JP2001273285A - Device and method for controlling disclosure information - Google Patents

Abstract

PROBLEM TO BE SOLVED: To solve a problem that complicated information setting is forced to the manager of a system for executing the disclosure control of documents since it is necessary to physically divide a document file and to set an access right for each of divided documents and it is necessary to set information clear ing the relation of respective divided documents as well. SOLUTION: When an access request to an XML document is accepted, while referring to a group belonging definition file 4 describing a group, to which a user belongs, the group, to which the user belongs, as a request source of that access is decided and while referring to security information, a tag, for which that group has the access right, is decided. Then, the document contents of that tag are disclosed.

Description

DETAILED DESCRIPTION OF THE INVENTION

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a disclosure information control apparatus and a disclosure information control method for disclosing only a part of a document to a specific user.

[0002]

2. Description of the Related Art In a system (disclosure information control device) that discloses a document on the Internet such as a Web server, a method of setting an access right for the entire document as a unit is generally used. Therefore, when only a part of a document is disclosed to a specific user, a method of physically dividing a document file has been adopted.

However, when a document file is physically divided, it is necessary to set an access right for each of the divided documents, and it is also necessary to set information for clearly indicating a relationship between the divided documents. . Therefore, in order to execute the disclosure control of the document, a complicated information setting is imposed on the system administrator.

[0004] In addition to the above-mentioned conventional example, Japanese Patent Laid-Open No. 7-44579 discloses a technique of registering a document having a logical structure, dividing the document into logical structure units and setting an access right to the logical structure unit. No. 6,086,045. According to this technology, the disclosure control of a document can be performed for each logical structure unit. However, since the document having the logical structure needs to be divided and stored, the relationship between the divided documents is clearly specified. Information that needs to be set.

[0005]

Since the conventional disclosure information control device is configured as described above, when only a part of a document is disclosed to a specific user, the document file is physically divided. Therefore, it is necessary to set an access right for each document after division, and it is also necessary to set information that clearly indicates a relationship between each document after division. Therefore, there is a problem that in order to execute the disclosure control of the document, a complicated information setting is required for the system administrator.

SUMMARY OF THE INVENTION The present invention has been made to solve the above-described problem, and can disclose only a part of a document to a specific user without forcing a system administrator to set complicated information. It is an object to obtain a disclosure information control device and a disclosure information control method.

[0007]

When an access request for a structured document is received, a disclosure information control device according to the present invention refers to a definition file in which a group to which a user belongs is described, and requests the access request source. A group determining unit that determines a group to which the user belongs; and a security information set by the setting unit, and determines a segment to which the group determined by the group determining unit has an access right. And information disclosure means for disclosing the contents of the document.

[0008] The disclosed information control apparatus according to the present invention embeds security information in a structured document.

The disclosed information control apparatus according to the present invention is provided with a dividing means for dividing a document into segments to generate a structured document.

[0010] The disclosed information control apparatus according to the present invention encrypts the document content of the segment for which encryption is instructed by the security information, and discloses the encrypted document content.

[0011] A disclosure information control device according to the present invention randomizes the document content of a segment to which the group determined by the group determination means has no access right, and discloses the randomized document content. is there.

[0012] A disclosure information control device according to the present invention is provided for a case where a disclosure period is set for a document content of a segment to which a group determined by a group determination unit has an access right, and the disclosure period is valid. As far as possible, the contents of the document are disclosed.

The disclosure information control apparatus according to the present invention is such that, when the expiration date is invalid, the contents of a document are encrypted or randomized and the contents of the document after encryption or randomization are disclosed.

In a disclosure information control apparatus according to the present invention, when attribute information of a user who is permitted to disclose document contents is set, if the user does not satisfy the attribute information, the group to which the user belongs is segmented The document content of the segment is not disclosed even if the user has the access right.

The disclosed information control device according to the present invention is provided with an editing means for editing a definition file.

In the disclosure information control apparatus according to the present invention, when the description content of the definition file is in an undefined state, the group to which the user belongs is determined by referring to the default value.

The disclosed information control device according to the present invention is provided with a transmitting means for transmitting the contents of the document disclosed by the information disclosing means.

In the disclosed information control method according to the present invention, when an access request for a structured document is received, a reference file that describes a group to which the user belongs is described, and the user who requested the access belongs to the definition file. In addition to determining the group, referring to the security information, the segment to which the group has access right is determined, and the document content of the segment is disclosed.

[0019]

DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS One embodiment of the present invention will be described below. Embodiment 1 FIG. FIG. 1 is a configuration diagram showing a disclosure information control apparatus according to Embodiment 1 of the present invention. In the figure, reference numeral 1 denotes an XML document which is a structured document, and 2 denotes an access right for each segment constituting the XML document 1. A security information setting unit (setting means) 3 for setting security information indicating a group that the user belongs to, an XML document 3 to which security information has been added, and a group belonging definition file 4 describing a group to which the user belongs.

When a request for access to the XML document 1 is received, a group affiliation determination unit (group determination means) 5 refers to the group affiliation definition file 4 and determines the group to which the user requesting the access belongs. 6
Refers to the security information set by the security information setting unit 2, determines the segment to which the group determined by the group belonging determination unit 5 has the access right, and discloses an information disclosure unit (information Disclosure means) and 7 are disclosure documents disclosed by the information disclosure unit 6. FIG. 2 is a flowchart showing a disclosure information control method according to Embodiment 1 of the present invention.

Next, the operation will be described. When an XML document 1 as shown in FIG. 3 exists (a tag corresponds to a segment in this example), the system administrator determines that the document content of <tag 1> is group X,
Users belonging to groups Y and Z are permitted to disclose, document contents of <tag 2> are permitted to be disclosed to users belonging to group Y, and document contents of <tag 3> are permitted to be disclosed to users belonging to group Z. If so, the security information setting unit 2 is used to set security information indicating a group having an access right for each tag as a segment (step ST1). FIG. 4 shows an XML document 3 to which security information has been added. In this example, security information is embedded in the XML document.

When the user ID (access request for the XML document 1) is input after the security information is given by the security information setting unit 2 (step ST2), the group affiliation determination unit 5 reads the group affiliation definition file 4. The group to which the user requesting the access belongs is determined with reference to the access request (step ST3). FIG.
Indicates the description contents of the group belonging definition file 4. For example, when the user ID is "b", the groups to which the user b belongs are "X" and "Y".

When the group disclosure determination unit 5 determines the group to which the user requesting access belongs, the information disclosure unit 6 refers to the security information and determines the tag to which the group has access right (step S1). ST
4). For example, when the user ID is “b”, “X” and “Y” are output from the group belonging determination unit 5 as a group to which the user b belongs. Then, as shown in FIG. 4, the group X is described in <tag 1> and the group Y is described in <tag 1> and <tag 2>.
<Tag 1> and <Tag 2>, which are their logical sum, are determined as tags having access rights.

When the information disclosing unit 6 determines the tag to which the group has the access right, the information disclosure unit 6 displays or prints the document content of the tag (step ST5). FIG. 6 shows a disclosure document 7 when the user ID is “b”. In this example, the content of the document of <tag 3> has not been disclosed.

As is clear from the above, the first embodiment
According to the above, when an access request for an XML document is received, the group to which the user requesting the access belongs is determined by referring to the group belonging definition file 4 in which the group to which the user belongs is described. With reference to the information, the tag to which the group has access right is determined, and the document content of the tag is disclosed. Therefore, only the group to which the user belongs is defined, and only a part of the XML document is copied. An effect that can be disclosed to a specific user is achieved.

In the first embodiment, an XML document is used as a structured document. However, the present invention is not limited to this. For example, an SGML document may be used.

Embodiment 2 FIG. In the first embodiment, the XML document 1 divided into a plurality of segments (tags)
However, when a document that is not divided into segment units is used as the original document, a dividing unit that divides the document into segment units to generate the XML document 1 may be provided. .

For example, when a document to which paragraph numbers are added as in the specification of a patent application is used as an original document, the document is divided for each paragraph number, and the presence or absence of disclosure is controlled for each paragraph number. It may be. As a result, there is an effect that an XML document to be subjected to disclosure information control can be automatically generated.

Embodiment 3 In the first embodiment, the document content of the tag to which the group does not have access right is not disclosed. However, the document content of the tag whose encryption is instructed by the security information is encrypted, and May be disclosed.
In the example of FIG. 7, the information instructing the encryption, that is, CRYP
Since T = “DES” is added to the security information of tag 2, the document content of tag 2 is encrypted and disclosed.
The hatched portion in FIG. 8 indicates that the document content of the tag 2 is disclosed in an encrypted form. As a result, similar to the first embodiment, there is an effect that leakage of the secret document can be prevented.

Embodiment 4 In the first embodiment, the document content of the tag to which the group does not have access right is not disclosed. However, the document content may be randomized and the document content after randomization may be disclosed. . As a result, as in the first embodiment, there is an effect that the content is not empty but exists, but it can be explicitly indicated that the content is concealed.

Embodiment 5 In the first embodiment, the document content of the tag to which the group has the access right is disclosed unconditionally.
If a disclosure period is set for the document content of the tag to which the group has access by setting a clock, the document content will be disclosed only if the disclosure period is valid. You may.

For example, if the disclosure period of the document content is set from 10:00 a.m. on April 1, 2000 to 4:00 p.m. on May 5, 2000 (see <Tag 1> in FIG. 9) If there is an access request during the disclosure period, the content of the document is disclosed. If the access request is made outside the above-mentioned disclosure period (when the disclosure period is invalid), the content of the document is not disclosed. As a result, there is an effect that the disclosure control of the document content can be finely executed.

Embodiment 6 FIG. In the fifth embodiment, when an access request is made outside the disclosure period, the document content is not disclosed. However, the document content is encrypted or randomized, and the content after encryption or randomization is obtained. The contents of the document may be disclosed. Thereby, the same effect as in the fifth embodiment can be obtained.

Embodiment 7 In the first embodiment, the document content of the tag to which the group to which the user belongs has the access right is disclosed unconditionally. However, when the attribute information of the user who is permitted to disclose the document content is set. In a case where the user does not satisfy the attribute information, even if the group to which the user belongs has access right to the tag, the document content of the tag may not be disclosed.

For example, when the attribute information of the user is set such as "disclose the contents of the document only to a user whose age is 35 years or older", even when the group to which the user belongs has the access right of the tag. , The user's age is 35
Only if you are over the age of 35, the contents of the document will be disclosed, and if you are under 35, the contents of the document will not be disclosed. As a result, there is an effect that the disclosure control of the document content can be performed more finely.

Embodiment 8 FIG. In the first embodiment, the group belonging definition file 4 in which the group to which the user belongs is described is given in advance. However, an editing unit for editing the group belonging definition file 4 may be provided. . Thereby, there is an effect that the group to which the user belongs can be set or changed as needed.

Embodiment 9 In the eighth embodiment, the editing unit for editing the group belonging definition file 4 is provided. However, when the group to which the user belongs is in an undefined state, the default definition (default value) is referred to. Thus, the group to which the user belongs may be determined. As a result, even when the group to which the user belongs is in an undefined state, the disclosure of the document contents can be controlled.

Embodiment 10 FIG. In the first embodiment,
Although the information disclosure unit 6 discloses the contents of the document, transmission means for transmitting the contents of the document may be provided. Thereby, for example, there is an effect that the content of the document can be disclosed also in another terminal connected to the disclosure information control device via the Internet.

[0039]

As described above, according to the present invention, when an access request for a structured document is received, the definition file describing the group to which the user belongs is described, and the user requesting the access is referred to. Refers to the group determining means for determining the group to which the group belongs, and the security information set by the setting means, determines the segment to which the group determined by the group determining means has access right, and determines the document content of the segment. Since the information disclosure means to be disclosed is provided, it is possible to disclose only a part of the structured document to a specific user only by defining a group to which the user belongs.

According to the present invention, since the security information is embedded in the structured document, it is possible to save the trouble of storing and managing the security information in a separate file.

According to the present invention, since the dividing means for dividing the document into segments to generate the structured document is provided, the structured document to be subjected to the information disclosure control is automatically generated. There is an effect that can be.

According to the present invention, the document content of the segment for which encryption is instructed by the security information is encrypted and the content of the encrypted document is disclosed, thereby preventing leakage of the secret document. There is an effect that can be.

According to the present invention, the content determined by the group determination means is randomized from the document content of the segment to which the group does not have the access right and the document content after randomization is disclosed. However, there is an effect that it is possible to explicitly indicate that it is concealed.

According to the present invention, when the expiration date is set for the document content of the segment to which the group judged by the group judging unit has the access right, only when the expiration date is valid, the document is Since the content is configured to be disclosed, there is an effect that the disclosure control of the document content can be finely executed.

According to the present invention, when the expiration date is invalid, the content of the document is encrypted or randomized and the content of the document after encryption or randomization is disclosed. There is an effect that can be prevented from being disclosed.

According to the present invention, when attribute information of a user who is permitted to disclose document contents is set,
If the user does not satisfy the attribute information, even if the group to which the user belongs has the access right to the segment, the document content of the segment is not disclosed, so that the disclosure control of the document content is performed more finely. There is an effect that can be.

According to the present invention, since the editing means for editing the definition file is provided, there is an effect that the group to which the user belongs can be set or changed as necessary.

According to the present invention, when the description content of the definition file is in an undefined state, the default value is referred to
Since the configuration is such that the group to which the user belongs is determined, the disclosure of the document contents can be controlled even when the group to which the user belongs is in an undefined state.

According to the present invention, the transmission means for transmitting the contents of the document disclosed by the information disclosure means is provided. For example, in another terminal connected to the disclosure information control apparatus via the Internet, Also, there is an effect that the contents of the document can be disclosed.

According to the present invention, when an access request to a structured document is received, the group to which the user who has requested the access belongs is determined by referring to the definition file in which the group to which the user belongs is described. At the same time, by referring to the security information, the segment to which the group has access right is determined, and the contents of the document of the segment are disclosed. Therefore, only by defining the group to which the user belongs, the structured document There is an effect that only a part can be disclosed to a specific user.

[Brief description of the drawings]

FIG. 1 is a configuration diagram illustrating a disclosure information control device according to a first embodiment of the present invention.

FIG. 2 is a flowchart showing a disclosure information control method according to the first embodiment of the present invention.

FIG. 3 is an explanatory diagram showing an XML document 1;

FIG. 4 is an explanatory diagram showing an XML document 3 to which security information has been added.

FIG. 5 is an explanatory diagram showing description contents of a group belonging definition file 4.

FIG. 6 is an explanatory diagram showing a disclosure document 7;

FIG. 7 is an explanatory diagram showing an XML document 3 to which security information has been added.

FIG. 8 is an explanatory diagram showing a disclosure document 7;

FIG. 9 is an explanatory diagram showing an XML document 3 to which security information has been added.

[Explanation of symbols]

1 XML document, 2 security information setting unit (setting means), 3 XML document after security information is added, 4
Group affiliation definition file, 5 group affiliation determination unit (group determination unit), 6 information disclosure unit (information disclosure unit), 7 disclosure document.

──────────────────────────────────────────────────続 き Continued on the front page (51) Int.Cl. ⁷ Identification symbol FI Theme coat ゛ (Reference) G06F 17/30 170 G06F 17/30 170A G06T 11/60 100 G06T 11/60 100A

Claims (12)

[Claims] 1. For each segment constituting a structured document,
A setting unit for setting security information indicating a group having an access right; and upon receiving an access request to the structured document, referring to a definition file in which a group to which the user belongs is described, and is a request source of the access. With reference to the group determination means for determining the group to which the user belongs, and the security information set by the setting means, a segment to which the group determined by the group determination means has an access right is determined, and a document of the segment is determined. A disclosure information control device comprising: an information disclosure unit that discloses contents. 2. The disclosed information control device according to claim 1, wherein the setting unit embeds the security information in the structured document. 3. The disclosed information control apparatus according to claim 1, further comprising a dividing unit that divides the document into segments to generate a structured document. 4. The disclosure information according to claim 1, wherein the information disclosure means encrypts the document content of the segment designated to be encrypted by the security information and discloses the encrypted document content. Control device. 5. The information disclosing means randomizes document contents of a segment to which the group judged by the group judging means has no access right, and discloses the randomized document contents. Disclosed information control device. 6. The information disclosing means, if the expiration date is set for the document content of the segment to which the group judged by the group judging device has the access right, only when the expiration date is valid, 2. The disclosed information control device according to claim 1, wherein the content of the document is disclosed. 7. The disclosure according to claim 6, wherein the information disclosure means encrypts or randomizes the document content and discloses the encrypted or randomized document content when the disclosure period is invalid. Information control device. 8. The information disclosing means, when attribute information of a user who is permitted to disclose the document contents is set,
2. The disclosure information control device according to claim 1, wherein when the user does not satisfy the attribute information, even if the group to which the user belongs has access right to the segment, the document content of the segment is not disclosed. 9. The disclosed information control apparatus according to claim 1, further comprising an editing unit for editing the definition file. 10. The disclosure information according to claim 9, wherein the group determining means determines a group to which the user belongs by referring to a default value when the description content of the definition file is in an undefined state. Control device. 11. The disclosed information control device according to claim 1, further comprising a transmission unit for transmitting the contents of the document disclosed by the information disclosure unit. 12. A definition file in which a group to which a user belongs is described when security information indicating a group having access right is set for each segment constituting a structured document and an access request for the structured document is received. To determine the group to which the user requesting the access belongs, determine the segment to which the group has access by referring to the security information, and disclose the document content of the segment. Disclosure information control method.