JP2001075855A - Processor - Google Patents

Abstract

PROBLEM TO BE SOLVED: To make adaptable to a request to protect a file, etc., even if it is made easy to change access right by providing an application program with an access right editing mode and specifying a unique access pattern at start-up time. SOLUTION: The processor 1 is equipped with a file and folder protecting means 2 which edits and practices an access right pattern unique to an application program AP. The protecting means 2 has an initial setting means 3 called an expert mode and a pattern practicing means 4 which operates while the AP is running. An access right pattern is set for a file, etc., that the AP defines and only a user who is limited by a password is able to change the pattern. The pattern practicing means 4 monitors file access while the AP is running and judges whether or not access to the file specified by the access right pattern is allowed in such a case, thereby preventing the file from being accessed owing to misoperation, etc.

Description

DETAILED DESCRIPTION OF THE INVENTION

[0001]

[0001] 1. Field of the Invention [0002] The present invention relates to file protection, and more particularly to a processing apparatus capable of setting an access right pattern according to a request unique to an application program.

[0002]

2. Description of the Related Art File protection means provided in an operating system is limited to restricting reference or updating of a file to be protected, and an access right is defined according to a hierarchical structure of a user organization. The contents of file protection in application programs are as follows:
It changes depending on the situation depending on the file creation process and the role played by the user. That is, fine management of access rights to files and folders unique to the application program is required. For example, in document creation, it is necessary not only to grant or exclude access but also to properly manage access rights in situations such as review, approval, and registration. Otherwise,
The access rights themselves are rigid and difficult to use. Therefore, according to Japanese Patent Application Laid-Open No. H8-50559, it is possible to set an access right unique to an application program. Rights can be changed to adapt to application-specific requirements. The user performs file access based on the access right set corresponding to the application program. In this method, under the access right management of the operating system, it is used in accordance with a request peculiar to the application program, and the system administrator must set the access right using the means of the operating system. It is inevitable that the operation of program access rights will be rigid.

According to Japanese Patent Application Laid-Open No. 4-344555,
It is stated that development operations can be made more efficient by flexible operation of temporarily changing access rights to individual files. In this publication, the file processing system
An access right management table pointed to the directory is provided, and a temporary access right is set in the table by a command so that the access right can be changed.
In this method, the function of the operating system is used, and the access right of the file defined by the application cannot be changed by itself.

According to the above-mentioned publication, when the access right is changed according to the request of the application program,
There is an annoyance that the system administrator changes the access right each time using the means of the operating system. In addition, it is not possible to set detailed access rights such as to update a file, but to prevent deletion or deletion.

[0005]

Initial setting means for registering a plurality of access rights to files and folders defined by an application program with a fine-grained access right pattern at the time of start-up, or for switching the access right pattern, And a pattern operation unit that operates the application based on the access right pattern.

An object of the present invention is to provide an access right editing mode in an application program separately from an access right to a file or folder in an operating system, and to provide one or more access right patterns according to a unique request. By specifying a pattern at the time of startup, the access right can be easily changed and finely adapted to the protection requirements of files and folders.

[0007]

Therefore, in a processing apparatus according to the present invention, wherein an operating system includes a unit for protecting files and folders under the user and group units, an initial setting of an application program executed by the operating system is provided. so,
Selecting an access right editing mode provided in the application program, registering a plurality of access right patterns unique to the application program by a system administrator, setting one of them as an initial value, and executing the application program, It is characterized by having a protection means for protecting files and folders defined by one of the patterns.

Further, when the application program is started, the protection means edits a plurality of access right patterns for files and folders defined by the application program itself, and sets one of the access right patterns. Pattern operation means for selectively monitoring access to the file or folder and protecting the access.

Further, the initial setting means includes an access right setting means for an administrator to edit an access right to the file and the folder into a plurality of access right patterns, and selects one of the access right patterns and sets the initial value to an initial value. Pattern setting means for setting.

[0010] Further, the pattern operation means includes: a file monitoring means for monitoring access to the files and folders based on an access right pattern set as an initial value; an access permission / non-permission judgment means for determining whether the access is permitted; An access rejecting unit for rejecting the access when the access is denied in the determination and an access execution confirming unit for confirming the execution of the access when the access is permitted in the determination.

Further, the access rejecting means, when executing the access, displays a notice indicating that the access is prohibited.

Further, the access execution confirming means displays a notice for confirming whether or not to execute the access, when executing the access.

[0013]

Next, an embodiment of the present invention will be described with reference to the drawings. Referring to FIG. 1 showing the configuration of this embodiment, a processing device 1 includes a file and folder protection unit 2 that edits and operates an access right pattern unique to an application program. The file and folder protection means 2 can select an expert mode in which an access right pattern can be edited and set when the application program is started, which has no restriction on file access, and can edit the access right pattern only in this expert mode. Can be set. The file and folder protection unit 2 includes an initial setting unit 3 that operates by initial setting, and a pattern operation unit 4 that operates during operation of the application program.

The initial setting means 3 includes an access right setting means 31 and a pattern setting means 32. The access right setting unit 31 sets an access right pattern for files and folders defined by the application program. The access right setting unit 31 sets the access right pattern not only for the system file but also for any file including the data file created by the user. It is a means to do. The access right setting means 31 can define and register a plurality of access right patterns. Each access right pattern is identified with an arbitrary name. The access right pattern only sets / changes the definition of the access right of each pattern, and the access right pattern operated by the application program is changed by the pattern setting unit 32. The pattern changing means 32 is a means for changing an access right pattern activated by the application program. Each access right pattern can be changed by a user restricted by a password. An administrator having a password can specify all access right patterns, and a general user other than the administrator can select only a limited access right pattern. A user without a password cannot change the access right pattern.

During the operation of the application program,
The access right pattern operation unit 4 that monitors file access based on the access right pattern includes a file access monitoring unit 41, an access permission determination unit 42, and an access rejection unit 43. The file access monitoring means 41 operates automatically when the application program is started, and monitors access to target files and folders to which the access right is set, based on the set access right pattern. The access permission / non-permission determining unit 42 determines whether or not access is permitted when an attempt is made to access a file and a folder specified by the access right pattern. The access rejecting unit 43 and the access execution confirming unit 44 discard the access request when the access permission determining unit 42 determines that the access is not possible. In addition, a setting can be made to display a message indicating that access has been denied. The access execution confirmation unit 44 can cause the user to specify whether or not the access should be executed when the access is attempted, in order to prevent access due to an erroneous operation.

Next, the operation of this embodiment will be described with reference to the drawings. Data file (data1.t)
A case where access to xt) is prohibited will be described with reference to FIG. The application program starts in the expert mode of the access right editing mode (step 101). Log on as an administrator (Step 10
2). The access right setting means 31 sets an access right pattern with an arbitrary name designating a plurality of access right patterns. In the sample1 pattern, data1. t
xt file access prohibition is set (step 1
03). The pattern is set to an initial value at the time of starting the next and subsequent application programs (step 10).
4). The application program is automatically restarted (step 105). After the restart, the operation is performed in the sample1 pattern (step 106). By the file access monitoring means 41, data1. Monitoring of access to txt is started (step 107). The user logs on (step 108). For example, data1. In order to delete the txt file, an access request is made to the file (step 10).
9). The setting file data1. txt is detected to be deleted (step 110). In the sample1 pattern, the access permission / inhibition judging means 42
1. It is determined that deleting txt is prohibited (Y in step 111). Access denial means 43
By data1. The user is notified that txt cannot be deleted, and the request is discarded (step 112).

The data files data1. The operation of the sample1 pattern that prohibits access to txt will be described with reference to FIG. In the access target file 400, the data file data1. txt and data file d
ata2. txt and the data file temp. txt
In the conventional access right protection for users and groups, the principal (owner) 411 is assigned to all data files 401, 402, and 403, and the group 412 is assigned data files data2. txt402, temp. tx
At the time t403, the third party 413 enters the temp. It is assumed that txt can be accessed. The above samp
By designating and operating the le1 pattern, the principal 4
21 is a data file data1. Access to the txt 401 will be prohibited.

Data file data2. A case where a message prompting confirmation is displayed when txt is to be deleted will be described with reference to FIG. It starts in the expert mode (step 201), and logs on as an administrator (step 202). The access right setting means 31 sets a sample2 pattern with an arbitrary name,
ata2. When the txt file is deleted, a setting for displaying a confirmation message is made (step 203). The access right pattern is set to the sample2 pattern, and starting from the next time, the sample is started with the sample2 pattern (step 20).
4). Restarted automatically (step 205), sa
The operation is started in the mple2 pattern (step 20).
6). By the file access monitoring means 41, data
2. Monitoring of access to txt is started (step 207). The user logs on (step 20)
8). For example, if the user is an explorer,
2. When an access request for deleting the txt file is made (step 209), the file access monitoring means 41 causes the file data2.txt to be deleted. txt is detected to be deleted (step 210). According to the access permission / inhibition judging means 42, d
ata2. When txt is deleted, it is determined that a confirmation message is displayed (step 211). The access execution confirmation unit 44 outputs data2. The user is asked whether to delete txt by inputting Yes / No (step 212). If the user specifies Yes
data2. txt is deleted (Y in step 213), and in the case of No, data2.txt is deleted. txt is not deleted (N in step 213).

[0019]

According to the present invention, an access right edit mode is provided in an application program separately from the access right to files and folders in the operating system, and one or more access right patterns are provided in accordance with a unique request. By specifying the right pattern, the access right can be easily switched, and the access right pattern can be set finely in response to the access request unique to the application, and the files and folders can be prevented from being updated due to erroneous operations.

[Brief description of the drawings]

FIG. 1 is a diagram showing an embodiment of the present invention.

FIG. 2 is a diagram showing an operation when file access is prohibited in this embodiment.

FIG. 3 is a diagram showing an operation when confirming file deletion in this embodiment.

FIG. 4 is a diagram for explaining a comparison between a conventional access to the data file of FIG. 2 and the present invention.

[Explanation of symbols]

 DESCRIPTION OF SYMBOLS 1 Processing apparatus 2 File and folder protection means 3 Initial setting means 4 Pattern operation means 31 Access right setting means 32 Pattern setting means 41 File access monitoring means 42 Access permission determination means 43 Access rejection means 44 Access execution confirmation means

Claims (6)

[Claims] 2. An apparatus according to claim 1, wherein said operating system includes means for protecting files and folders under the user and group units. In an initial setting of an application program executed by said operating system, an access right of said application program is edited. A mode is selected, a plurality of access right patterns unique to the application program are registered by a system administrator, and one of them is set as an initial value. When the application program is executed, one of the access right patterns causes A processing device comprising a protection means for protecting files and folders to be defined. 2. The method according to claim 1, wherein: when starting up the application program, the protection unit edits a plurality of access right patterns for files and folders defined by the application program itself; 2. The processing apparatus according to claim 1, further comprising: a pattern operation unit that selects and monitors and protects access to the file or folder. 3. An initial setting unit, wherein an administrator edits an access right to the file and folder into a plurality of access right patterns, and one of the access right patterns is selected, and an initial value is selected. 3. The processing apparatus according to claim 2, further comprising: a pattern setting unit for setting. 4. The pattern operation unit includes: a file monitoring unit that monitors access to the file and the folder based on an access right pattern that is set as an initial value; an access permission determination unit that determines whether the access is permitted; An access rejecting means for rejecting the access when the access is denied in the determination, and an access execution confirming means for confirming the execution of the access when the access is permitted in the determination. 3. The processing apparatus according to 2. 5. The processing apparatus according to claim 4, wherein said access rejecting means displays a notice indicating that the access is prohibited when said access is executed. 6. The processing apparatus according to claim 4, wherein the access execution confirmation unit displays a notification for confirming whether or not the access is to be performed, when executing the access.