JP2000259476A - File management system and server computer - Google Patents

Abstract

PROBLEM TO BE SOLVED: To appropriately deal with access to a file from a user. SOLUTION: This file management system is provided with a file access permission information storing part 2 which, corresponding to the identification information of a file to be stored, stores permission information for limiting the range of a user who should be allowed to access, a user security information storing part 3 which stores security information showing user's access authority to a file in correspondence to user identification information and an access permission controlling part 4 which obtains security information from the part 2, also obtains permission information from the part 3 on the basis of the identification information of a user requesting access to a file and the identification information of a file related to access and perform control as to whether or not to give the user access permission in accordance to them.

Description

DETAILED DESCRIPTION OF THE INVENTION

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention can appropriately control a user's access request to each file having a plurality of security levels in accordance with a file access authority determined from each user's position and authority. The present invention relates to a possible file management system and a server computer.

[0002]

2. Description of the Related Art Conventionally, there is a system in which a file such as a document is stored in a server, and a user accesses the server from a plurality of clients to perform operations such as registration, search, reference, delivery, and deletion of the document. Are known.
When security management is introduced in such a system, the security user level and security document level must be managed for each operation type such as document registration, search, reference, delivery, deletion, etc. Instead, the processing was complicated.

For example, when there is access to a document,
It is necessary to perform a process of searching for the level of a security user and the level of a security document provided for each type of operation. In addition, when registering a new document or a new user, it is necessary to set a security document level for each operation type and set a security user level.

[0004]

SUMMARY OF THE INVENTION The present invention has been made to solve the problems of the conventional file management system and server computer as described above, and its purpose is to appropriately cope with a user accessing a document. It is an object of the present invention to provide a file management system and a server computer which can perform a process for registering a new document or a user easily.

[0005]

In the file management system and the server computer according to the present invention, permission information for limiting the range of users to whom access is permitted is stored in accordance with the identification information of the file to be stored. File access permission information storage unit, a user security information storage unit in which security information indicating the user's access right to the file is stored in correspondence with the user identification information, a user identification information requesting file access, and access While obtaining security information from the user security information storage unit based on the identification information of the file according to
Obtaining permission information from the file access permission information storage unit,
An access permission control unit that controls whether or not to grant an access permission to the user in accordance with these, and a file transfer / write unit that transfers and writes a file according to the control of the access permission control unit are provided. Features. As a result, when requesting access to a file, file access control is appropriately performed only by indicating the identification information of the user and the identification information of the file to be accessed.

In the file management system according to the present invention, the category information used to divide a file into a smaller number of blocks than the number of files includes permission information for limiting a file and a range of users to whom access is permitted. A file access permission information storage unit in which security information indicating the user's access right to the file is stored in association with the user identification information, and a file access request. The security information is obtained from the user security information storage unit based on the user's identification information and the category information of the file to be accessed, and the permission information is obtained from the file access permission information storage unit, and the user is given access permission in accordance with these. Access control unit that controls whether or not , File transfer and for transferring and writing the file according to the control of the access permission control unit
A writing unit. Thus, when requesting access to a file, file access control is appropriately performed using the identification information of the user and the category information of the file to be accessed.

[0007] In the file management system according to the present invention,
When the security information and the permission information are information of the same number of bits, and the information of the same bit position of the security information and the permission information is significant, the user is permitted to access, and the access permission control is performed. The department is
The present invention is characterized in that a logical product operation of security information and permission information is performed, and control is performed to give an access permission when a significant bit appears in the result. As a result, it is possible to perform control for giving access permission by a simple method called a logical product operation.

[0008]

DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS A file management system and a server computer according to the present invention will be described below with reference to the accompanying drawings. FIG. 1 shows a configuration of a file management system or a server computer according to the present invention. The file management system or the server computer includes a file storage unit 1 for storing files. Files stored in the file storage unit 1 include, for example, quality records, technical reports, minutes, etc. generated in projects such as product development.
Documents such as deliverables. Of course, the file is not limited to a document, but may be image data, a database, or other data.

The above file management system or server computer includes a user security information storage unit 2, a file access permission information storage unit 3, an access permission control unit 4, and a file transfer / write unit 5. For example, as shown in FIG. 3, the user security information storage unit 2 stores a security level, which is security information indicating a user's access right to a file, in association with the user identification information (user ID). As shown in FIG. 4, for example, as shown in FIG. 4, the file access permission information storage unit 3 stores permission information for limiting the range of users to whom access should be permitted according to the document name which is the identification information of the file to be stored. Is stored. The permission information is one byte, and each bit corresponds to one to eight security levels from the upper bit side. FIG.
In the example, the document with the document name "System 1a" can be accessed by users of the security level 1 to 3 and the document with the document name "Plan B" can be accessed by the user with the security level 1 It is shown that.

The access permission control unit 4 obtains a security level from the user security information storage unit 2 based on the identification information (ID) of the user who requests access to the document and the identification information (ID) of the accessed document, and obtains the file access. It obtains permission information from the permission information storage unit 3 and controls whether to grant access permission to the user according to the permission information. The file transfer / write unit 5 transfers a document stored in the file storage unit 1 under the control of the access permission control unit 4, and writes a document in the file storage unit 1.

The above file management system is, for example,
It is realized by a client-server system as shown in FIG. That is, the server computer 7 and the client computers 8-1 to 8-n are connected to the network 6. Server computer 7, client computer 8-
1 to 8-n need not have all the components,
It is configured as shown in FIG. That is, the CPU 10
Are configured to control each unit using the programs and data stored in the main memory 11 and perform data processing.

The CPU 10 has a keyboard control unit 13, a display control unit 14, a mouse control unit 15,
The printer controller 16, the magnetic disk controller 17, and the communication interface 18 are connected. A keyboard input device 19 is connected to the keyboard control unit 13, and an operator of each node can input information using the keyboard input device 19. A CRT display device 20 having, for example, a CRT is connected to the display control unit 14 so that necessary information is displayed. A mouse 21 as a pointing device is connected to the mouse control unit 15 so that position information can be input when necessary.

The printer controller 16 includes a printer 22
Is connected, and information can be printed out. A magnetic disk device 23 is connected to the magnetic disk control unit 17, and programs and data are stored in the magnetic disk device 23, and read and written by the CPU 10 as needed. A communication processing unit 24 is connected to the communication interface 18 so that data is transmitted to and received from a network.

The CPU 10 of the server computer 7 functions as the access permission control unit 4 and the file transfer / write unit 5 by executing a program corresponding to the flowchart shown in FIG. For example, client computer 8
When -1 requests access to a document by the document name and the user ID, the CPU 10 of the server computer 7 receives the document name and the user ID (S1), and searches the user security information storage unit 2 by the user ID. Then, a corresponding security level is obtained (S2). Further, the file access permission information storage unit 3 is searched by the document name to obtain the corresponding permission information (S3).

The security level obtained above is compared with the permission information (S4), and whether or not the access is permitted is determined by checking whether "1" is set in the bit position of the permission information corresponding to the security level. It is detected (S5). For example, in the case of security level 1 as shown in the first column of FIG. 3, if the permission information is “11100000” shown in the first column of FIG. As shown, in the case of the security level 4, the permission information is "1000" shown in the second column of FIG.
If "0000", access is not permitted. When the access is permitted, the document corresponding to the document ID is taken out from the file storage unit 1 and transferred, or the revised document is overwritten on the old document in the file storage unit 1 (S6). When the access is not permitted, the fact that the access is not permitted is transferred to the client computer 8-1.
Is displayed (S7).

When registering a new document, for example, the document, document name, and permission information are provided from the client computer 8-n to the server computer 7. As a result, for example, the access permission control unit 4 registers the document name and the permission information in the file access permission information storage unit 3 and transfers the file.
The writing unit 5 registers a document in the file storage unit 1.
When registering a new user ID and security level, for example, the client computer 8-n gives the server computer 7 a new user ID and security level. Thereby, for example, the access permission control unit 4 registers the user ID and the security level in the user security information storage unit 2.

Next, a first modification of the above embodiment will be described. In this modified example, as shown in FIG. 7, the configuration of the file access permission information storage unit 3 stores permission information and a document name in association with category information. Here, the category information indicates that the file (document) is
Information used to divide the number of blocks into smaller blocks than the number.For example, the contents of documents such as quality records, technical communication, minutes, deliverables are used as categories, or the top secret, Medium confidentiality, low confidentiality, no confidentiality, etc. are used as categories.

In the example of FIG. 7, different permission information is set for each category information.
The same permission information can be set in the documents of the category of the quality record and the technical communication (essentially, documents of a plurality of categories) in the categories of the technical communication, the minutes, and the deliverable. The CPU 10 of the server computer 7 executes a program corresponding to the flowchart shown in FIG.
Function as For example, the client computer 8-1
Requests access to a document based on the document name, user ID, and document category, the CPU 10 of the server computer 7
Receives the document name, the user ID, and the document category (S11), searches the user security information storage unit 2 based on the user ID, and obtains a corresponding security level (S12). Further, the file access permission information storage unit 3 is searched according to the document category to obtain the corresponding permission information (S13). As a result, it is possible to search faster than directly searching a large number of document names.

Next, it is detected whether the request is writing or reading of a document (S14). When the read request has arrived together with the document name and the like, the security level obtained above is compared with the permission information (S15), and "1" is set in the bit position of the permission information corresponding to the security level. Then, it is detected whether reading is permitted (S16). Here, when the access is permitted, the document corresponding to the document ID is extracted from the file storage unit 1 and transferred (S17). When the access is not permitted, the client computer 8 informs that the access is not permitted.
-1 to be displayed on the client computer 8-1 (S18).

On the other hand, if the request is for writing a document, the security level obtained above is compared with the permission information (S19), and whether "1" is set in the bit position of the permission information corresponding to the security level is determined. Is checked to determine whether writing is permitted (S2).
0). Here, when writing is permitted, for example, the document is registered (overwritten or newly registered) in the file storage unit 1 by the file transfer / writing unit 5, and when newly registered, the file access permission information storage unit 4 is used by the access permission control unit 4. The file access permission information storage unit 3 is completed by registering the document name in the column of the document category 3 (S2).
1). When the writing is not permitted, the fact that the access is not permitted is transferred to the client computer 8-1, and the client computer 8-1 displays the writing non-permission (S18).

Next, a second modification of the above embodiment will be described. In this modification, as shown in FIG. 9, the configuration of the file access permission information storage unit 3 is such that the category information includes permission information for reading (indicated by R) and permission information for writing (indicated by W). ) And the document name are stored in association with each other. In other words, even if reading is permitted, overwriting is not permitted.

The CPU 10 of the server computer 7 executes a program corresponding to the flowchart shown in FIG. 10 to execute the access permission control unit 4 using the file access permission information storage unit 3 configured as described above, -It functions as the writing unit 5. For example, when the client computer 8-1 requests access to a document based on the document name, the user ID, and the document category (either reading or writing is indicated in the request), the CPU 10 of the server computer 7 Is the document name and user ID
And the document category are received (S11), and the user ID
Search the user security information storage unit 2 to find the corresponding security level (S12).

Next, it is detected whether a request for reading or writing is indicated (S22). Here, if the request is a read request, the file access permission information storage unit 3 is searched by the document category to obtain permission information corresponding to the read (S23). The security level acquired above is compared with the permission information corresponding to the read (S24), and it is checked whether the bit position of the permission information is set to "1" in accordance with the security level to determine whether the read is permitted. Is detected (S25). Here, when the access is permitted, the document corresponding to the document ID is taken out from the file storage unit 1 and transferred (S26). When the access is not permitted, the fact that the access is not permitted is transferred to the client computer 8-1 and displayed on the client computer 8-1 (S27).

If it is determined in step S22 that the request is a write request, the file access permission information storage unit 3 is searched according to the document category to obtain permission information corresponding to the write (S28). The security level acquired above is compared with the permission information corresponding to writing (S
29) It is detected whether writing is permitted by checking whether "1" is set in the bit position of the permission information corresponding to the security level (S30). Here, when the access is permitted, the document to be overwritten corresponding to the document ID is written to the file storage unit 1 (S31).
When the access is not permitted, the fact that the access is not permitted is transferred to the client computer 8-1 and displayed on the client computer 8-1 (S27).

Next, a third modification of the above embodiment will be described. In this modification, as shown in FIG. 11, the security level stored in the user security information storage unit 2 has the same number of bits (1 byte) as the permission information stored in the file access permission information storage unit 3. If the information at the same bit position between the security level and the permission information is significant (here, “1”), the access permission is given to the user. In other words, the security level indicates 1 to 8 levels depending on which bit position in the 1 byte is set to “1”, and the permission information corresponds to the position where “1” is set in the bit position in 1 byte. This indicates that a user with a security level of is accessible.

The access permission control unit 4 performs a logical product operation of the security information and the permission information configured as described above, and a significant bit (“1” in this example) is added to a result (here, 1 byte). Control to give access permission when it appears. This AND operation is performed in S15 and S
19, in FIG. 10, in S24 and S29,
Each is performed at the time of comparison.

More specifically, the user having the user ID “8913” shown in FIG.
When the access request of “b” is issued, the user ID “8”
The security level of “913” is “1000000” from FIG.
0 (level 1), and the permission information of the document name "plan 2b" is "10000000" (level 1 or higher permitted) from FIG. 4, so the result of the logical product operation is shown in FIG. Thus, the access permission is given because the value is "10000000" and the significant bit "1" appears.

In contrast to the above, the user ID “898
When the user No. 8 issues an access request for the document name “system 1a” in FIG. 4, the security level of the user ID “8988” is “00010000” (level 4) from FIG. 11, and the document name “system 1a” The permission information is shown in FIG.
From "11100000" (permitted at level 3 or higher), the result of performing the logical product operation is "00" as shown in FIG.
000000 ”(all zeros), and no access is granted because no significant bit“ 1 ”appears. According to this modified example, comparison is facilitated, and access permission / non-permission can be given at high speed.

In the above description, a server computer having a document (file) and a server computer performing file control are defined as one.
The server computer having the document (file) is separated from the server computer having the document (file) and the server computer having the file control. When the server computer having the file control gives a result indicating that it is accessible, the server computer having the document (file) is obtained. To transfer the file to the appropriate client,
The file transfer may be performed by receiving the file transfer from the corresponding client.

[0030]

As described above, according to the file management system and the server computer of the present invention, security information is obtained based on the identification information of the user who requests access to the file and the identification information of the file concerned, and the permission is obtained. It obtains information and controls whether or not to grant access to the user in accordance with these. Therefore, when requesting access to a file, only indicating the identification information of the user and the identification information of the file to be accessed are properly performed. There is an effect that file access control is performed.

Further, in the file management system according to the present invention, when requesting access to a file, file access control is appropriately performed using user identification information and category information of the file to be accessed. It is possible to perform file management using information that is easily recognizable by humans, that is, categories.

[Brief description of the drawings]

FIG. 1 is a configuration diagram of a file management system and a server computer according to the present invention.

FIG. 2 is a configuration diagram of a client-server system to which a file management system according to the present invention is applied.

FIG. 3 is a diagram showing contents of a user security information storage unit used in the file management system according to the present invention.

FIG. 4 is a diagram showing contents of a file access permission information storage unit used in the file management system according to the present invention.

FIG. 5 is a configuration diagram of a server computer and a client computer of the system according to the present invention.

FIG. 6 is a flowchart for explaining operations of the system and the server computer according to the embodiment of the present invention.

FIG. 7 is a diagram showing contents of a file access permission information storage unit used in a first modification of the file management system according to the embodiment of the present invention.

FIG. 8 is a flowchart for explaining an operation of the first modification of the system and the server computer according to the embodiment of the present invention.

FIG. 9 is a diagram showing contents of a file access permission information storage unit used in a second modification of the file management system according to the embodiment of the present invention.

FIG. 10 is a flowchart for explaining the operation of a second modification of the system and the server computer according to the embodiment of the present invention.

FIG. 11 is a diagram showing contents of a user security information storage unit used in a third modification of the file management system according to the embodiment of the present invention.

FIG. 12 is a flowchart for explaining an operation in a third modified example of the file management system according to the embodiment of the present invention.

FIG. 13 is a flowchart for explaining an operation in a third modification of the file management system according to the embodiment of the present invention.

[Explanation of symbols]

DESCRIPTION OF SYMBOLS 1 File storage part 2 User security information storage part 3 File access information storage part 4 Access permission control part 5 File transfer / write part

Claims (6)

[Claims] 1. A file access permission information storage unit in which permission information for limiting a range of users to whom access is permitted is stored corresponding to identification information of a file to be stored, and a user access right to a file Security information indicating security information corresponding to the user identification information, and security from the user security information storage unit based on the identification information of the user requesting access to the file and the identification information of the file related to the access. Information, obtaining permission information from a file access permission information storage unit, and controlling whether or not to grant an access permission to a user in accordance with the information. A file transfer / write unit for transferring and writing data A file management system characterized by the following. 2. File information and permission information for limiting the range of users to whom access is permitted are stored in association with category information used to divide a file into blocks smaller than the number of files. A file access permission information storage unit, a user security information storage unit in which security information indicating a user's access authority to the file is stored corresponding to the user's identification information, Access permission for obtaining security information from the user security information storage unit based on the category information of the file, obtaining permission information from the file access permission information storage unit, and controlling whether or not to grant the user access according to these. Control unit and control of this access permission control unit A file management system, comprising: a file transfer / write unit that transfers and writes a file in response to the request. 3. The file management system according to claim 1, wherein the access permission information is divided into information corresponding to a file read request and information corresponding to a file write. 4. A configuration in which the security information and the permission information are information of the same number of bits, and an access permission is given to the user when the information of the same bit position between the security information and the permission information is significant. The access permission control unit performs a logical product operation of the security information and the permission information and performs control for giving an access permission when a significant bit appears in the result. File management system described in the section. 5. An access permission control unit, a file storage unit storing a file and a file transfer / write unit,
2. The server according to claim 1, wherein the server is provided on another server.
5. The file management system according to any one of Items 4 to 4. 6. A file access permission information storage unit in which permission information for limiting a range of a user to whom access is permitted is stored in accordance with identification information of a file to be stored; Security information indicating security information corresponding to the user identification information, and security from the user security information storage unit based on the identification information of the user requesting access to the file and the identification information of the file related to the access. Information, obtaining permission information from a file access permission information storage unit, and controlling whether or not to grant an access permission to a user in accordance with the information. A file transfer / write unit for transferring and writing data A server computer characterized by the following.