information to the third party computer on the network, and a receiving unit Receiving the approval request result from the third party computer; and And an operation control step for allowing the operation when the result of the approval request is approval, and prohibiting or interrupting the operation when the result of the approval request is denial. Is the method.

  A file management program according to an aspect of the present invention is a file management program for causing a computer to execute processing for managing handling of a file stored in a computer on a network based on a security policy. A detection unit that detects that any of copy, move, and upload operations of the file has been performed, and manages the operator who performed the operation and the security policy when the detection unit detects the operation An approval request unit for generating approval request information for requesting approval for the operation to a third party other than the policy manager, and transmitting the approval request information to the third party computer on the network; and Receive the result of the approval request from a third party computer. And file management for functioning as an operation control unit that permits the operation when the approval request result is approval, and prohibits or interrupts the operation when the approval request result is disapproval It is a program.

  According to the present invention, security related to handling of confidential files can be improved.

It is a figure which shows the file management system which concerns on one Embodiment of this invention. It is a block diagram which shows the structure of a computer. It is an example of the look-up table used when determining an operator and a third party. It is a modification of a lookup table. It is another modification of a lookup table. It is a figure which shows an example of the data format of approval request information. It is a flowchart which shows the processing content which a control part performs.

[Description of Embodiment of the Present Invention]
First, the contents of the embodiment of the present invention will be listed and described.
(1) A file management system according to an embodiment of the present invention is a file management system that manages the handling of a file stored in a computer on a network based on a security policy, and copies, moves, and uploads the file. And a third unit other than the operator who performed the operation and the policy manager who manages the security policy when the detection unit detects the operation. Generating an approval request information for requesting the user to approve the operation, and transmitting the approval request information to the third party computer on the network, and the approval request from the third party computer. A receiver that receives the result of the request, and if the result of the approval request is approval, It allows operation, and a ban or suspend the operation control unit of the operation when the result of the approval request is denied.

  According to the file management system described above, when an operation for copying, moving or uploading a file stored in a computer on a network is performed, the operations performed by the operator and the policy administrator who manages the security policy The three parties are requested to approve the operation. The operation is allowed when the approval request result is approval, and the operation is prohibited or interrupted when the approval request result is denial. For this reason, for example, even if a policy administrator performs an operation of copying a confidential file stored in the computer to a removable storage device, a third party other than the policy administrator denies the approval request for the operation, A confidential file can be prevented from leaking outside. Thereby, the security regarding handling of a confidential file can be improved.

(2) In the file management system, the approval request unit preferably generates the approval request information when a predetermined condition is satisfied.
In this case, the approval request information is generated / transmitted only when a predetermined condition is satisfied, so that it is possible to reduce the work load of the third party who performs the approval process.

(3) In the file management system, it is preferable that the predetermined condition includes a condition based on the number of files on which the operation is performed.
In this case, if the predetermined condition is, for example, that the number of files on which the operation has been performed is equal to or greater than a threshold value, and if the number of files is equal to or greater than the threshold value, the third party rejects the operation approval request. can do. Therefore, for example, if the number of confidential files on which the above operation has been performed is equal to or greater than a threshold, it is possible to prevent these confidential files from being taken out by a third party.
Further, since the predetermined condition is set based on the number of files, it is not necessary to set the security level for each file as in the conventional case. Therefore, a file management system can be easily constructed.

(4) In the file management system, the predetermined condition may include a condition based on a total capacity of the file on which the operation is performed.
In this case, for example, if the total capacity of a plurality of files on which the operation has been performed is equal to or greater than a threshold value, and the total capacity is equal to or greater than the threshold value, an approval request for the operation by a third party is given. Can be denied. Therefore, for example, even if the number of confidential files on which the above operation has been performed is small, if the total capacity of these confidential files is equal to or greater than a threshold value, these confidential files are taken out by a third party. Can be prevented.
Further, since the predetermined condition is set based on the total capacity of the file, it is not necessary to set the security level for each file as in the conventional case. Therefore, a file management system can be easily constructed.

(5) In the file management system, the predetermined condition may include a condition based on an elapsed time from the time when the previous operation was performed.
In this case, when the predetermined condition is, for example, that the elapsed time from the time when the previous operation was performed is less than the predetermined time, and the elapsed time is less than the predetermined time, the third party An operation approval request can be denied. Therefore, for example, even when a plurality of confidential files are continuously copied in a small number and a small capacity in a plurality of times, if the elapsed time is less than the predetermined time, these secrets may be copied by a third party. The file can be prevented from being taken outside.
Further, since the predetermined condition is set based on the elapsed time, it is not necessary to set the security level for each file as in the conventional case. Therefore, a file management system can be easily constructed.

(6) In the file management system, the predetermined condition may include a condition based on at least one of the number of files and the total capacity stored in one storage area as a storage destination by the past operation. good.
In this case, if the predetermined condition is, for example, that the number of files (or total capacity) stored in one storage area that is the storage destination by the previous operation is greater than or equal to a threshold value, the number of files (or total When the (capacity) is equal to or greater than the threshold, the approval request for the operation can be denied by a third party. Therefore, for example, even when a plurality of confidential files are divided into a small number (or capacity) and copied to the same storage area, the number of confidential files already stored in the storage area (or the total number) If the (capacity) is equal to or greater than the threshold, it is possible to prevent these confidential files from being taken out by a third party.
In addition, since the predetermined condition is set based on at least one of the number of files and the total capacity stored in the storage area, it is not necessary to set a security level for each file as in the prior art. Therefore, a file management system can be easily constructed.

(7) In the file management system, the predetermined condition includes a condition based on at least one of the number of files and the total capacity of the file in which the operation is performed in one folder that is a storage source by the past operation. You can leave.
In this case, if the predetermined condition is, for example, that the number (or total capacity) of files that have been operated in one folder that is the storage source by the previous operation is equal to or greater than a threshold, the number of the files When (or the total capacity) is equal to or greater than the threshold value, the approval request for the operation can be denied by a third party. Therefore, for example, for a plurality of confidential files stored in the same folder in a server computer on a network, even when copying a different number of confidential files from a plurality of client computers in a small number (or capacity), If the number (or total capacity) of confidential files already copied from the folder is equal to or greater than the threshold, it is possible to prevent these confidential files from being taken out by a third party.
Further, since the predetermined condition is set based on at least one of the number of files and the total capacity in which the operation is performed in the folder, it is not necessary to set a security level for each file as in the conventional case. . Therefore, a file management system can be easily constructed.

(8) In the file management system, the approval request unit identifies the operator based on identification information that can identify the operator, and determines the third party based on the identified operator. Is preferred.
In this case, since the approval request information is transmitted to a third party computer determined based on the operator, for example, whether or not to approve the operation by setting the person who knows the operator as the third party. Can be made appropriately.

(9) In the file management system, it is preferable that the approval request unit determines the identified superior of the operator as the third party.
In this case, since the approval request information is transmitted to the operator's superior computer, the operator's superior can determine whether or not to approve the operation.

(10) In the file management system, the approval request unit identifies the operator based on identification information that can identify the operator, and a plurality of candidates excluding the identified operator and the policy manager One candidate selected at random may be determined as the third party.
In this case, since the approval request information is transmitted to a third-party computer selected at random, it is possible to prevent the confidential file from being taken out by the operator and the third party colluding. . Therefore, security regarding handling of confidential files can be further improved.

(11) In the file management system, the specific information includes a login ID logged in to the computer on which the operation is performed, and the approval request unit includes a plurality of login IDs and the login IDs. It is preferable that the owner corresponding to the login ID included in the specifying information is specified as the operator using a look-up table indicating the relationship with the owner.
In this case, even when the operator cannot directly specify the operator, the approval request unit can specify the owner corresponding to the login ID logged in to the computer on which the operation is performed as the operator.

(12) In the file management system, the specific information includes an identifier of a computer on which the operation has been performed, and the approval request unit includes identifiers of a plurality of computers on the network and each of the computers. The owner of the computer corresponding to the identifier of the computer included in the specifying information may be specified as the operator using a look-up table indicating the relationship with the owner.
In this case, even when the operator cannot directly identify the operator, the approval request unit can identify the owner corresponding to the identifier of the computer on which the operation has been performed as the operator.

(13) In the file management system, the specific information includes an identifier of a removable storage device in which the file is stored by the operation, and the approval request unit includes an identifier of a plurality of removable storage devices and each of these identifiers. The owner of the removable storage device corresponding to the identifier of the removable storage device included in the specific information may be specified as the operator using a lookup table indicating the relationship with the owner of the removable storage device.
In this case, even when the operator cannot directly specify the operator, the approval request unit can specify the owner corresponding to the identifier of the removable storage device in which the file is stored by the operation as the operator.

(14) In the file management system, the approval request information preferably includes information indicating a reason for performing the operation.
In this case, the third party can appropriately determine whether or not to approve the operation based on information indicating the reason for performing the operation.

  (15) The file management method of this embodiment is a file management method executed in the above-described file management system. Accordingly, the file management method of the present embodiment has the same operational effects as the above-described file management system.

  (16) The file management program of the present embodiment is a program for causing a computer to function as the above-described file management system. Therefore, the file management program of the present embodiment has the same effects as the above-described file management system.

[Details of the embodiment of the present invention]
Hereinafter, embodiments of the present invention will be described in detail with reference to the accompanying drawings.
<Overall configuration of file management system>
FIG. 1 is a diagram showing a file management system according to an embodiment of the present invention.
This file management system includes a plurality (here, five) of client computers 1a, 1b, 1c, 1d, and 1e, a server computer 2, and a removable storage device 3.

  The server computer 2 is connected to each client computer 1a to 1e via a network such as a LAN (Local Area Network) or a WAN (Wide Area Network). In order to prevent leakage of files stored in the server computer 2 and the client computers 1a to 1e (hereinafter also simply referred to as computers), the handling of these files is set to a predetermined security policy. Is managed based on. The security policy is managed by the policy manager P1.

  The removable storage device 3 includes, for example, a USB memory (Universal Serial Bus memory), and can be connected to the computers 1a to 1e and 2. In addition to the USB memory, the removable storage device 3 may be another storage medium such as an SD memory card, a CD-R (Compact Disc-Recordable), or an external hard disk device.

FIG. 2 is a block diagram showing the configuration of the computers 1a to 1e and 2. As shown in FIG.
The computers 1a to 1e and 2 include a control unit 11, a communication unit 12, a storage unit 13, an input unit 14, and a display unit 15.
The control unit 11 includes a processor (CPU: Central Processing Unit) and the like, and is connected to each of the hardware units via an internal bus, and also controls operations of these units.

  The communication unit 12 is a communication interface capable of communicating with other computers via a network. The communication unit 12 transmits approval request information described later to another computer. The communication unit 12 functions as a receiving unit that receives the result of the approval request from another computer that has transmitted the approval request information.

  The storage unit 13 is composed of a recording medium such as a hard disk or a semiconductor memory connected to the control unit 11, and stores files (names, etc.) related to the security policy target file and the policy manager P1. Yes. The storage unit 13 temporarily stores various information (such as approval request information) transmitted and received by the communication unit 12. Furthermore, the storage unit 13 stores a computer program such as a file management program executed by the control unit 11.

  The input unit 14 includes an input interface such as a keyboard and a mouse. The display unit 15 is configured by a liquid crystal display or the like.

<About the control structure of the file management system>
The control unit 11 includes a detection unit 21, an approval request unit 22, and an operation control unit 23 as functional units of a file management program executed by the control unit 11.
Based on the operation input from the input unit 14 by the operator P2 of its own device, the detection unit 21 performs any one of the operations of copying, moving, and uploading the file stored in the storage unit 13 (hereinafter simply “copy”). It is detected that the operation is also performed.

When the detection unit 21 detects a copy operation or the like, the approval request unit 22 determines a third party P3 other than the policy manager P1 and the operator P2 stored in the storage unit 13 if a predetermined condition is satisfied. To do. Details of the predetermined condition will be described later.
The approval request unit 22 of the present embodiment specifies the operator P2 based on identification information that can identify the operator P2, and determines a third party P3 based on the identified operator P2. The specific information includes, for example, a login ID for logging in to a computer on which a copy operation or the like has been performed.

The approval request unit 22 generates approval request information for requesting approval for the copy operation or the like to the determined third party P3, and transmits the generated approval request information to the third party computer on the network. To do.
The operation control unit 23 allows a copy operation or the like when the result of the approval request received from the computer of the third party P3 by the communication unit 12 is approval, and copies when the result of the approval request is denial. Prohibit or interrupt operations.

  FIG. 3 is an example of a look-up table used when the approval request unit 22 determines the operator P2 and the third party P3. This lookup table shows a login ID for logging in to each of the computers 1a to 1e, 2, the name of the owner corresponding to the login ID, and the name of the superior corresponding to the owner. . Note that the lookup table is stored in the storage unit 13.

The approval request unit 22 reads the holder corresponding to the login ID included in the specific information using the lookup table, and specifies the owner as the operator P2. Thereby, even when the operator P2 cannot directly identify the operator P2, the approval request unit 22 identifies the owner corresponding to the login ID logged in to the computer on which the copy operation or the like has been performed as the operator P2. Can do.
The approval request unit 22 determines a third party P3 based on the identified operator (owner) P2. The approval request unit 22 of the present embodiment reads the upper manager corresponding to the identified owner using the lookup table, and determines the upper manager as the third party P3.

FIG. 4 is a modification of the lookup table used by the approval request unit 22.
In this modification, the identification information that can identify the operator P2 includes an identifier that can identify the computer on which the copy operation or the like has been performed, in addition to or instead of the login ID. As this identifier, for example, the serial number of the computer can be used.
The look-up table of the present modification shows the identifiers of the computers 1a to 1e, 2, the names of computer owners corresponding to the identifiers, and the names of superiors corresponding to the owners.

The approval request unit 22 reads the owner corresponding to the identifier of the computer included in the specific information using the lookup table, and specifies the owner as the operator P2. Thereby, even when the operator P2 cannot directly specify the operator P2, the approval request unit 22 can specify the owner corresponding to the identifier of the computer on which the copy operation or the like has been performed as the operator P2.
The approval request unit 22 reads the upper manager corresponding to the specified operator (owner) P2 using the lookup table, and determines the upper manager as the third party P3.

FIG. 5 is another modification of the lookup table used by the approval request unit 22.
In this modification, the identifier that can identify the removable storage device 3 in which the file is stored by a copy operation or the like is added to the specific information that can identify the operator P2 in addition to or instead of the login ID and the computer identifier. include. As this identifier, for example, the serial number of the removable storage device 3 can be used.
The lookup table of this modification corresponds to the identifiers of a plurality of removable storage devices that can be connected to the computers 1a to 1e, 2, the names of the owners of the removable storage devices corresponding to the identifiers, and the owners. The name of the superior is shown.

The approval request unit 22 reads the owner corresponding to the identifier of the removable storage device included in the specific information using the lookup table, and specifies the owner as the operator P2. Thereby, even when the operator P2 cannot directly identify the operator P2, the approval request unit 22 can identify the owner corresponding to the identifier of the removable storage device in which the file is stored by the copy operation or the like as the operator P2. it can.
The approval request unit 22 reads the upper manager corresponding to the specified operator (owner) P2 using the lookup table, and determines the upper manager as the third party P3.

Note that the approval request unit 22 may use a combination of two or more of the above three lookup tables. Further, the approval request unit 22 determines the superior of the operator P2 specified in the lookup table as a third party P3, but if it is a person who knows the operator P2, it sets it as a person other than the superior May be.
Further, the approval request unit 22 may determine one candidate selected at random from a plurality of candidates excluding the specified operator P2 and policy manager P1 as the third party P3. In this case, the lookup table need not include information indicating the name of the superior.

FIG. 6 is a diagram illustrating an example of the data format of the approval request information generated by the approval request unit 22. The approval request information of this embodiment includes data areas of “computer identifier”, “operator information”, “operation type information”, “file information”, “storage destination information”, and “operation reason information”.
The “computer identifier” is an area for storing an identifier of a computer on which a copy operation or the like has been performed. “Operator information” is an area for storing information related to the operator P2 specified using the lookup table (for example, the name of the operator P2).

  The “operation type information” is an area for storing information indicating whether the operation performed by the operator P2 is a copy, move, or upload operation. “File information” is an area for storing information (for example, a file name, the number of files, and a folder name in which the file is stored) regarding a file on which a copy operation or the like has been performed.

The “storage destination information” is an area for storing information related to the storage destination of a file by a copy operation or the like (for example, the location (path information) of the storage destination). The “operation reason information” is an area for storing information indicating the reason for performing the copy operation or the like. The information indicating the reason or the like is displayed on the display unit 15 when the operator P2 performs the copy operation or the like, for example. By displaying a message requesting the input of the information, the operator P2 himself / herself inputs the information through the input unit 14.
The approval request information may include other information in addition to or in place of the above information.

<About the processing contents of the control unit>
FIG. 7 is a flowchart showing the processing content executed by the control unit 11.
The control unit 11 starts processing when it is detected by the detection unit 21 that a copy operation or the like of the file stored in the storage unit 13 has been performed (step ST1, detection process).
When the detection unit 21 detects that a copy operation or the like has been performed, the approval request unit 22 determines whether or not a predetermined condition for performing an approval request for the copy operation or the like is satisfied (step ST2).

Specifically, the approval request unit 22 determines whether or not at least one of the following five conditions is satisfied as the predetermined condition, for example.
Condition 1: The number of files that have undergone a copy operation is greater than or equal to a threshold value Condition 2: The total capacity of files that have undergone a copy operation is greater than or equal to the threshold value Condition 3: The previous copy operation or the like has been performed The elapsed time from the point in time is less than the predetermined time. Condition 4: The number of files or the total capacity stored in one storage area as a storage destination by a past copy operation or the like is greater than or equal to a threshold. Condition 5: Past The number of files or the total capacity of files that have been copied in one folder that is the storage source due to copy operations, etc. must be greater than or equal to a threshold value

Condition 1 is set based on the idea that when the number of files subjected to a copy operation or the like is large, the risk of the confidential file being taken out increases.
Condition 2 is, for example, a case where the number of files subjected to a copy operation or the like is small and the condition 1 is not satisfied, but if the total capacity of these files is large, there is a risk that a confidential file may be taken out to the outside. It was set based on the idea of becoming higher.

Condition 3 and condition 4 are set based on the following idea. For example, when a copy operation or the like is performed by dividing a large number of files into a plurality of times with a small number and a small capacity, there is a risk that a confidential file is taken out without satisfying both of the conditions 1 and 2 .
Therefore, the elapsed time from the time when the previous copy operation or the like is performed is less than a predetermined time (Condition 3) and the past copy operation or the like so that the copy operation or the like is not continuously performed. Thus, the condition for requesting approval is that the number or total capacity of files stored in the same storage area (for example, a removable storage device) as a storage destination is equal to or greater than a threshold (condition 4).

Condition 5 is set based on the following idea. For example, as shown in FIG. 1, for a plurality of files stored in the same folder in the server computer 2 on the network, a copy operation or the like can be performed with a small number and a small capacity of different files from the plurality of client computers 1a to 1e. If it is performed, there is a risk that the confidential file is taken out without satisfying all of the conditions 1 to 4.
Therefore, in order to prevent such a copy operation from being performed, the number or total capacity of the files in which the copy operation or the like is performed in the same folder of the server computer 2 that is the storage source by the past copy operation or the like is greater than or equal to a threshold This is the condition for requesting approval.

The predetermined condition may include other conditions in addition to or instead of the above conditions 1 to 5. For example, the risk level is quantified based on the number of times file copy operations have been performed, the number of files that have been copied, etc., and the total capacity, etc. good.
In this case, when setting the degree of risk for the number of times that a file copy operation, etc. is performed, the file is externally exposed when the copy operation is performed only once for the same file and when it is performed a plurality of times. The risk of leakage is considered equivalent. For this reason, the risk level when a copy operation or the like is performed a plurality of times on the same file may be set to the same risk level as when the copy operation or the like of the file is performed only once.

Returning to FIG. 7, if the determination result in step ST <b> 2 is negative, the approval request unit 22 ends the process.
If the determination result in step ST2 is affirmative, the approval requesting unit 22 identifies the operator P2 who performed the next copy operation or the like (step ST3), and determines the superior of the identified operator P2 as a third party. P3 is determined (step ST4). The operator P2 and the third party P3 can be identified and determined using a lookup table (see FIG. 3) based on identification information (login ID or the like) that can identify the operator P2 as described above. .

Next, the approval request unit 22 generates approval request information (see FIG. 6) including file information, operation reason information, and the like, and transmits the generated approval request information to the computer of the third party P3 by the communication unit 12. (Step ST5, approval request process).
The third party P3 that has received the approval request information determines whether to approve an approval request such as a copy operation based on the approval request information, and transmits the result of the approval request to the computer of the operator P2.

When receiving the result of the approval request from the computer of the third party P3 by the communication unit 12 (step ST6, receiving step), the operation control unit 23 determines whether the result of the approval request is “approval”. (Step ST7).
If the determination result in step ST7 is affirmative, the operation control unit 23 allows a file copy operation or the like (step ST8, operation control step).
When the determination result of step ST7 is negative, that is, when the result of the approval request is “denied”, the operation control unit 23 prohibits the copy operation or the like unless the file copy operation or the like is started, If a file copy operation or the like has already been performed, the copy operation or the like is interrupted (step ST9, operation control step).

<About effect>
As described above, according to the present embodiment, when a file stored in a computer on a network is copied, the operator P2 who has performed the copying operation or the like and the policy manager P1 who manages the security policy are other than those. An approval request for a copy operation or the like is made to the third party P3. When the result of the approval request is approval, the copy operation or the like is permitted, and when the result of the approval request is disapproval, the copy operation or the like is prohibited or interrupted. Therefore, for example, even if the policy administrator P1 performs an operation of copying a confidential file stored in the computer to the removable storage device 3, a third party P3 other than the policy administrator P1 requests an approval for the copy operation or the like. By denying, the confidential file can be prevented from leaking outside. Thereby, the security regarding handling of a confidential file can be improved.

Moreover, since the approval request part 22 produces | generates and transmits approval request information, only when predetermined conditions are satisfy | filled, the work burden of the third party P3 which performs an approval process can be reduced.
Further, since the predetermined condition includes that the number of files subjected to the copy operation or the like is equal to or greater than a threshold value, when the number of files is equal to or greater than the threshold value, the copy operation is performed by a third party P3. The approval request such as can be denied. Therefore, for example, if the number of confidential files on which the copy operation or the like has been performed is equal to or greater than a threshold, it is possible to prevent these confidential files from being taken out by the third party P3.

  Further, since the predetermined condition includes that the total capacity of the file subjected to the copy operation or the like is greater than or equal to a threshold, when the total capacity is equal to or greater than the threshold, the copy operation is performed by a third party P3. The approval request such as can be denied. Therefore, for example, even if the number of confidential files subjected to the copy operation or the like is small, if the total capacity of these confidential files is equal to or greater than the threshold, these confidential files are externally released by the third party P3. It can be prevented from being taken out.

  Further, since the predetermined condition includes that the elapsed time from the time when the previous copy operation or the like was performed is less than the predetermined time, when the elapsed time is less than the predetermined time, the third condition The approval request for the copy operation or the like can be denied by the person P3. Therefore, for example, even when a plurality of confidential files are continuously copied and divided into a plurality of times with a small number and a small capacity, if the elapsed time is less than the predetermined time, the third party P3 Therefore, it is possible to prevent these confidential files from being taken outside.

  In addition, the predetermined condition includes that the number or total capacity of files stored in one storage area as a storage destination by a past copy operation or the like is equal to or greater than a threshold value. When the capacity is equal to or greater than the threshold, the third party P3 can deny an approval request for the copy operation or the like. Therefore, for example, even when a plurality of confidential files are copied to the same storage area in a small number and with a small capacity, the number or total capacity of confidential files already stored in the storage area is If it is equal to or greater than the threshold, it is possible to prevent these confidential files from being taken out by the third party P3.

  In addition, the predetermined condition includes, as a condition, that the number or total capacity of files in which the copy operation or the like has been performed in one folder that is a storage source by a past copy operation or the like is greater than or equal to a threshold value. If the number of files or the total capacity is equal to or greater than the threshold, the third party P3 can reject the approval request for the copy operation or the like. Therefore, for example, for a plurality of confidential files stored in the same folder in the server computer 2 on the network, different confidential files are copied from the plurality of client computers 1a to 1e with a small number and a small capacity. However, if the number or total capacity of the confidential files already copied from the folder is equal to or greater than the threshold, it is possible to prevent these confidential files from being taken out by the third party P3.

  Further, since the predetermined conditions are set to the above conditions 1 to 5, it is not necessary to set a security level for each file as in the prior art. Therefore, a file management system can be easily constructed.

  Further, since the approval request information is transmitted to the upper computer of the operator P2 determined by the approval request unit 22, the upper manager of the operator P2 appropriately determines whether to approve the copy operation or the like. be able to. Thereby, the security regarding handling of a confidential file can be further improved.

  In addition, when the approval request information is transmitted to the computer of the third party P3 randomly selected by the approval request unit 22, the operator P2 and the third party P3 collide and take out the confidential file to the outside. Can be prevented. Therefore, security regarding handling of confidential files can be further improved.

  Further, since the approval request information includes operation reason information indicating the reason why the copy operation or the like is performed, the third party P3 appropriately determines whether or not to approve the copy operation or the like based on the operation reason information. be able to.

  The embodiment disclosed this time should be considered as illustrative in all points and not restrictive. The scope of the present invention is defined by the terms of the claims, rather than the meanings described above, and is intended to include any modifications within the scope and meaning equivalent to the terms of the claims.

1a to 1e Client computer 2 Server computer 3 Removable storage device 11 Control unit 12 Communication unit 13 Storage unit 14 Input unit 15 Display unit 21 Detection unit 22 Approval request unit 23 Operation control unit P1 Policy manager P2 Operator P3 Third party

Claims (16)

A file management system for managing the handling of files stored in computers on a network based on a security policy,
A detection unit for detecting that any of the operations of copying, moving, and uploading the file has been performed;
When the detection unit detects the operation, it generates approval request information for requesting approval for the operation to a third party other than the operator who performed the operation and a policy administrator who manages the security policy, An approval request unit for transmitting approval request information to the third party computer on the network;
A receiving unit for receiving the result of the approval request from the third party computer;
An operation control unit that permits the operation when the result of the approval request is approval, and prohibits or interrupts the operation when the result of the approval request is denial;
A file management system comprising:   The file management system according to claim 1, wherein the approval request unit generates the approval request information when a predetermined condition is satisfied.   The file management system according to claim 2, wherein the predetermined condition includes a condition based on a number of files on which the operation is performed.   The file management system according to claim 2, wherein the predetermined condition includes a condition based on a total capacity of the file on which the operation is performed.   The file management system according to any one of claims 2 to 4, wherein the predetermined condition includes a condition based on an elapsed time from the time when the previous operation was performed.   6. The method according to claim 2, wherein the predetermined condition includes a condition based on at least one of the number of files and the total capacity stored in one storage area which is a storage destination by the past operation. File management system described in.   7. The method according to claim 2, wherein the predetermined condition includes a condition based on at least one of the number of files and the total capacity in which the operation is performed in one folder as a storage source by the past operation. The file management system according to claim 1.   The said approval request part specifies the said operator based on the specific information which can specify the said operator, and determines the said third party based on the specified said operator. The file management system according to item 1.   The file management system according to claim 8, wherein the approval request unit determines a superior of the identified operator as the third party.   The approval request unit identifies the operator based on identification information that can identify the operator, and randomly selects one of a plurality of candidates other than the identified operator and the policy manager. The file management system according to claim 1, wherein a candidate is determined as the third party. The specific information includes a login ID for logging in to the computer on which the operation has been performed,
The approval requesting unit specifies, as the operator, a holder corresponding to the login ID included in the specifying information, using a look-up table indicating a relationship between a plurality of login IDs and holders of these login IDs. The file management system according to any one of claims 8 to 10. The specific information includes an identifier of the computer on which the operation was performed,
The approval request unit uses a look-up table indicating the relationship between the identifiers of a plurality of computers on the network and the owners of the computers, and owns the computers corresponding to the identifiers of the computers included in the specific information. The file management system according to any one of claims 8 to 11, wherein an operator is specified as the operator. The specific information includes an identifier of a removable storage device in which a file is stored by the operation,
The approval request unit uses a lookup table indicating a relationship between identifiers of a plurality of removable storage devices and owners of the respective removable storage devices, and the removable request corresponding to the removable storage device identifier included in the specific information. The file management system according to any one of claims 8 to 12, wherein an owner of a storage device is specified as the operator.   The file management system according to claim 1, wherein the approval request information includes information indicating a reason for performing the operation. A file management method for managing handling of files stored in a computer on a network based on a security policy,
A detection step of detecting that any one of copying, moving and uploading of the file has been performed by the detection unit;
When the detection unit detects the operation by an approval request unit, approval request information for requesting approval for the operation to the third party other than the operator who performed the operation and the policy manager who manages the security policy And an approval request step for transmitting the approval request information to the third party computer on the network;
A receiving step of receiving a result of the approval request from the third party computer by a receiving unit;
An operation control step that allows the operation when the result of the approval request is approval by the operation control unit, and prohibits or interrupts the operation when the result of the approval request is denial;
File management method including. A file management program for causing a computer to execute processing for managing handling of a file stored in a computer on a network based on a security policy,
Computer
A detection unit for detecting that any of the operations of copying, moving, and uploading the file has been performed;
When the detection unit detects the operation, it generates approval request information for requesting approval for the operation to a third party other than the operator who performed the operation and a policy administrator who manages the security policy, An approval request unit for transmitting approval request information to the third party computer on the network;
A receiving unit for receiving the result of the approval request from the third party computer;
A file management program for functioning as an operation control unit that permits the operation when the result of the approval request is approval, and prohibits or interrupts the operation when the result of the approval request is disapproval.

Images