JPH096681A - Secrecy check method and device for data management device - Google Patents

Abstract

PURPOSE: To provide a secrecy protection check method/device with which an operator can easily and quickly deal with the data on plural types of authority. CONSTITUTION: This check device checks the secrecy protection of an operator when he retrieves the desired data out of plural groups of data which are stored as a group of data on plural relative items. The check device consists of the authority setting means 2 and 7 which set plural types of authority that decide the operable ranges for the items and/or operation contents and also assign the types of authority to the operators in every group of data, and a decision means 3 which receives the identification information and the operation contents of the operators supplied from an input means 9 to retrieve the authority of every operator set by the means 2 and 7 and decides that the data can be retrieved if the operator has and the authority; however the data can not be retrieved if he does not have it, to deal with his desired data respectively.

Description

Detailed Description of the Invention

[0001]

BACKGROUND OF THE INVENTION The present invention, when an operator retrieves desired data from a plurality of groups of data stored as one group of data for a plurality of related items, checks the security of the operator. A method and apparatus for performing.

[0002]

2. Description of the Related Art Generally, a computer system apparatus handles a wide variety of information, and a large amount of information, and many operators are involved in the operation thereof. Therefore, it is possible to freely use important information. Need to be restricted. Therefore, in order to prevent unauthorized use / unauthorized update of such important information, a security mechanism is provided to limit the operation range available to each operator. Conventionally, this security check has been performed using the operator's "user name and password" or the like.

This example will be described in detail with reference to FIGS. First, as shown in FIG. 7, an ID code and a password and their authority are negotiated for each operator. Further, as shown in FIG. 8, the operable range of each authority is determined. Then, as shown in FIG. 9, security check processing is performed during data operation. That is, first, the operator inputs his own ID code and password (step S201). In response to this, it is checked whether the entered ID code and password are correct (step S
202), if correct, the authority of the operator is acquired from the authority agreement (step S203). Waiting for the input of the operation target document and the operation content from the operator (step S204), it is judged from the authority content shown in FIG. 8 whether the operator can execute the input operation (step S205), If executable, the operation is enabled (steps S206, S207, S209). In the past, when performing operations with different authorities, the operator could only enter the ID code and password corresponding to the authority again and obtain the necessary authority before executing this operation. (Step S209).

[0004]

As described above, in the conventional security check, the operable authority depends on the operator, such as the operator is identified and checked by "user name and password". Therefore, it was impossible for one operator to operate simultaneously with multiple authorities. In such a case, a method of re-passing the security check process and transferring to another authority, such as the operator logging in again with a "user name and password" corresponding to another authority as described above. However, the operation is complicated and rapid processing is difficult.

The present invention has been made in view of the above circumstances, and a method of checking security for enabling one operator to easily and quickly operate with a plurality of authorities when performing data operation, and The purpose is to provide a device.

[0006]

In order to achieve the above object, the invention according to claim 1 of the present invention is such that an operator desires from a plurality of groups of data stored as one group of data for a plurality of related items. A method for performing security check on the operator when searching data, wherein a plurality of types of authority that defines an operable range are set for the above-mentioned item and / or operation content, and each operator is set. Assigning the type of authority to each data group, checking the authority of the operator for the data desired by the operator at the time of data retrieval, and if the operator has the authority for the data, The feature is that it is determined that the data can be searched, and that if the user does not have the authority, the data cannot be searched.

Further, in the invention according to claim 2, when the operator retrieves desired data from a plurality of groups of data stored as one group of data for a plurality of related items, the operator is protected from security. It is a device that performs a check, and sets a plurality of types of authority that defines an operable range for the item and / or operation content,
With respect to each operator, the authority setting means for allocating the type of authority for each data group, and the operator identification information and the operation content input from the input means are received from the authority setting means. For determining the operation of the desired data, if the operator has the authority, it is determined that the data can be searched, and if the operator does not have the authority, it is determined that the search is impossible. It is a feature.

[0008]

According to the first and second aspects of the present invention, first, the authority setting means sets a plurality of kinds of authority that define an operable range for data items and / or operation contents, and The type of authority is assigned to each operator for each data. Then, the operator inputs his / her identification information and the operation content to the determination means. In response to this, the determination means searches the authority of the operator, determines that the data can be searched if the operator has the authority to operate the desired data, and does not search if the operator does not have the authority. Judge as possible.

As described above, according to the present invention, it is possible to set different authority for one operator for each data group. As a result, the security check can be performed for each data group, and since it is not necessary to perform the security check for all data, the security check process can be performed easily and quickly.

[0010]

Embodiments of the present invention will be described below in detail with reference to the accompanying drawings. FIG. 1 is an explanatory view showing the outline of an apparatus according to an embodiment of the present invention. This device is a filing device for filing document data and the like, and is provided with a security check mechanism for operators (hereinafter referred to as "users"). As shown in FIG. 1, this device comprises a CPU (1), a storage device (5), an input device (9), and a display device (10), and the CPU (1) has authority. Registration unit (2), authority search / determination unit (3) and process execution unit (4)
The storage device (5) includes a data storage unit (6), an authority information storage unit (7), and a processing program unit (8). The details of each unit will be described below. The input device (9) is composed of a keyboard, a mouse and the like, and the display device (10) is composed of a display and the like, all of which are known elements, and therefore detailed description thereof will be omitted here. Further, in this example, the data to be filed is the document data, but the data is not limited to this, and there is no problem even if it is numerical data.

The processing program section (8) stores a program for executing a predetermined processing, and the processing execution section (4) stores a program corresponding to a designated processing in the processing program section (8). The program is read out and the program is executed.

The authority registration unit (2) receives a plurality of types of authority that determines the operable range of the user in response to the input from the input device (9), and determines the type of authority for each user. It is to be assigned. Specific functions of the authority registration unit (2) will be described with reference to FIGS.
Will be described in more detail. FIG. 2 is a chart for explaining the setting of the type of authority, and FIG. 3 is a chart for explaining the allocation of the authority. Regarding the document data in this example, there are a plurality of types of document (quote and contract) data for each theme (for example, for each customer).
The "each document data" corresponds to the "item" in the claims, and the "plurality of document data for each theme" corresponds to the "group of data" in the claims.

First, the authority setting will be described. In this example, as shown in FIG. 2, “administrator authority” is given for the authority.
And “person in charge” are set and the contents are set respectively. That is, “administrator authority” means that operations for approval of quotation documents and approval of contract documents are possible, but operations for creation / change of quote documents and creation / change of contract documents are not possible. Yes, the “person in charge” means that operations such as creation / modification of quotation documents and creation / modification of contract documents are possible, but operations for approval of quotation documents and approval of contract documents are not possible. is there. Incidentally, the "creation", "change", and "approval" referred to here correspond to the "operation content" in the claims. In this way, the authority setting is performed by setting the permission / prohibition of the “operation content” related to the “document data”.

Further, as shown in FIG. 3, each user is assigned to have the "administrator authority" or the "personal authority" for each theme. That is, for example, the user “employee A” has “personal authority” for theme 1, “administrator authority” for theme 2, and “administrator authority” and “person responsible” for theme 3. Have “authority”. In this way, the allocation of authority is performed by allocating the authority for each user for each theme.

The data storage unit (6) stores the document data for each theme, and the authority information storage unit (7) stores the authority information set by the authority registration unit (2). is there.

The authority search / determination section (3) obtains the identification information of the user and the information about the theme, searches the authority information storage section (7) based on the information, and obtains the authority information of the user. Based on the authority information, it is determined whether the user can search the document data specified by the user.

This determination process will be described in more detail with reference to FIG. As shown in the figure, first, the user "employee A" inputs his / her user name and password from the input device (9) and logs in (step S1). As a result, the authority search / determination unit (3) identifies that the user is “employee A” by the user name and password. At this time, if the password for the user is incorrect, an error will occur and login will not be possible. Then, "employee A" selects and inputs the theme to be operated ("theme 1" in this example) from the themes he is in charge of (step S2). In response to this input, the authority search / determination section (3) searches the authority information storage section (7) to obtain the type of authority of “employee A” and obtain the content of the authority (step S
3). At this time, "employee A" can select only the theme for which he / she has the authority, and cannot select other themes for which he / she has no authority. As shown in FIG.
Since “employee A” has authority over “theme 1”, “theme 2”, and “theme 3” and does not have authority over “theme 4”, “employee A” has “theme 1” and “theme 2”. , "Theme 3" can be selected, but "Theme 4" cannot be selected. In the example of FIG. 4, “theme 1” is selected, and the authority search / determination unit (3) obtains information from the authority information storage unit (7) that the authority of “employee A” is “person authority”. obtain.

Then, "employee A" selects and inputs desired operation contents. In response to this, the authority search / determination unit (3)
Compares the authority content obtained from the authority information storage section (7) with the input operation content, and if "employee A" can operate the processing, the operation execution section ( 4), and if the operation is not possible, “Operation not possible” is displayed on the display device (10). The process execution unit (4) reads the process program corresponding to the selected process from the process program unit (8) of the storage device (5) and executes it (step S4). In the example of FIG. 4, "employee A" can create or change a quote or create or change a contract, but cannot approve the quote or approve the contract.

FIG. 5 is an explanatory diagram showing an example of switching the theme after login. In this example, the theme can be switched at any time after logging in. Even when switching the theme after login, the operation for other themes not related to the user cannot be performed. As mentioned above, the theme that "Employee A" can select is "Theme 1",
Since “theme 2” and “theme 3” are set, “employee A” cannot perform operations on other themes other than these. When the theme is switched, the authority search / determination unit (3) automatically acquires the authority assigned to the theme by the user according to the theme selected by the user, and switches the authority. In the example of FIG. 5, when switching to “theme 2”, the authority is automatically switched to “administrator authority”, and when switching to “theme 3”, the authority is automatically switched to “administrator authority + person authority”. Then, the user can perform an operation according to this authority.

FIG. 6 shows the series of processes described above.

[0021]

As described in detail above, according to the present invention, it is possible to set different authority for one operator for each data group. As a result, the security check can be performed for each data group, and since it is not necessary to perform the security check for all data, the security check process can be performed easily and quickly. In addition, a plurality of authorities can be set for one operator, more detailed security check can be performed, and a shift to a different authority can be performed easily and a quick operation can be performed.

[Brief description of drawings]

FIG. 1 is a block diagram showing a schematic configuration of a device according to an embodiment of the present invention.

FIG. 2 is an explanatory diagram for explaining types of authority.

FIG. 3 is an explanatory diagram for explaining allocation of authority.

FIG. 4 is an explanatory diagram illustrating a determination process.

FIG. 5 is an explanatory diagram for explaining switching of the theme after login.

FIG. 6 is a flowchart showing a determination process and a theme switching process.

FIG. 7 is a chart showing a relationship between an ID code and the like and authority.

FIG. 8 is an explanatory diagram illustrating types of authorities.

FIG. 9 is an explanatory diagram showing a conventional security check process.

[Explanation of symbols]

 1 CPU 2 Authority Registration Section 3 Authority Search / Determination Section 4 Processing Execution Section 5 Storage Device 6 Data Storage Section 7 Authority Information Storage Section 8 Processing Program Section 9 Input Device 10 Display Device

Claims (2)

[Claims] 1. A method for checking security of an operator when the operator retrieves desired data from a plurality of groups of data stored as a group of data for a plurality of related items, For each item and / or operation content, a plurality of types of authority that define the operable range are set, and for each operator, the type of authority is assigned to each of the data groups, and at the time of data retrieval, the operator is assigned. Checks the authority of the operator for the desired data, and enables the retrieval of the data if the operator has the authority for the data,
A confidentiality check method in a data management device, characterized in that a search is impossible unless the user has the authority. 2. An apparatus for checking security of an operator when the operator retrieves desired data from a plurality of groups of data stored as a group of data regarding a plurality of related items. , Authority setting means for setting a plurality of types of authority defining an operable range for the item and / or operation content, and assigning the type of authority to each operator for each data group, and input means The operator's authority is retrieved from the authority setting means in response to the operator's identification information and the operation content input by the operator, and if the operator has the authority to operate the desired data, the operator retrieves the data. A confidentiality check device in a data management device, characterized in that the confidentiality check device is configured to determine that it is possible and that if the user does not have the authority, the search is impossible.