JP2000020377A - Database system, data managing method and storage medium storing software for data management - Google Patents

Abstract

PROBLEM TO BE SOLVED: To easily perform the management and change of access right by relating it with the attribute of a user on the organization. SOLUTION: A document access designating part 42 designates the mode (kind) of access such as reference, preparation or approval to be performed to the document in a database 1. Based on the section and managerial position of the user, a document preparation/reference right check part 43 judges whether the user has the access right or not corresponding to the designated document and access kind. A page preparation/reference right check part 45 investigates whether the user has the access right to perform reference or preparation corresponding to the kind of access together with the part designated by a table-of- contents display part 44. A page display/write part 46 displays the page of the designated document.

Description

DETAILED DESCRIPTION OF THE INVENTION

[0001]

[0001] 1. Field of the Invention [0002] The present invention relates to an improvement in a technique relating to a database system for storing and managing data such as documents. The management can be easily changed by associating.

[0002]

2. Description of the Related Art In a database used by a plurality of users,
It is important to manage access rights in order to prevent unauthorized reference or falsification of documents, files, data, etc. (hereinafter collectively referred to as “data”). The access right is an authority indicating which user can access which data and how, and is generally set for each type of access, such as creation, reference, editing, approval, and deletion.

[0003] Techniques related to such access right management include: (1) First, a password such as a keyword or an access code is set in units of data, and a user who knows the password is given a password to the file. Known are those that allow access.

(2) Also, an access right is set in units of data sets in units of directories or the like, and which set is to be accessed based on the user ID and password input by the user. Is also known.

(3) Further, as disclosed in Japanese Patent Application Laid-Open No. 9-6681, when a user accesses a group of data, the user is allowed to operate which items and what kind of operation. There is also known an example in which permission or rejection is set for a plurality of types of authority, and such an authority type relating to each data group can be assigned to each user.

(4) In Japanese Patent No. 2700517 (JP-A-6-26691), regarding data management using a relational database, versions of data and versions of data in page units are stored simultaneously in association with each other. Examples are disclosed. In this example, a confidential type can be set for each version and page, and access rights can be managed based on attributes for each user.

[0007]

However, in the prior art as described above, the access right is managed for each user independently of the organizational departments and positions, so that the type of data is limited. If there is an increase in personnel or personnel changes,
There was a problem that the change concerning the access right was troublesome.

That is, in the above-mentioned example (1), since a password is set for data, each user who performs a common task using the data has to be provided with the password. Data not available. For this reason, there is a problem in that it takes time and effort to notify the password to a necessary range of users, and there is a problem that the number of types of passwords increases the burden on the users to manage the password. Further, when the user who knows the password loses the access right to the data due to a transfer or the like, a complicated procedure such as changing the password is required.

In the above-mentioned example (2), the ID and the password corresponding to the aggregate must be made known only to the individual users who can access them. In the case where the access right is lost due to change, it is difficult to manage to prevent unauthorized access by the original access right holder.

Further, in the above-mentioned example (3), setting the access right is complicated because the authority is set in relation to each user and the items and contents that can be operated. In particular,
If the work of users changes due to the movement of departments in the company, etc., and the access rights change, the access rights must be reset according to the relationship between individual users and items and contents as described above. There is a problem that the trouble is burdensome.

In particular, with regard to access rights within an organization such as a company, a viewpoint of how many positions of users may access and a viewpoint of which departments of users are reasonable to grant access. Are both required. But,
Conventionally, a plurality of viewpoints, which should originally be present, are unified into a table representing access rights. For this reason, if there is a change in people, a reorganization of business units, or an increase in data, such a unified table must be modified so that there is no inconsistency in relation to individuals. However, there is also a problem that it takes a lot of trouble to correct correctly.

The present invention has been proposed to solve the above-mentioned problems of the prior art, and its object is to easily associate an access right with a user's organizational attribute. It is a management change. Another object of the present invention is to efficiently set access rights for a plurality of documents. Another object of the present invention is to manage security finely by enabling access rights to be set for each part of a document.

[0013]

In order to achieve the above-mentioned object, a first aspect of the present invention is a database system for managing data, wherein a means for specifying which data is to be accessed, and a means for specifying which data to access. Judgment means for judging whether or not the user has access to data based on organizational attributes given in advance for each user. Access means for making access. The invention of claim 6 relates to the invention of claim 1 and shows a data structure called a table. In a database system for managing data, an attribute table for storing organizational attributes of each user is provided. An access right table that stores whether or not there is an access right to each data based on an organizational attribute; and an access to specified data based on the attribute table and the access right table. Determining means for determining whether or not to permit the user. According to a thirteenth aspect of the present invention, the invention of the first aspect is regarded as a method. In a data management method for managing data, a step for designating which data is to be accessed, and A step of determining whether or not the user has an access right based on an organizational attribute given in advance to each user, and allowing the user determined to have the access right to access the specified data Access step. Claim 17
The invention of claim 1, the invention of claim 13 is viewed from the viewpoint of a recording medium recording computer software, in a recording medium recording data management software for managing data using a computer, The software allows the computer to accept designation of which data to access, and determines whether or not the user has access to the designated data based on organizational attributes given in advance for each user. And allowing the user determined to have the access right to access the specified data. According to the first, sixth, thirteenth, and seventeenth aspects of the present invention, it is determined whether access to each data is permitted based on organizational attributes such as a user's department and post. For this reason, when a department or position changes due to a change or the like, if the organizational attribute is changed, the contents of the access right automatically change accordingly. This eliminates the need to enter a password for each piece of data to be accessed, change the password at the time of transfer, or reset access rights for each piece of data.

According to a second aspect of the present invention, in the database system according to the first aspect, when it is determined that there is an access right for the specified data, the portion of the specified data is displayed. Means, means for designating which part of the data is to be accessed, and whether or not the user has an access right to the specified part is determined based on the organizational attributes given in advance for each user. Determination means, wherein the access means is configured to allow a user determined to have an access right to the designated part to access the part. According to a fifth aspect of the present invention, in the database system for managing data, for each data and its part, what kind of organizational attribute a user having an access right has stored is stored. Access right table, means for checking whether the user has the right to use the database system, means for specifying the data to be accessed, and the user having the right to access the specified data Means for determining whether or not the user has the access right to the specified data, based on the organizational attributes of the user and the access right table, and what part the data has , A part to be accessed, a means for specifying an access type, a specified part and an access type When the user has means for determining based on whether they have access to the access right table, the user has access the type specified portion and accessible for, and access means for executing the access,
It is characterized by having. According to a fourteenth aspect of the invention, the invention of the second aspect is viewed from the viewpoint of a method. In the data management method according to the thirteenth aspect, when it is determined that the specified data has an access right, the specified data is designated. For each user, the steps to indicate what part of the data they have, the step to specify which part of the data is to be accessed, and the presence or absence of the right to access the specified part. And a step of determining the attribute of the organization given in advance, the step of accessing, for the user who is determined to have the right to access the specified portion,
It is characterized in that the part is accessed. Claim 1
According to an eighth aspect of the present invention, the inventions of the second and fourteenth aspects are viewed from the viewpoint of a recording medium on which software of a computer is recorded. In the database system according to the seventeenth aspect, the software stores data designated by the computer. If it is determined that the user has the right to access the specified data, it displays what part the specified data has, accepts the specification of which part of the data is to be accessed, and has the right to access the specified part. Is determined based on the organizational attributes given to each user in advance, and if a user is determined to have access to the specified part, that part is accessed. I do. Claims 2, 5, 1
According to the inventions of Patent Nos. 4 and 18, in addition to the check at the time of log-in, only when the access right to the data can be confirmed, what part such as the version and the page the data has is presented. Further, the access right is confirmed for the part to be accessed and the type of access. As described above, by gradually disclosing information to the user, the security of the system is further improved.

According to a third aspect of the present invention, in the database system according to the first or second aspect, each data is divided into a plurality of classifications in advance, and the determining means determines whether the user has an access right to the specified data. Is determined based on the relationship between the specified data classification and the organizational attributes given in advance for each user. The invention according to claim 7 relates to the invention according to claim 3 and shows a data structure called a table. In the database system according to claim 6, each data is classified into a plurality of classes including one or more hierarchies. The access right table stores whether or not there is an access right to data based on each classification. According to a fifteenth aspect of the present invention, the invention of the third aspect is viewed from the viewpoint of a method. In the data management method according to the thirteenth or fourteenth aspect, each data is divided into a plurality of classifications in advance, and The step is characterized in that whether or not the user has the right to access the specified data is determined based on the classification of the specified data and a relationship between each user and an organizational attribute given in advance for each user. I do. According to the third, seventh, and fifteenth aspects of the present invention, using a general concept such as a type of data and a higher-level large classification,
Access rights can be collectively and efficiently set for a plurality of data having a common property.

According to a fourth aspect of the present invention, in a database system for managing data, an attribute table for associating a department and a post to which each user belongs is associated with a data type including one or more data. A classification table for classifying into one or more major types including one or more data types, one or more versions for each data, and one or more versions for each page included in the data A table for associating at least one of the above, and whether or not the user has an access right to the data is determined for each of at least one of the data type, the major classification, the data, the version related to the data, the page, and the page version. And an access right table for storing based on at least one of the department or position. To. The invention of claim 16 is
The invention of claim 4 is taken from the viewpoint of a method,
In the data management method for managing data, the department to which each user belongs and the post are associated in advance,
A data type including one or more data,
The data is classified into a large classification including one or more data types, and one or two or more versions of each data and at least one of a page included in the data and one or two or more versions of each page are included. The data type, the data type,
For at least one of the major categories, data, data versions, pages, and page versions,
The determination is based on at least one of the department or position. According to the fourth and sixteenth aspects of the present invention, the setting of the access right to data can be collectively performed based on high-level concepts such as data types and large classifications, or can be performed in units of data such as versions or pages. . Moreover, access rights can be set in units of these based on departments and positions. For this reason, by sharing appropriate types of data and appropriate portions of data to appropriate officials of related departments, it is possible to easily achieve both information sharing and security. As a processing procedure using each of these tables, for example, if the access right is checked in units of data, it is possible to see what version or page is available, and then, based on the access right, an access is attempted. If you select more versions or pages, you might see specific access rights for the selected version or page. Further, each table may be configured as a single table, or may be configured as a plurality of tables for each type of correspondence.

According to an eighth aspect of the present invention, in the database system according to the sixth or seventh aspect, the attribute table comprises:
Each user includes at least one of a department and a post, and the access right table stores whether or not the user has an access right to data based on at least one of the department and the post. According to the invention of claim 8, since the presence or absence of the access right is determined based on the department or the position, it is easy to apply to many organizations that are systematized for each department and have a hierarchical post system.

According to a ninth aspect of the present invention, in the database system according to any one of the sixth to eighth aspects, the access right table indicates whether or not there is an access right.
It is characterized in that it is stored according to the type of access. According to the ninth aspect of the present invention, the access right can be set according to the type of access such as reference only for viewing data, creation of data, and approval of data contents. Can be managed.

According to a tenth aspect of the present invention, in the database system according to any one of the sixth to ninth aspects, the access right table includes at least one of a version of the data, a page included in the data, and a version of the page. Storing whether or not there is an access right in units of one, wherein the determining means is configured to determine whether to permit access to a specified version, page or page version of the data; I do. According to the tenth aspect, it is possible to set an access right for data such as a document for each version or each page. For this reason, if the properties of even one piece of data differ from part to part, it is not necessary to forcibly determine whether to permit access as the whole data. Thus, it is possible to finely set whether to grant access to give priority to use of information or to give priority to security without granting access, depending on the nature of the part.

According to an eleventh aspect of the present invention, in the database system according to any one of the sixth to tenth aspects,
A table for limiting access to at least one of the data, the data version, the data page, or the page version to only some users of the department is provided. According to the invention of claim 11, data related to confidential matter that must be kept secret from other departments even within the organization, data that is in the process of being created and is not disclosed to other departments, etc.
Access can be limited to users of some departments, such as the department that created the data, and security is further improved.

The invention of claim 12 is the invention of claim 10 or 11
In the above described database system, a table for storing the contents of data for each page is provided. According to the twelfth aspect of the invention, the contents of the page are also stored in a table format which is easy to handle on the relational database, so that the implementation is easy.

[0022]

Embodiments of the present invention (hereinafter, referred to as "embodiments") will be described below with reference to the drawings. It is generally considered that the present invention is realized by controlling a computer having a peripheral device by software. In this case, the software is created by combining the instructions according to the description in this specification, and the common parts with the above-described prior art use the technique described in the prior art. Further, the software includes not only program codes but also data prepared in advance for use in executing the program codes.

The software utilizes physical resources such as a CPU, a coprocessor, processing devices such as various chipsets, input devices such as a keyboard and a mouse, storage devices such as a memory and a hard disk device, and output devices such as a display and a printer. By doing so, the operation and effect of the present invention are realized.

However, the specific software and hardware configurations for implementing the present invention can be variously modified. For example, there are various types of software such as a compiler, an interpreter, and an assembler. For exchanging information with the outside, various types of a removable recording medium such as a floppy disk, a network connection device, and the like can be considered. Further, a recording medium such as a CD-ROM in which software or a program for realizing the present invention is recorded is also an aspect of the present invention by itself. Further, a part of the functions of the present invention can be realized by a physical electronic circuit such as an LSI.

As described above, there are various possible modes for realizing the present invention using a computer. In the following, a virtual circuit block for realizing individual functions included in the present invention and the embodiments will be described. The invention and embodiments will be described. For each figure used in the description,
The same elements and the same types of elements as those described in the previous figures are denoted by the same reference numerals, and description thereof will be omitted.

[1. Outline of Embodiment] FIG. 1 is a conceptual diagram showing an outline of this embodiment. That is, in this embodiment, as shown in FIG. 1, data such as a document is stored in the database 1 and the attribute table H stores
Attribute such as department and post for each user is stored,
The access right table T stores, for each document stored in the database 1, what attribute of the user has access rights for reference and creation. Further, as an interface for exchanging information such as instructions and data with a user, an output unit 3a such as a CRT monitor and an input unit 3b such as a keyboard and a mouse are provided.

When the user specifies a document to be accessed from the specifying unit 142, the judging unit 143 refers to the attribute table H and the access right table T described above, and the organization of the user is determined. Based on the attributes of
Determines whether the user has access to the specified document. When the user has the access right, the access unit 146 executes access to the specified document.

[2. Configuration of Embodiment] [2-1. Overall Configuration] FIG. 2 is a functional block diagram showing a specific configuration of this embodiment. That is,
In this embodiment, the present invention is applied to a relational database. As shown in FIG. 2, a database 1, a DBMS (database management system) 2, a display input interface unit 3, a document management control unit 4,
It has.

The database 1 is a relational database, and can store various data in a table format. The database 1 includes not only documents such as character string texts, but also files including modification data specific to various application programs, image files such as bitmap images,
Various types of files, such as worksheets for spreadsheet programs and drawing data files for draw tools and graphic software, can be stored as data.

However, here, the database 1 stores documents as data, and will be described in detail later.
It is also assumed that a plurality of tables for managing documents and managing access rights to documents are also stored.

The DBMS 2 performs various operations such as creation, addition, search, update, and deletion on data such as documents stored in the database 1. The display input interface unit 3 is an interface that accepts various instructions and data inputs from the user, and presents information such as data extracted from the database 1 and messages such as operational prompts to the user. is there.

Further, the document management control unit 4 refers to each table in the database 1 in accordance with an instruction from the user given through the display input interface unit 3 and gives a database 1 to a user who has access right. This is the part that accesses the document inside. The document management control unit 4 specifically includes a user check unit 41, a document access designation unit 42, a document creation / reference right check unit 43, a document table display unit 44, a page creation / reference right check A section 45 and a page display / write section 46 are provided.

The user checking unit 41 determines whether the user who is trying to access the database 1 is a registered regular user based on the personal ID and password input from the display input interface unit 3. This is a means for checking whether or not the user belongs to an organization, such as affiliation and post, from a table in the database 1 for use in checking access rights.

The document access designation section 42 allows the user to refer to, create,
This is a means for specifying what mode (type) of access, such as approval, is to be made.
2 obtains, from the table in the database 1, the document ID number for uniquely defining which document the document specified in this way is.

The document creation / reference right check unit 43
Is a means for checking whether the user has the right to reference, create, approve, etc. the specified document, that is, whether or not the user has the access right. I can't proceed.

The document table of contents display section 44 displays the configuration (called a table of contents) such as what version and what logical page (called a logical page or page) the specified document has. This is a means for displaying in a table format. The user looks at the table of contents and designates which part, that is, which version or page is to be accessed, in the document table of contents display section 44, and sets a mode such as a reference mode or a creation mode as an access type. specify.

A page creation / reference right check unit 45
Is a means for checking whether the user has an access right to refer to, create, and the like with respect to the portion and the type of access specified by the document table of contents display section 44. If the user does not have the access right, go to the next step Does not proceed. In addition, document creation
The reference right check unit 43 and the page creation / reference right check unit 45 determine whether or not each user is permitted to access the specified data. In particular, the page creation / reference right check unit 45 corresponds to a second determination unit described in the claims.

The page display / write section 46 is means for displaying a page of a designated document. And
In the page display / write section 46, when a document is opened in the creation mode, the document can be written or rewritten on the display screen, and the written content can be registered in the database 1. . On the other hand, even when the document is opened in the reference mode, the page display / write unit 46 cannot write or rewrite the document. The page display / write unit 46 corresponds to an access unit described in the claims.

[2-2. Table Configuration] The database 1 also registers the following tables required for document management and access right management. First, a table A shown in FIG. 3 is a table storing names, symbols, and document types for individual documents. Further, in this table A, a unique document ID uniquely assigned to each document so that the documents do not overlap with each other,
The document type to which the document belongs is registered. Since the documents are identified by the document IDs, the document names need not be unique (unique), and can be freely named according to the use of the documents.

Table B shown in FIG.
Represents the number and what version (document Ver) of the entire document is issued and stored for each document specified by. For example, if the document ID is "A
As the document “001”, there are two versions, version 1 and version 2 created on different dates.

Table C shown in FIG. 5 stores what kind of logical page is made of each version of the document specified by the document ID in table B shown in FIG. Represents what version (called a page version) each of those pages has.

Table D shown in FIG. 6 is different from Table C shown in FIG. 5 in that each logical page and its page version that constitute each document is created by which department (creating department). ) Is associated with a confidential level, which is information for limiting access rights to some departments.

Table E shown in FIG. 7 shows the document type associated with each document in table A shown in FIG.
Furthermore, they are classified into a large category, which is a superordinate concept. As a result, as will be described in detail later, it is possible to easily set an access right for creating or referring to a higher-level concept called a large classification. The table A and the table E shown in FIG. 3 are for classifying individual documents in two layers, and correspond to the classification table described above.

A table F shown in FIG. 8 indicates the correspondence relationship between logical types to be included in each document type. The table F can be referred to when a new document is created, for example. The required pages are configured.

The contents of each logical page described above are stored in another table, and the table G shown in FIG. 9 shows in which table the contents of each logical page are stored as described above. Is represented. By storing the contents of each logical page in a table in this way, the data itself and the data management table can be configured in the same table format that can be handled on a relational database, so that implementation is facilitated. .

The tables TBL01, TBL01,
As shown in Table G of FIG. 9, TBL02 is a table in which actual data forming the logical page PS01 (FIG. 9) is stored in two parts according to the nature of the data. . Similarly, the tables TBL31 and TBL32 shown in FIG.
F01 (FIG. 9) is a table that stores actual data. Since the contents of these pages differ depending on the specific application of the document and the application program to be used, it is not necessary to limit the contents to a certain format, and they can be freely determined.

The document reference right table shown in FIG. 12 has an access right for a user in any department or position in the reference mode based on the document's large classification and document type. Is a registered table. Similarly, the document creation right table shown in FIG. 13 shows, for each major classification and document type of a document, what kind of department or position of a user has the access right to access in the creation mode. It is a registered table.

The page reference right table shown in FIG. 14 registers, for each logical page of the document, what kind of department or position the user has access right to access in the reference mode. The page creation right table shown in FIG. 14 is used to determine, for each logical page of a document, what kind of department or position a user has access right to access in the creation mode. It is a registered table.

Each of the tables shown in FIGS.
It stores whether or not there is an access right to data based on organizational attributes such as a department and a post, and corresponds to the above-described access right table. In addition, these access right tables store whether or not there is an access right for each type of access, as described above for each table.

In particular, the page reference right table and the page creation right table shown in FIG. 14 set an access right for each page included in the data. You can also set access rights for each version of.

A table H shown in FIG. 15 is a table storing information relating to individual users who use the system. Specifically, a table H is a registered regular user. In addition to the login name and password for confirming whether or not, the information includes the department code of the department to which the user belongs, the post code indicating the post, and the like. These departments and positions are attributes of the user's organization, and this table H corresponds to the attribute table described above.

[3. Operation of the Embodiment] This embodiment configured as described above operates as follows. Here, FIG. 16 is a flowchart showing a processing procedure in this embodiment. [3-1. User Authentication and Document Specification] First, a user inputs his / her login name and password from the display input interface unit 3 (step 1). When the data relating to the user is thus input, the user check unit 41 is activated in the document management control unit 4, and the user check unit 41 stores the data in the table H (FIG. 15) in the database 1 through the DBMS 2. Access and check whether the user corresponding to the input login name and password is registered.

As a result, if the corresponding user is registered (step 2), the user check unit 41 stores the department code and the post code of the logged-in user in the table H.
And saves it in the document management control unit 4, and activates the document access designation unit 42.

When the login is successful, the document access designating section 42 determines which document is stored in the database 1 based on the table A in the database 1 (FIG. 3). A list is displayed on the display screen in FIG. 3, and the user specifies a document that he / she wants to access from a list of displayed documents and the like (step 3). In this specification, which document is to be viewed is specified by the document ID, and whether the user simply wants to refer to the document (reference mode) or edits (creation mode) is specified.

It is to be noted that the format in which the document is displayed is arbitrary and is not shown again. For example, a simple list display based on the document name order, last update date order, or the like is possible. For example, a tree display may be performed for each document type or each directory, or a display may be performed for each access right level.

[3-2. Judgment of access rights for each document)
Subsequently, the document access specifying unit 42 determines whether or not the table A in the database 1 is based on the document ID of the specified document.
By searching (FIG. 3), a document type corresponding to the designated document is specified (step 4), and further, by searching table E (FIG. 7) in the database 1, the document type corresponding to the specified document type is identified. A major classification is obtained (step 5).

Next, the document creation / reference right checking unit 43 of the document management control unit 4 checks the document type and the large classification obtained in this way, and the user's department and position obtained from the table H, By referring to the document reference right table (FIG. 12) and the document creation right table (FIG. 13) in the database 1, it is determined whether or not the user has the access right to refer to or create the specified document. Check (step 6).

For example, how the access right is set using the document reference right table shown in FIG. 12 as an example will be described. (1) For document type TS01, the first three characters of the department code are BUA. The user has reference rights. (2) Regarding the document type TS02, there is a reference right if the job title is A or B, regardless of the department user. (3) In addition, with respect to documents belonging to the major category TS-B, for example, documents of document types TS04 and TS05, users of any post in any department have a right of reference regardless of the types of documents. Note that, in these document reference right tables (FIG. 12) and document creation right tables (FIG. 13), “*” marks (asterisks)
Indicates that the item is not limited, that is, a so-called wild card. If it is determined that there is an access right in such a check in step 6, the next document index display section 44 is activated.

[3-3. Judgment of Access Rights in Pages] The document table of contents display section 44 searches the tables A, B, C, and D (FIGS. 3 to 6) in the database 1 based on the document ID of the document specified by the user. By doing so, you can get information about what version, page, and page version the document is made of,
Based on the information, what version, page or page version is present in the designated document, the confidential level of each document, and the creating department are displayed (step 7).

Then, based on this display, the user designates which page or version the user wants to access, and in what mode such as reference or creation, that is, the type of access (step 7). ). Here, it is assumed that the user has specified an access target based on the logical page.

Then, the page creation / reference check unit 45 further checks whether the user has the creation right or the reference right for the specified part and the access type in the page reference right table. , By searching the page creation right table (FIG. 14) (step 8). Here, in the page reference right table and the page creation right table, the format in which the access right is set is the same as that described above for the document reference right table (FIG. 12).

Further, a page creation / reference right check unit 4
5 refers to the security level stored in the table D (FIG. 6) in the database 1 for the specified page version of the specified logical page (step 9). The item of the confidential level temporarily limits the access right to the logical page of each document to a part of the department or the post. For example, the logical level set as “J” in FIG. Pages other than users of the department registered as the department that creates the logical page cannot be referenced or created.

In addition, for example, “B” other than the above “J”
If a department code is set as in "UA02" (FIG. 6), it indicates that a department other than the same department or the creation department as the set code cannot be referenced or created. Here, an example in which the confidential level is set for the data page and its version has been described, but the confidential level may be set in units of the entire document or the document version.

[3-4. Access to the page]
Only when it is determined that there is access right in all the checks described above, the page display / writing unit 46 displays the substance of the page specified by the user, and according to the type of access specified by the user. As a result, it becomes possible to refer only or edit the contents (step 10). On the other hand, steps 2, 6, 8 or 9
If it is determined that there is no access right in any of the checks, the access is denied.

More specifically, the page display / writing section 46
Is a table having a table name determined by searching a table G (FIG. 9) in the database 1 for a table name indicating which table stores data corresponding to a specified logical page. TB
L01, TBL02 (FIG. 10), table TBL31,
Data corresponding to the designated document ID and logical page is acquired from the TBL 32 (FIG. 11) and displayed.

For example, as a result of referring to table G, data representing the contents of logical page PS01 is stored in table TBL0.
1, TBL02, it is found that the data of the page specified by the user is obtained by searching the corresponding document ID, for example, the data of A001, from each of the tables TBL01, TBL02. This can be displayed on the interface unit 3.

If the user has specified the "create" mode as the type of access to the logical page, a blinking cursor appears, for example, at the editable character string on the display screen, and the user is prompted. When the content is edited using the cursor and an operation of ending is performed, the edited content is written back to the corresponding table again, and the document in the database 1 is updated.

When a new version of a document, a new logical page, or a new version of a logical page is created by such a creation, the tables B and C are updated accordingly, and the newly created portion is updated. Is added to the appropriate table and is available for subsequent access.

[4. Effect of Embodiment] As described above, in this embodiment, it is determined whether or not access to each data is permitted based on the organizational attributes of the user stored in the table H, ie, the department and the post. For this reason, when a department or position changes due to a transfer such as transfer between departments, joining a company, retirement, etc., only the information representing those attributes for each user needs to be maintained, and the content of the access right automatically changes accordingly. become.

This eliminates the need to enter a password for each piece of data to be accessed, change the password at the time of transfer, or reset the access right for each piece of data. That is, for each user, the departments and positions registered in the table H (FIG. 15) can use the information file in the human resources department as it is, without the work of the information processing department. It is possible to configure to change directly from.

For this reason, when there is a change in the department or position, it is not necessary to reset the access right from the viewpoint of the access right, and the access right can be easily managed without contradiction even in relation to other personnel information. be able to. That is, according to this embodiment, labor saving can be overwhelmingly achieved as compared with the conventional case where all the information related to the access right of each individual is changed and created.

On the other hand, for example, when the division of work to the department is changed and the document creation and reference rights are changed, only the access right tables such as the reference right table and the creation right table need to be changed. Since it is not necessary to change the information related to the attribute of, the access right management becomes very easy in this respect as well.

In this embodiment, the table A
A higher concept such as the document type shown in FIG. 3 (FIG. 3) and a higher class as shown in Table E (FIG. 7), that is, a plurality of data having a common property by using a frame unit indicating a plurality of documents. , Access rights can be set collectively and efficiently.

In particular, in this embodiment, since the presence or absence of the access right is determined based on both the department and the position, it is easy to apply to many organizations which are systematized for each department and have a hierarchical position system. It is.

In this embodiment, the access right can be set as shown in FIGS. 12 to 14 according to the type of access such as reference only for viewing a document, creation of a document, and approval of the content of the document. Security can be finely managed according to the business flow and the scope of authority.

In this embodiment, the access right can be set for data such as a document in units of versions or pages. For this reason, if the properties of even one piece of data differ from part to part, it is not necessary to forcibly determine whether to permit access as the whole data. Thus, it is possible to finely set whether to grant access to give priority to use of information or to give priority to security without granting access, depending on the nature of the part.

Further, in this embodiment, the data relating to confidential matters that must be kept secret from other departments even within the organization, data that is in the process of being created and is not disclosed to other departments, etc., are stored in a table. As shown in FIG. 6D (FIG. 6), access can be limited to users of some departments such as the department that created the data, and security is further improved.

Further, in this embodiment, the contents of the page are also stored in a table format which is easy to handle on the relational database as shown in FIGS.

That is, in this embodiment as described above, the setting of the access right to the data can be collectively performed based on higher-level concepts such as the data type and the large classification, and the data portion such as each version or each page can be set as a unit. It can also be performed as. Moreover, access rights can be set in units of these based on departments and positions.

Therefore, by sharing appropriate types of data and appropriate portions of the data to appropriate officials of related departments, it is possible to easily achieve both information sharing and security. In particular, in this embodiment, in addition to the check at the time of login, the document creation / reference right check unit 43
Only when the access right to the data can be confirmed, the document table of contents display section 44 indicates what part the data has, such as a version and a page.
Further, the page creation / reference right check unit also checks the access right for the part to be accessed and the type of access. As described above, by gradually disclosing information to the user, the security of the system is further improved.

The specific contents of a document in this embodiment include, for example, a document describing technical contents such as a standard, a standard, and a standard plan. So, for example, product specifications,
An example is considered in which a logical page is configured for each coherent unit, such as a standard or a handling rule, and a version is increased each time the content is revised, and both the version before revision and the version after revision are stored.

By applying the present invention to such an example, for example, a document or page of the latest version is published to each department in a document, and a document or page of an older version is assigned to the official in charge. To prevent unnecessary disclosure of information,
Security can be improved while sharing information.

[5. Other Embodiments] The present invention is not limited to the above-described embodiments, but includes other embodiments as exemplified below. For example, in the above-described embodiment, a department or a post is stored in the form of a code as an attribute of an organization. However, for example, only one of a department and a post may be used. It is also possible to determine whether there is access right based on organizational attributes other than departments and positions, such as regular employees, contract employees, and temporary employees. It may be stored as a character string such as “section manager”.

Further, the various tables as described above may be integrated by increasing the number of items per table to reduce the total number, or may be subdivided. Further, in the above-described embodiment, an example has been described in which each document is divided into two hierarchies of a document type and a large classification.
Documents can be divided into three or more layers.

Further, in the above-described embodiment, the presence or absence of the access right is determined in two stages of a document unit and a page unit. However, the determination may be made at once. Further, in the above-described embodiment, three types of data, that is, a data version, a page included in the data, and a page version are shown, but it is necessary to determine the access right by dividing the data into such parts. However, it is also possible to introduce only one or two of these.

It is not essential to limit access to only some of the users of the departments according to the confidentiality level, and it is not essential to store the contents of each page in a table. Further, for example, in a case where the system itself is located in a safe place and cannot be operated by anyone other than an authorized user, means and processing for checking whether the user has the right to use the database system are not essential.

[0087]

As described above, according to the present invention, management can be easily changed by associating the access right with the attribute of the user's organization.

[Brief description of the drawings]

FIG. 1 is a conceptual diagram schematically showing an embodiment of the present invention.

FIG. 2 is a functional block diagram showing a specific configuration of the embodiment of the present invention.

FIG. 3 is a view exemplifying the contents of a table A for comparing a document ID with a document type in the embodiment of the present invention;

FIG. 4 is a view exemplifying the contents of a table B for comparing a document ID and a version in the embodiment of the present invention;

FIG. 5 is a diagram exemplifying the contents of a table C for comparing a document ID with a logical page in the embodiment of the present invention;

FIG. 6 is a diagram exemplifying the contents of a table D for comparing a logical page with a confidential level in the embodiment of the present invention;

FIG. 7 is a view exemplifying the contents of a table E for comparing a document type and a large classification in the embodiment of the present invention.

FIG. 8 is a view exemplifying the contents of a table F for comparing a document type and a logical page in the embodiment of the present invention.

FIG. 9 is a view exemplifying the contents of a table G for comparing a logical page with a table name in the embodiment of the present invention.

FIG. 10 is a table TB according to the embodiment of the present invention;
The figure which illustrates the content of L01, TBL02.

FIG. 11 is a table TB according to the embodiment of the present invention;
The figure which illustrates the content of L31 and TBL32.

FIG. 12 is a diagram exemplifying the contents of a document reference right table for setting an access right for reference in units of documents in the embodiment of the present invention.

FIG. 13 is a diagram exemplifying the contents of a document creation right table for setting an access right for creation in units of documents in the embodiment of the present invention.

FIG. 14 exemplifies the contents of a page reference right table for setting an access right for reference in units of pages and a page creation right table for setting an access right for creation in units of pages in the embodiment of the present invention; Figure to do.

FIG. 15 is a diagram exemplifying the contents of a table H for comparing departments and the like for each user in the embodiment of the present invention.

FIG. 16 is a flowchart showing a processing procedure in the embodiment of the present invention.

[Explanation of symbols]

 DESCRIPTION OF SYMBOLS 1 ... Database 2 ... DBMS 3 ... Display input interface part 3a ... Output means 3b ... Input means 4 ... Document management control part 41 ... User check part 42 ... Document access designation part 142 ... Designation means 43 ... Document creation and reference right check Part 143 ... Judgment means 44 ... Document table of contents display part 45 ... Page creation / reference right check part 46 ... Page display / writing part 146 ... Access means H ... Attribute table T ... Access right table

 ──────────────────────────────────────────────────続 き Continuing on the front page (72) Inventor Riichi Ebata 1-3-7 Honjo, Sumida-ku, Tokyo Inside Lion Corporation (72) Inventor Kazuhiko Saijo 1-3-7, Honjo, Sumida-ku, Tokyo No. Within Lion Corporation (72) Inventor Akito Kobayashi 2-6-1, Nishi-Shinjuku, Shinjuku-ku, Tokyo F-term within CSK Corporation 5B017 AA07 BA05 BA06 BB06 CA16 5B082 BA09 EA11 GA05 GA13 GC03 GC04 5B085 AE06

Claims (18)

[Claims] In a database system for managing data, means for designating which data is to be accessed and whether or not each user has an access right to the designated data are given in advance by an organization. A database system comprising: a determination unit that determines based on the above attribute; and an access unit that allows a user determined to have an access right to access specified data. 2. A means for displaying what part the specified data has when it is determined that the specified data has an access right, and specifying which part of the data is to be accessed. Means for determining whether or not the user has an access right to the designated portion, based on an organizational attribute given in advance for each user, comprising: 2. The database system according to claim 1, wherein a user who is determined to have an access right to the designated part is made to access the part. 3. Each data is classified into a plurality of classifications in advance, and the determining means determines whether or not the user has an access right to the specified data, by classifying the specified data, and for each user. 3. The database system according to claim 1, wherein the database system is configured to make a determination based on a relationship with a given organizational attribute. 4. A database system for managing data, comprising: an attribute table for associating a department and a post to which each user belongs; a data type including one or more data;
A classification table for classifying into one or more major classes including one or more data types; one or more versions for each data, and one or more versions for each page included in the data; A table for associating at least one of them, and whether or not the user has an access right to the data is determined by at least one of the data type, the large classification, the data, the version related to the data, the page, and the version of the page. A database system comprising: an access right table for storing based on at least one of the department or position. 5. In a database system for managing data, an access right that stores, for each data and its part, what type of access a user having an organizational attribute has access to what kind of access. Means for checking whether the user has the right to use the table and the database system, means for specifying the data to be accessed, and whether the user has the right to access the specified data Means for determining based on the user's organizational attributes and the access right table, and presenting what part of the data when the user has access to the specified data Means to specify, the part to be accessed, the means for specifying the type of access, the specified part and the type of access Means for determining whether or not the user has an access right based on the access right table; and, when the user has the access right for the specified part and the type of access, an access means for executing the access, A database system comprising: 6. In a database system for managing data, an attribute table storing attributes of each user in an organization, and whether or not each user has an access right to the data is stored based on the attributes in the organization. An access right table, based on the attribute table and the access right table,
A database system comprising: a determination unit configured to determine whether an individual user is permitted to access specified data. 7. A classification table for dividing individual data into a plurality of classifications including one or more hierarchies, wherein the access right table stores whether or not there is an access right to data based on the individual classification. 7. The database system according to claim 6, wherein: 8. The attribute table includes at least one of a department and a post for each user, and the access right table determines whether or not the user has an access right to data based on at least one of the department and the post. 8. The database system according to claim 6, wherein the data is stored. 9. The database system according to claim 6, wherein the access right table stores whether or not there is an access right in accordance with an access type. 10. The access right table stores whether there is an access right in units of at least one of a version of the data, a page included in the data, and a version of the page. The database system according to any one of claims 6 to 9, wherein it is configured to determine whether access is permitted for the specified version, page, or page version. 11. A table for limiting access to at least one of the data, the data version, the data page or the page version to only some users of the department. The database system according to any one of claims 6 to 10. 12. The database system according to claim 10, further comprising a table for storing data contents for each page. 13. In a data management method for managing data, a step for designating which data is to be accessed and whether or not the user has an access right to the designated data are given in advance for each user. A data management method, comprising: a determination step of determining based on an organizational attribute; and an access step of causing a user determined to have an access right to access designated data. 14. A step of displaying what part the specified data has when it is determined that the specified data has an access right, and specifying which part of the data is to be accessed. And a determining step of determining whether or not the user has an access right to the specified portion with respect to an organizational attribute given in advance to each user. 14. The data management method according to claim 13, wherein a user determined to have an access right to the part is allowed to access the part. 15. Each of the data is divided into a plurality of categories in advance, and the determining step includes determining whether or not the user has an access right to the designated data, by classifying the designated data, and by each user. 15. The data management method according to claim 13 or 14, wherein the determination is made based on a relationship with an organizational attribute given in advance. 16. A data management method for managing data, comprising: an attribute table for associating a department and a post to which each user belongs; a data type including one or more data;
A classification table for classifying into one or more major classes including one or more data types; one or more versions for each data, and one or more versions for each page included in the data; A table for associating at least one of them, and whether or not the user has an access right to the data is determined by at least one of the data type, the large classification, the data, the version related to the data, the page, and the version of the page. A data management method, comprising: an access right table for storing based on at least one of the department or position. 17. A recording medium on which data management software for managing data using a computer is recorded. The software causes the computer to accept designation of which data is to be accessed. It is determined whether each user has the access right based on the organizational attributes given to each user in advance, and the users determined to have the access right are allowed to access the specified data. A recording medium on which data management software is recorded. 18. The software causes the computer to display what portion the designated data has when it is determined that the computer has an access right to the designated data, and to access which portion of the data. To determine whether or not the user has the right to access the specified part, based on the organizational attributes given in advance for each user. If the user has the right to access the specified part, The recording medium according to claim 17, wherein the determined user is caused to access the part.