JP2004303051A - Data management method, data management device, information processor, and telecommunication network system - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide a data management device, information processor, and a telecommunication network system composed so that data management in a server and/or a terminal can be easily carried out by middleware with a utility group in the center. <P>SOLUTION: Only members of a group with access authority to a data box can access an accounting file stored in the data box which is a divided area of virtually dividing a storage. Also, only the members of the group with access authority to the data box can access the accounting file stored in the data box. <P>COPYRIGHT: (C)2005,JPO&NCIPI

Description

[0001]
TECHNICAL FIELD OF THE INVENTION
The present invention relates to a data management technique including a data access restriction in a server or a terminal in a communication network such as a LAN or a WAN, and particularly to a network (including a WAN or a LAN) in a small business entity such as an accounting office. ), A data management device, and a communication network system.
[0002]
[Prior art]
There are the following techniques for restricting access to files in order to maintain data security and for managing folders to facilitate data handling.
As a data access control method for efficiently executing a control for an access request to a database, a hierarchical structure data menu is set in association with a user ID unique to a user, and each user is set based on a user identifier included in the access request. A method of creating and displaying a hierarchically structured data menu accessible to the user on a terminal (for example, see Patent Document 1).
[0003]
As a method of restricting access in a data sharing method via a storage device under a storage area network (SAN) environment, in a storage device system having at least one storage device and connected to a plurality of computers, at least one storage device is provided. A device provided with means for permitting or prohibiting access from a plurality of computers in a device area (for example, see Patent Document 2).
[0004]
A database management system that shares information within an organization such as a company in a client / server system. Group restrictions are described in a definition table according to the type of client that has made an access request to the database, and users are grouped. And an access control device for restricting access by group type (for example, see Patent Document 3).
[0005]
Conventionally, in a client server system using a network (including a WAN and a LAN), when restricting access to a user or managing areas that can be accessed by each user separately, various types of OS prepared are required. The management software was started and the settings were made. That is, using OS management software such as Windows (R) or Linux, (1) first make settings for user registration, (2) make settings for grouping each user, and (3) access authority for each folder. By setting, it is possible to set whether or not to access a specific folder on a group basis (Non-Patent Document 1).
[0006]
On the other hand, in the database system, in order for each user to access the database, access rights are set using a database language SQL (Structured Query Language), which is a dedicated application, and the functions of the relational database management system In some cases, database access control is performed according to In this method, access control is performed using a "role" (to perform group management, grouping a plurality of users as one unit and assigning the same authority to all users who are members of the group) (for example, , Non-Patent Document 2).
[0007]
When setting or changing the access right using the SQL language in the database system described in Non-Patent Document 2, the user is aware of data items, file names, search conditions, and the like in association with the SQL statement of data access. However, the more complex the query conditions of the database, the greater the amount of work, and furthermore, the higher the level of knowledge about the database and SQL, the more difficult it is for ordinary operators to describe. However, there is a problem that an expert, such as a database administrator, who has advanced knowledge of the database and SQL must be requested to perform the operation.
[0008]
As a technique for solving such a problem, a user who associates user login information with a user group for each user in order to control access to user management information such as employee information for each user group according to the attribute of the user. By automatically generating separate group information based on user management information, it is possible to set and change access rights without being an expert without being aware of the settings in the database language, reducing the burden on the operator and A data access control device for matching the access right for each group with the user management information has been proposed (for example, Patent Document 4).
[Patent Document 1]
Japanese Patent No. 3382881
[Patent Document 2]
JP 2003-6048 A
[Patent Document 3]
JP 2000-137735 A
[Patent Document 4]
JP-A-11-194974
[Non-patent literature]
Crain Stinson, Carl Siechert, translated by Shunichi Adachi and Mayumi Adachi, "Microsoft Windows (R) 2000 Professional Official Manual", Nikkei bp Soft Press Publishing, June 5, 2000, p553-p594.
[Non-patent document 2]
By Marci Frohock Garcia, Jamie Reding, Whalen, Steve Adrian Deluca, Quick Translation, "Microsoft SQL Server 2000 Official Manual", Nikkei BP Soft Press Publishing March 19, 2001
[0009]
[Problems to be solved by the invention]
Accounting firms provide accounting and guidance to their advisors (meaning individuals or companies that have entrusted accounting or guidance on accounting with a contract with an accounting firm). In such accounting firms, the contents of journals and descriptions are checked (audited) using an accounting device for auditing, and if there is an error, a correction input to correct it is made, or a check or guidance is provided. Although the ledger and financial statements are displayed or printed out, each person in charge does not necessarily have the specialized knowledge related to system management related to data management and security management.
[0010]
In such an accounting firm, as shown in FIG. 1 (a), a LAN consisting of a server 1 and terminals is formed, and a plurality of terminals update and create accounting files stored in the storage medium of the memory device 2. When performing audits or guidance using financial statements or the like displayed or printed out based on accounting files stored in the storage medium of the memory device 2, access restrictions and holder management on servers and terminals are performed. It is desirable to introduce a simple data management method for reducing the burden on setting of access authority and the like. In addition, a similar simple data management method is introduced to a so-called “Internet accounting” for performing accounting processing and guidance with a consultant terminal via a communication network such as a WAN as shown in FIG. 1B. It is desirable to be done.
In addition, accounting firms perform audits and provide guidance to advisor companies using ledger entry and financial statements, etc., so that data access authority settings (for example, grouping of staff, data areas that encouraged accounting firms to work) , And their correspondence, etc.) may be sufficient if they are standardized to some extent.
Rather, rather than complicating the setting work due to the high degree of freedom of access authority management, it is sufficient to manage the access authority necessary for the business of the accounting firm even if the degree of freedom is low.
[0011]
In addition, by the incorporation of accounting firms, accounting firms A, B, ... will be merged into accounting firm X (corporate). In this case, for the time being, the original accounting firms A, B, It is expected that the advisors of B,... Will be in charge of the former accounting firms A, B,. In such a case, for example, only a member of the person in charge of the original accounting firm A can access a specific storage area storing the accounting files of the adviser of the original accounting firm A as a group. It is desirable to perform data management in The same applies to the former accounting firm B,...
Here, when accounting firms are incorporated, there may be cases where several accounting firms are integrated or accounting firms of a certain large scale are transferred to corporations as they are. The form of incorporation of the office is limited to some extent, and the setting of data access authority (for example, grouping of staff, division of data areas promoted by accounting firms, correspondence between them, etc.) is also standardized in advance. It is desirable to be done.
[0012]
From such a viewpoint, the data access control method described in Patent Document 1 is a technique for providing a hierarchically structured data menu, so that access control is performed on a user-by-user basis, and user groups are divided. It does not perform the above access control or association with the divided area of the database.
[0013]
The access control method described in Patent Document 2 is a technique for performing access control on a file basis for each user. As in the case of Patent Document 1, access control and database division are performed after grouping users. It does not correspond to an area.
[0014]
Further, the access control device described in Patent Literature 2 restricts “search access” by a definition table. Therefore, it operates only when a search access is made by the user, and is not allocated to an accessible area in advance.
On the other hand, the operation of starting and setting various management software prepared in the OS with the OS (operating system) management software described in Non-Patent Document 1 is an extremely complicated and time-consuming operation, and is a usual operation. The user required skill before using the management software of the OS, and a user who had not been trained could practically not perform these operations. (Because it is necessary to master not only the various settings, but also the priorities and correlations of those settings).
[0015]
For example, when selecting the rights of the Administrator group, a dialog box as shown in FIG. 26 is displayed, and it is necessary to select and select ones related to the access right of the folder from among them. Furthermore, when assigning actual rights to each group, there are many things that do not have a folder access right relationship, so it is necessary to select ones related to the folder access right from among them. That is, as shown in FIG. 26, there is a problem that a lot of background knowledge is required even if only one access right in the whole setting is set, and even if setting is performed for only one group. .
[0016]
It is also difficult for ordinary users to divide not only the access authority setting but also the accessible area.
For example, when dividing an area of a memory device, it is first necessary to understand an outline of a file system.
In other words, it is first necessary to understand the concept of volumes, the concept of partitions, and the concepts of files and folders.
Then, it is necessary to determine whether to manage the access authority on a file basis or on a folder basis.
[0017]
Also, when managing access rights on a folder basis, it is necessary to start up a security management program for each folder (settings are made on the “Security” tab of the “Properties” dialog box of the folder).
[0018]
In this case, it is necessary to set while understanding the inheritance relationship with the folder higher than the folder being set, and it is necessary to consider the effect of inheriting the access permission from the higher folder. As described above, unless a person who is proficient in OS management software is used, folder management is virtually impossible.
[0019]
Also, in the database language described in Non-Patent Document 2, not only when setting or changing access rights, but also when a user has authority to use any database object and the user can perform any operation on those objects. In the case of setting or changing "authority" for determining whether or not the setting is possible, similarly, it is extremely difficult to set the setting unless an expert with advanced database knowledge and SQL knowledge like a system administrator or the like. There is.
[0020]
Also, the invention described in Patent Document 4 is based on a relational database management system that sets access rights using the database language described in Non-Patent Document 1 described above, and sets the access rights using the database language. / Meaning method for easily changing a user group, and a means for defining a user group and a means for defining user login information are constituted by a definition file for directly controlling a database. Not applicable when performing data management outside of a relational database management system.
[0021]
Further, in the above conventional technology, the security policy (strategic design such as dividing the persons in charge into groups, creating data areas to encourage the work, and associating each person in charge group) is determined by the user. And it was difficult for general users, so in many cases, it was necessary to obtain the help of an external system integrator (SI).
[0022]
Here, the middleware located between the application and the management software is used for simple settings centered on the utility, and with simple settings, it is possible to restrict access to users or to distinguish areas accessible by each user. If it can be managed, data management in a client-server system using a network (including a WAN and a LAN) can be easily performed by a small business entity such as an accounting firm without having specialized knowledge. Can be.
SUMMARY An advantage of some aspects of the invention is to provide a data management method and a data management apparatus configured so that data management in a server and / or a terminal can be easily performed by a middleware centering on a utility group. And the provision of communication networks.
[0023]
[Means for Solving the Problems]
In order to solve the above problem, according to the first aspect of the present invention, a data box including a divided area obtained by dividing a storage area is set, a user group is associated with at least one of the data boxes, and at least one of the user groups is set. A data management method, wherein only a user associated with a user group belonging to a data box can access data stored in a data box associated with the user group. I will provide a.
[0024]
According to the invention described in claim 2, the storage device of the information processing apparatus includes a data box obtained by dividing the storage area, and only a user belonging to a user group associated with the data box is assigned to the group. A data management device capable of accessing data stored in a data box associated with the data management device.
[0025]
According to the third aspect of the present invention, in the storage device of the information processing apparatus, a group management in which a data box obtained by dividing a storage area is associated with a data box and a user group that can access the data box. Information, and user management information in which the user group and the user are associated with each other, and only the users belonging to the user group associated with the user management information are included in the data stored in the data box associated with the group management information. Provided is a data management device characterized by being accessible.
[0026]
According to a fourth aspect of the present invention, there is provided the data management apparatus according to the second or third aspect, wherein the storage area includes a common area that can be accessed by the user without restriction.
[0027]
Further, in the invention according to claim 5, a data box setting means for setting, as a data box, a divided area obtained by dividing a storage area of the storage device in a storage device, and a group setting for associating the set data box with a user group. Means, a user setting means for setting a user group and a user in association with each other, an access right setting means for setting an access right for a data box, and a setting operation control means for controlling each means to execute a setting operation. There is provided an information processing apparatus characterized by comprising:
[0028]
Further, in the invention according to claim 6, an information processing apparatus provided with different storage devices, a data box setting means for setting each of the different storage devices as a data box, and a data box and a user group which have been set. Group setting means for associating, user setting means for setting a user group and a user in association with each other, access right setting means for setting an access right for a data box, and setting operation control for controlling each setting means to execute a setting operation Means for providing an information processing apparatus.
[0029]
According to a seventh aspect of the present invention, there is provided a communication network system comprising a plurality of terminals for transmitting and receiving data to and from the information processing apparatus according to the fifth or sixth aspect via a communication network, wherein The user associated with the user can access data stored in the data box associated with the user group to which the user belongs by the group setting means from one of the plurality of terminals. Provide a network system.
[0030]
According to an eighth aspect of the present invention, there is provided a communication network system including a plurality of terminals connected to a server including the information processing apparatus according to the fifth or sixth aspect via a communication network, wherein the data box setting unit includes: There is provided a communication network system including means for setting a data box in a storage device of a terminal.
[0031]
According to a ninth aspect of the present invention, there is provided a communication network system including a plurality of terminals connected via a communication network to a server including the information processing device according to the fifth or sixth aspect, wherein the terminal comprises: Upon activation of the application program, a storage device selection unit that selects a storage device in which a data box is set, and a data box selection unit that selects a data box set in the storage device selected by the storage device selection unit, Data selection means for selecting data stored in the data box selected by the data box selection means, and selection operation control means for controlling each selection means to execute a selection operation. Provide a communication network system.
[0032]
BEST MODE FOR CARRYING OUT THE INVENTION
1. Network configuration example
FIG. 1 is a diagram showing one embodiment of a network configuration example to which the present invention can be applied. FIG. 1A shows an application example in an accounting firm, and FIG. 1B adopts so-called "Internet accounting". An example of application in an accounting firm is shown below.
In FIG. 1, reference numeral 1 denotes a server installed in an accounting office, reference numeral 2 denotes a memory device such as a magnetic disk device, and reference numeral 3 denotes a LAN provided in the accounting office, and reference numerals 4-1 and 4-2. .. Indicate terminals connected to the server 1 via the LAN (auditing accounting processing device (hereinafter referred to as terminal 4)). Reference numeral 5 denotes a WAN (Wide Area Network) such as the Internet, reference numerals 6-1 and 6-2,... Reference terminals (accounting processing devices (hereinafter, referred to as terminals 6)), and reference numeral 100 denotes a LAN network. And 200 denotes a WAN which is a wide area network such as the Internet.
[0033]
In FIG. 1, the operator of the accounting office sets a plurality of data boxes (to be described later) in the memory device 2 in the server 1 and divides each person in charge into groups and associates them with the data boxes. As a result, the person in charge has access authority to the associated data box. The memory device 2 is provided with a shared area that can be accessed by anyone. Also. Some of the contacts can have access to multiple data boxes.
Although the memory device 2 is described as having a configuration different from that of the server, it can be physically installed inside the server.
Further, the entity of the management device for performing data management according to the present invention exists in the memory device (including the case of the external memory device) of the server 1 or the terminal 3.
Then, the management device for performing data management according to the present invention selects and sets from the memory device (including the external memory device) of the server 1 or the terminal 3 by the “environment setting” operation as described later.
Further, the “memory device” constituting the data box is not limited to the memory device 2 built in or external to the server 1 as described later, but may be a storage device built in or external to the terminal 3. Further, the memory device 2 may be configured as a database device.
[0034]
Also, in the network 100 shown in FIG. 1A, in the accounting office, each person in charge operates the terminal 3 to input journal data received from an advisor and to perform accounting processing (for example, input of accounting data, accounting). Update files and audit ledgers and financial statements) and send the results to the advisor in charge. At the start of the accounting process, user authentication based on the group management method according to the present invention is performed, and access control to the data box is performed.
[0035]
In the input process, the input data is stored in the data box of the memory device 2 via the LAN 2 and the server 1 in the data box associated with the group of which the person in charge is a member. In the process of updating the accounting file, the accounting file stored in the data box associated with the group of which the person in charge is a member among the data boxes of the memory device 2 is transmitted via the LAN 2 and the server 1. Perform an update. At the time of the audit, a ledger or a ledger is stored on the basis of the accounting file stored in the data box associated with the group of which the person in charge is a member among the data boxes of the memory device 2 via the LAN 2 and the server 1. Display the semantic statements etc.
[0036]
In the network system 200 shown in FIG. 1B, access control by user authentication and accounting work are performed in the same manner as in FIG. 1A. Transfer of accounting data and accounting files between the server 1 and the terminal 6 of the advisor is performed via the server 1, and synchronization processing of the accounting files is performed.
[0037]
2. Data box
The data box refers to a plurality of data boxes virtually provided by a data management program in an area of a storage device of a designated computer device (in the illustrated example, a designated one of the server 1 or the plurality of terminals 3). It is an independent divided area (logically divided area), and can be subjected to access restriction assuming that there are apparently a plurality of data areas.
These data boxes will be selected as data management devices as described later.
[0038]
The data box is realized by, for example, partitioning a server disk by partitions. However, since the data box may be compatible with a multi-device as described later, the actual data box is not limited to a hard disk (and a partition which is a part of the data box), and a wide range of storage media such as a CD-R, a MOD, and a USB device are widely used. Including. In addition, it also includes dividing a database as well as dividing by the concept of a folder.
Note that a partition obtained by physically dividing a storage area of a data management device (for example, the memory device 2) can be used as a data box as a divided area. However, since the area is fixed, the partition lacks flexibility and furthermore, Depending on the size of the file, the number of files that can be stored is limited, or an unused area remains in a worm-like state (referred to as fragmentation).
In other words, in the case of a virtual (logical) divided area, it is not necessary to consider the occurrence of such fragmentation, so that it has a feature that is easy to manage. Therefore, when one physical memory device is divided, a virtual division method is mainly used.
[0039]
However, in some cases, it is convenient to assign the memory device to one data box instead of dividing it, so that the data box does not necessarily mean only a virtually divided area.
More specifically, as will be described later, the entirety of one MO device, one entire DVD device, and one entire USB memory device are allocated as data boxes (without division), respectively (FIG. 6 (b)).
[0040]
FIG. 2 is an explanatory diagram of a data box, and is an example in which a data box is set in the memory device 2. In the illustrated example, data boxes 21, 22, and 23 are set in the storage area 20 of the memory device (for example, a magnetic disk) 2, but the number of data boxes that can be provided in the storage area 20 is three. It is not limited to one. In the storage area 20, various divided areas can be set in addition to the data box in addition to the common area.
[0041]
A member of the group having access authority to each data box can store a data file in the data box, update the contents of the stored data file, or delete the data file. In the example shown in the figure, the data box 21 stores accounting files 21-1, 21-2, and 21-3 which are members of an accounting office and which can be accessed only by members of a group who has access authority to the data box 21. I have. Data boxes 22 and 23 also store accounting files that can be accessed only by members of other groups having access rights.
[0042]
FIG. 3 is a diagram showing a configuration example of a storage area of a storage device in which a data box is set. , An information management box 20-2 for storing security information and the like, and a plurality of data boxes 21, 22,.
[0043]
Specifically, a directory named “= XXXX” (XXXX is data box. NO) is prepared in the root directory of the disk, and data is stored under this directory with the same configuration as before. In this way, data management on a group basis is realized. (The old area is called the "shared area" and can be accessed without access by all users.)
[0044]
For example, in the case of an accounting office, files such as an OS, a system file, a program file for a financial accounting system (application program), financial files 1, 2,... Are stored in the common area 20-1. Is done.
[0045]
The management information box 20-2 manages a “user management table” for managing user information, a “group management table” for managing group information to which the user belongs, and manages what data box is prepared in the storage area 20. For example, information such as a “data box management table” is stored. In the example shown in the figure, each data box stores a plurality of accounting files of each adviser of the accounting firm.
[0046]
FIG. 4 is an explanatory diagram of the contents of the access authority managed by the management table.
In the present embodiment, the access levels are three levels of 0 to 2, and as shown in the figure, at level 0, the access authority is "no restriction", and all members can access. This is an access level when a storage area is used as a shared area or when data management by type is performed.
[0047]
At level 1, the access authority is access restriction by a password common to data boxes, and only members who know the password can access all data boxes. This is an access level when a storage area is used as a shared area or when data management by type is performed.
[0048]
At level 2, the access authority is access restriction by a password provided for each data box, and only members of a group associated with a certain data box can access the data box. This is the access level for group management.
[0049]
These access rights are all managed by the information management BOX 20-2 (FIG. 3). Note that one information management box is prepared for each device. As described above (FIG. 3), the information management box is provided with three management tables, a user management table, a group management table, and a data box management table. Management of access rights to the data box is realized.
[0050]
(User management table)
The user management table is a table for performing management on a user-by-user basis, and the user is a minimum unit for managing access rights of a data box. Also, all users must belong to some group. This table manages a user name, a password, a user name, a user authority, a user ID, a group ID to which the user belongs, and the like. When all data boxes are shared by all without setting an access right, only the “anonymous” user is registered.
[0051]
(Group management table)
The group management table is a table for managing groups, and specifies a data box that can be accessed for each group. Here, a group ID, a group name, and an accessible data box ID are set.
[0052]
(Data box management table)
6 is a table for managing data boxes prepared in a memory device. This table manages data box IDs and data box names.
[0053]
FIG. 5 is a diagram showing a configuration example of a user management table, a group management table, and a data box management table stored in the information management box and a relationship between the management tables. FIG. FIG. 5B shows a group management table, and FIG. 5C shows a data box management table.
[0054]
The user management table 51 includes a user name column 511 storing a user name, a password column 512 storing a password, a user name column 513 storing a name of an accounting office, a user right column 514 storing user rights, and a user ID. And a group ID column 516 storing a group ID to which the user belongs.
[0055]
The group management table 52 includes a group ID column 521 storing a group ID, a group name column 522 storing a group name, and a data box ID column 523 storing an ID of a data box accessible to members of the group. Become.
[0056]
The data box management table 53 includes a data box ID column 531 storing a data box ID and a data box column 532 storing a data box name.
[0057]
In the example of FIG. 5, the group name to which the user B belongs can be specified as “Z accounting group” in the group management table 52 using the group ID “# 003” registered in the user management table 51 as a pointer. Of the data box accessible by the user B who is a member of the group "BOX-1" and "BOX-4". Then, based on the acquired data box IDs “BOX-1” and “BOX-4”, the data box (name) accessible to the user B can be known by referring to the data box management table 53. Conversely, based on the data box name, it is possible to know the group that can refer to this data box and its members.
[0058]
FIG. 6 is a diagram showing an embodiment of a data management device selection screen. FIG. 6A is a diagram showing one example of a data management device selection screen displayed when the accounting process is started at a terminal of an accounting office having a LAN configuration. An example will be described.
[0059]
The data management device selection screen 60 includes a machine display column 61 and a management device selection column 62. The machine display column 61 displays the name of an information processing device including a memory device in which a data box is set. Indicates the name of the memory device in which the data box is set, and the name of the data box is added in parentheses or the like).
[0060]
In the example of FIG. 6A, the common area set in the storage area of the magnetic disk device of the X server (the machine name of the server) and two data boxes (individuals of the A accounting firm) are displayed on the data management device selection screen 60. The data box for data and the data box for corporate data of the accounting office A), the MO (Magneto-Optical disk) of the X server that is entirely set as one data box, and the whole as one data box The magnetic disk device of the terminal being displayed is displayed. In FIG. 6A, if a group of all members (that is, all members) is regarded as a data box of a general-purpose user (anontomous) user who is associated with an access right of “no access right” in FIG. Three data boxes are set in the storage area of the magnetic disk device of the server, and can be managed as data boxes in the data box management table 53 of FIG.
[0061]
On the data management device selection screen 60 displayed at the start of the job, the user selects a data management device to which the user has access, that is, a common area or a data box with the cursor 65, and clicks a confirm button 66. You can get access to the data files needed for the job and start the job.
If the user makes this setting first, the user can then start each application software and concentrate on the operation of the application software without being aware of data management during the processing of the software. This is one of the advantages of the present invention realized by middleware.
[0062]
FIG. 6B shows an embodiment of a data management device selection screen when a data box is set in association with a multi-device, and the user selects this data management device selection screen 60 'displayed at the start of a job. Then, by selecting the data management device, that is, the device set as the data box in FIG. 5C, the access right to the device necessary for the job can be acquired and the job can be started. As described above, a data box can be associated with a device set as a memory device.
[0063]
When the setting as shown in FIG. 6B is made, the data box allocated to the DVD device can be used for evacuation of past year's data, and the past history is stored in the DVD in preparation for a disaster such as an earthquake or fire. -A data management system suitable for accounting firms that need to be evacuated to R or the like can be provided.
[0064]
7A and 7B are conceptual diagrams showing a difference in user management depending on an access level. FIG. 7A is a conceptual diagram of user management at level 0 or level 1, and FIG. 7B is a conceptual diagram of user management at level 2. It is.
[0065]
In FIG. 7A, the access level is 1 when the password is assigned to the general-purpose user, and the access level is 0 when the password is not assigned to the general-purpose user. At level 0, anyone can access the shared area and data box, but at level 1, only the person who has been given a password can access all data boxes (a general-purpose user who has not been given a password at level 1 can do so) Only in the common area).
When operated in such a configuration, since each user belongs to the same group, an environment suitable for a relatively small accounting firm can be provided.
[0066]
In the example of FIG. 7B, the users A and B to which the access authority of the group 1 has been granted can access the shared area and the data box 0001, but cannot access the other data boxes. The user C who has been granted the access right of the group 2 can access the shared area and the data box 0002, but cannot access the other data boxes. However, the “administrator” who is granted the access right of the group “admin” can access the common area and all the data boxes.
[0067]
When operated in the configuration as shown in FIG. 7B, each user belongs to three groups, so that an environment suitable for a relatively large accounting firm can be provided. This is in line with the fact that when accounting firms grow in size, the person in charge is often assigned to each consultant.
[0068]
FIG. 8 is a conceptual diagram in which the user management by the access level is enlarged. The difference from the conceptual diagram of the access level 2 in FIG. 7B is that a portion connected by a dashed line indicated by reference numeral 81, that is, the user A The point is that the access authority of group 2 is also given. As described above, in the access level 2, the management of granting the access authority may be expanded so as to grant the user the access authority of a plurality of groups. Alternatively, a password may be specified for each user.
[0069]
FIG. 9 is a diagram showing an example in which group management can be customized in user management by access level. In the illustrated example, the data of the advisor is disclosed to all clerks, but the data of the accounting firm itself is shown. This is an example in which only a clerk cannot refer to (an accounting file of an accounting office, a salary file, etc.) (however, illustration of a shared area is omitted).
[0070]
That is, in the illustrated configuration, all clerks are given the access right to the clerk group by sharing the ID of one group (clerk group). Can access previous data. However, only the teacher belonging to the teacher group can access the data box ZZZ storing the salary file and the like in the office.
In this case, a suitable environment can be provided when it is desired to separately manage the salary and personnel data of each staff so that only the teacher can access the data.
[0071]
FIG. 10 is a diagram showing an embodiment of data management using a data box, in which data is managed by type. In FIG. 10, reference numeral 101 denotes a server installed in an accounting office, reference numeral 102 denotes a disk connected to the server 101, reference numeral 103 denotes a LAN line, reference numerals WS1, WS2. Indicates a terminal (account processing device) connected to the server 101 via the LAN.
[0072]
The use of the data box makes it possible to manage the data stored in the disk for each type in such a configuration of one server. For example, data can be classified into “corporate”, “individual”, “other”, etc., and data can be selected from terminals (WS1, WS2,...) In accordance with the business content, and input processing and the like can be performed.
[0073]
There are corporations and individuals as advisors to accounting firms, and by managing them separately as "corporate", "individual", "other", etc., it is efficient to save data mixed on one disk It can perform effective consultant management. In the illustrated example, the terminal WS1 and the terminal WS2 are set so that the same management device can be used. However, this is suitable for accounting at a relatively small accounting firm.
In such a case, the access level is basically set to 0 (an access right is not set and all users can access all data). For example, if only “corporate” and “individual” can be accessed for each group of persons in charge, for example, in an accounting firm with many persons in charge, a group divided into a group in charge of corporations and a group in charge of individuals Management becomes possible, which is a form suitable for a relatively large accounting firm.
[0074]
FIG. 11 is a diagram showing an embodiment of data management using a data box, in which only specific data can be accessed. The description of the network configuration is the same as that of FIG.
[0075]
Use of a data box can secure a private data area that cannot be accessed by other members. For example, if you do not want to show it to the general clerk, such as the accounting office's own accounting file, salary file, private data for teachers, create and register a dedicated data box, You can create two accounts, one for the clerk and one for the teacher, so that only the teacher can access the data box. In other words, the general clerk manages the advisor's data in the shared area, the general clerk can use only the shared area, and the teacher can use the shared area, the data box storing the office data, and the teacher's personal data. It can be set so that the stored data box can be accessed.
[0076]
FIG. 12 is a diagram showing an embodiment of data management using a data box, in which data is managed by group. The description of the network configuration is the same as that of FIG.
[0077]
For example, if it is desired to manage data by group in order to cope with the incorporation of accounting firms, data of a plurality of accounting firms can be managed by a single server disk by using a data box. . In this case, data such as finance, tax, documents, etc. are registered in the data box for each group (former office) in the same way as the conventional disk, and whether a server is prepared for each old office It can be operated as follows.
[0078]
In this case, first, an account is created for each clerk, a group is created for each accounting office, and then the group to which each clerk belongs is defined. As a result, only the data box to which the user can access (data of the office) is displayed on the management device selection screen of the application. Also, depending on the settings, the teacher may be able to access all office data.
[0079]
In the above description, the definition of the data box that configures the data box and promotes the specific business is suitable for an accounting firm of any size, any configuration, or any business form. It has been explained whether access management is realized.
[0080]
Hereinafter, first, how it acts as middleware in various applications will be described. Next, utilities for constructing an environment for realizing these will be described.
[0081]
<Data management using middleware>
In a client server system, when restricting access to a user or separately managing an accessible area for each user, an OS (for example, Windows (R) (registered trademark of Microsoft Corporation)) has conventionally been prepared. Various management software was started up and the settings were made, but the initial settings required for the management software and the various operations required by the management software started at the start of application startup require expert knowledge of the OS and management software. As described above, it is difficult and cumbersome as necessary.
[0082]
In the present invention, the initial setting and change of the data management conditions and the job menu described above are performed by a simple selection operation and input operation using a limited number of selection screens centered on a group of utility programs positioned between the application and the OS. Various operations for data management required at the time of startup and application execution are enabled.
[0083]
That is, the middleware positioned between the application and the OS can provide a common data management and access management environment for the application based on the configuration set by the utility program group.
[0084]
In the following description, display, selection or input of the screens shown in FIGS. 13 and 14 and each of the screens shown in FIGS. 16 to 26, registration and storage of the input result, change of the setting conditions, and change of the setting conditions and parameters The exchange with the OS and the application program is executed by a utility program corresponding to each screen.
[0085]
FIG. 13 is a diagram showing an embodiment of a data box management main screen (hereinafter, main screen) using a utility. The main screen 130 is displayed at the time of initial setting and change of data management conditions and before the application is started.
[0086]
As shown in the figure, the main screen 130 includes a setting content display column 131 for displaying the setting content and a menu display column 132 for displaying various setting menus.
[0087]
The meaning of the setting content shown in the setting content display column 131 is as follows. In the illustrated case, the “management device name” line indicates the name of the management device to be changed by the job (application) to be executed. The "Management Device Settings" line will usually show the authentication mode, the "Current User" line will show the username of the currently logged in user, and the "Current Group" will be the currently logged in user. The name of the group to which the user belongs is displayed, and the "Current privileges" line displays the privileges of the currently logged-in user (however, if the administrator password is entered, the "Administrator (Administrator) Password entered) ”is displayed.
[0088]
When the menu in the menu display column 132 is selected, the program branches to a program for performing the processing displayed on the menu (in this example, a utility program group corresponding to various menus). Note that a more detailed menu may be displayed in the menu selection column 132 (for example, see the main screen in FIG. 16).
[0089]
(For application execution)
FIG. 14 is a flowchart showing the process of the data management operation performed when the application is started. The operation is performed in the order shown in FIG. Screens 141 to 144 shown on the right side of the flowchart in FIG. 14 are data management screens displayed according to the process.
[0090]
First, when the terminal is started, a job menu for selecting an application is displayed (step S1). When the operator selects a job (application), a tee for confirming access authority is selected from a group of data management utility programs. The utility program is called by the data management program configured as middleware, and displays a user authentication screen 141 as shown in the figure to confirm the access authority to the data box, and inputs authentication data such as a user name and a password. Prompt. When the user inputs the authentication data, an authentication process is performed (step S2).
[0091]
If the authentication is performed, an application for executing the job selected in step S1 is started, and at substantially the same time, a utility program for management device selection processing is called from the utility program group for data management by the data management program. Then, the management device selection screen 142 as shown is displayed to prompt the user to select an area (common area or data box) (step S3), and the user is prompted to select the area (common area or data box) displayed on the management apparatus selection screen 142. Box: In the illustrated example, when the data box 1) is selected and a determination operation is performed (step S4), a data utility program for data selection is called from the data management utility program group by the data management program. A data selection screen 143 like Shimesuru. The data selection screen displays a list of data (file) names and the like stored in the area selected in step S4 (one case in the illustrated example). S5) The data is called from the area selected in step S4, and the application is executed.
[0092]
As shown in the flowchart of FIG. 14, according to the data management method of the present invention, an application can be executed only by performing a simple operation on a minimum number of displayed screens.
[0093]
That is, the user first sets the simple settings as shown in FIG. 15, and thereafter starts each application software and concentrates on the operation of the application software without being aware of data management during the processing of the software. can do.
[0094]
If it is desired to further simplify the user's setting operation while using each application software (for example, when a specific management device is used for a specific application), the management device selection in step S4 is performed. You can also pass.
[0095]
FIG. 15 is a flowchart showing a process of a setting operation such as data box creation.
First, when a data box management job is started, a data management program is started, and a utility program for displaying a main screen is called from a group of data management utility programs by a data management program configured as middleware. Since the main screen 130 as shown is displayed, when the user selects “initial setting” displayed in the setting menu column 132 (step T1), a utility program for setting a password is selected from the utility program group for data management. Called by the data management program, an administrator password setting screen 170 as shown in FIG. 17 is displayed, and the user is prompted to enter a password. When the administrator password is entered and the "execute" button 171 is clicked, the process proceeds to step T3 ( S -Up T2).
[0096]
The utility program for displaying the main screen is called again by the data management program from the utility program group for data management, and the main screen 130 shown in FIG. 16 is displayed. ", The process proceeds to step T4," data box setting "to step T5," group setting "to step T6, and" user setting "to step T7 (step T3).
[0097]
When "initial setting" is selected on the main screen 130, a utility program for displaying a basic setting screen is called from the data management utility program group by the data management program, and a basic setting screen 180 as shown in FIG. When the user selects one of the authentication modes displayed in the authentication mode selection field 181, the process returns to step T3 to display the main screen of FIG. . When performing group setting or user setting, "with user authentication" is selected to enable user authentication (step T4).
[0098]
When "data box setting" is selected on the main screen 130, a utility program for data box setting is called from the utility program group for data management by the data management program, and first, as shown in FIG. The management device / data box list screen 190 is displayed. Note that a tree of the management device and the data box is displayed in the left column 191 of the screen 190, and information related to the item selected in the tree is displayed in the left column 192 (blank display at initial setting). When the user clicks the "Add" button 193, an input screen 190 'as shown in FIG. 19B is displayed, so that the user can enter data necessary for creating a data box in each input box of the data box setting screen 190'. Is entered and the "Execute" button 198 is clicked, a data box corresponding to the input is created, and the management device / data box list screen 190 is displayed again as shown in FIG. 191, a tree of the management device and the data box is displayed, and in the right column 192, information relating to the item selected in the tree (in this example, “Sato accounting firm data”) is displayed. Here, when the user clicks the "access setting" button 194, the process proceeds to step T5 ', and when the user clicks the "confirm" button 195, the process returns to step T3 (step T5).
[0099]
When the “access setting” button 194 is clicked on the management device / data box list screen 190, a utility program for setting an access right is called from the data management utility program group by the data management program, and FIG. The access right setting screen 200 shown in FIG. Since the group name is displayed in the group display column 202 of the access right setting screen 200, the group that is permitted to use the data box (the data box set in step T5) displayed in the data box display column 201 is displayed. When the user clicks to turn the check on and clicks the “OK” button 203, the group for which the check is turned ON is given an access right to the data box displayed in the data box display column 201, and returns to step T 5. (In this case, in step T5, the group name of which access is permitted is displayed in the information display column 192 of the management device / data box list screen 190 as shown in FIG. 20B) (step T5 ').
[0100]
When "group setting" is selected on the main screen 130, a utility program for user setting is called from the data management utility program group by the data management program, and first, as shown in FIG. The group list screen 210 is displayed. Note that the left column 211 group name of the screen 210 is displayed, and the right column 212 displays information related to the group selected in the left column 211 (the column is blank at the time of initial setting). When the user clicks the “Add” button 213, a group setting screen 210 ′ as shown in FIG. 21B is displayed, and the user inputs a group name into the group name input field 211 ′ of the group setting screen 210 ′. When the user inputs and clicks an "execute" button 218, a group is set. As shown in FIG. 21C, the group list screen 210 is displayed again, and the set group is displayed in the left column 212. Here, when the user clicks the “access setting” button 214, the process proceeds to step T6 ′, and when the user clicks the “check” button 215, the process returns to step T3 (step T6).
[0101]
When an “access setting” button 214 is clicked on the group list screen 210, a utility program for setting an access right is called from the data management utility program group by the data management program, and an access as shown in FIG. The right setting screen 220 is displayed. Since the data box name is displayed in the display column 222 of the access right setting screen 220, the user clicks on the data box permitted to use the group displayed in the group name display column 221 and turns on the check. Button 223, the access right to the data box displayed in the group name display field 221 is given to the data box whose check is ON, and the process returns to step T5 (in this case, in step T5, the data The name of the group whose access is permitted is displayed in the information display column 212 of the box list screen 190 as shown in FIG. 22B (step T6 ').
[0102]
When "user setting" is selected on the main screen 130, a utility program for user setting is called from the data management utility program group by the data management program, and first, as shown in FIG. The user list screen 230 is displayed. Here, when the user clicks the “Add” button 237, a user setting screen 230 ′ as shown in FIG. 23B is displayed, and the user enters necessary data in each name input field of the user setting screen 23 ′. When a key is entered and an “execute” button 238 is clicked, a group is set, and as shown in FIG. 23C, the group list screen 230 is displayed again, and the set user information is displayed in the display column 232. . Here, when the user clicks the "confirm" button 239, the process returns to step T3 (step T7).
[0103]
As is clear from the description of the flowchart in FIG. 15, the initial settings, basic settings, data box settings, group settings, access right settings, User settings can be made.
[0104]
FIG. 24 is a conceptual diagram of user management via a WAN line.
According to the data management method of the present invention, a computer connected via a WAN line as shown in the figure. Even the user 241 can perform group management on the accounting office 242 side. Also, a password can be specified for each user.
[0105]
According to the data management method of the present invention, a computer connected via a WAN line as shown in the figure. Even the user 241 can perform group management on the accounting office 242 side. Also, a password can be specified for each user.
[0106]
As described above, as a result of the data box setting, group setting, and user setting, the data box management table 53, the group management table 52, and the user management table 51 as shown in FIG. Are linked, and a system for managing access authority to each data box for each group is established.
[0107]
Next, when various application software (payroll software, financial input software, etc.) is started, and the management device is accessed (that is, read and write payroll data and financial data) during the operation, the above-described configuration is established. It is explained whether access restriction management is utilized for each user (group) based on the environment.
[0108]
When the user A attempts to access the data box “BOX2”, first, the group ID “# 0002” to which the user A belongs is extracted from the user management table 51 of FIG. Searching 52, it can be seen that there are "BOX1" and "BOX2" as data boxes accessible to the group "X accounting firm group" to which user A belongs.
[0109]
As described above, the user A can access the data box “BOX2” associated with the X accounting firm (or the data box 2 is displayed on the management device of the user A), but the Y accounting firm is displayed. User A does not belong to the Y accounting office and therefore has no access right and is denied access even if he tries to access the data box (or is not displayed on the management device of user A).
[0110]
As described in the description of the flowcharts in FIGS. 14 and 15, the data management program functions as middleware, so that as shown in FIG. 25 (an explanatory diagram of password inheritance), a user belonging to the group α After the authentication, the application software X is started to access a specific data box, and after the processing by the application software X is completed, the processing by another application Y accessing the same data box is performed. Since the program maintains the access restriction environment set for the previous application software X, the application software Y can be activated without inputting a password. That is, when the same person accesses the same data box and continuously uses different application software, the access restriction environment such as a password is inherited, so that there is no need to repeat the operation for data management.
[0111]
Finally, how the application and the middleware process cooperate and how they operate based on the settings by the utility described in FIG. 15 and thereafter will be briefly described with reference to the table configuration of FIG. 5 as appropriate.
[0112]
First, as a result of various settings of the data box made by the utility, a table as shown in FIG. 5 is constructed. As a result, the data box and the group are linked, and an access authority management system for each data box for each group is established.
Based on this premise, next, various application software (payroll software, financial input software, etc.) are started, and the management device is accessed during the operation (that is, read / write of payroll data and financial data). At this time, how the access restriction management is utilized for each user (group) based on the constructed environment will be described.
[0113]
A case where the financial input program is started will be described. First, when the user B tries to access the data box “BOX-2”, first, the group ID to which the user belongs belongs to “#” according to the user management table of FIG. 003 ”, and the group management table in FIG. 5B shows that the group with the group ID“ # 003 ”corresponds to the Z accounting office group, and the user B belongs to the Z accounting office group. You can see that. Further, it can be understood from the accessible data box ID of the group management table that the Z accounting office can access the data boxes “BOX-1” and “BOX-4”.
[0114]
Further, according to the data BOX management table of FIG. 5C, the name of the data box “BOX-4” is “shared data”, and the name of the data box “BOX-4” is “Z accounting office data”. You can see that.
[0115]
In this case, a list of data boxes accessible as a management device (in this case, “BOX-1” and “BOX-4”) is displayed in step S4 of FIG. (Not shown).
[0116]
In the case of the user A, the data “BOX-1” and the data “BOX-3” associated with the Y accounting firm can be accessed by searching the same table. Although “BOX-1” and data “BOX-3” are displayed, data “BOX-4”, which is a data box of the Y accounting office to which the user A belongs, is not displayed as a management device, and Grouping and data box access right management. As described above, by functioning as the middleware based on the configuration set by the utility, it is possible to construct an environment in which access is restricted even if any application software is started and operated.
[0117]
As mentioned above, although one Example of this invention was described, this invention is not limited to the said Example, It cannot be overemphasized that various deformation | transformation implementation is possible.
[0118]
【The invention's effect】
As described above, according to the present invention, only the user associated with the user group belonging to the data box can access the data stored in the data box associated with the user group. Easy to manage. Therefore, it is possible to perform access management independent of an application.
[0119]
In addition, since the data box can be allocated to the device of the information processing apparatus, it can correspond to a communication network environment of various configurations.
[Brief description of the drawings]
FIG. 1 is a diagram showing an embodiment of a network system configuration example to which the present invention can be applied.
FIG. 2 is an explanatory diagram of a data box.
FIG. 3 is a diagram illustrating a configuration example of a storage area of a memory device in which a data box is set.
FIG. 4 is a diagram illustrating a configuration example of a user management table, a group management table, and a data box management table, and a relationship between the management tables;
FIG. 5 is a diagram illustrating a configuration example of a user management table, a group management table, and a data box management table, and a relationship between the management tables.
FIG. 6 is a diagram showing one embodiment of a data management device selection screen.
FIG. 7 is a conceptual diagram illustrating a difference in user management depending on an access level.
FIG. 8 is a conceptual diagram in which user management based on an access level is enlarged.
FIG. 9 is a diagram showing an example in which group management can be customized in user management based on an access level.
FIG. 10 is a diagram showing an embodiment of data management using a data box.
FIG. 11 is a diagram showing an embodiment of data management using a data box.
FIG. 12 is a diagram showing an embodiment of data management using a data box.
FIG. 13 is a diagram showing one embodiment of a data box management main screen.
FIG. 14 is a flowchart illustrating a process of a data management operation performed when an application is started.
FIG. 15 is a flowchart showing a process of a setting operation such as data box creation.
FIG. 16 is a diagram showing one embodiment of a data box management main screen.
FIG. 17 is a diagram showing an embodiment of an administrator password setting screen.
FIG. 18 is a diagram showing an example of a basic setting screen.
FIG. 19 is a diagram illustrating an example of a management device / data box list screen.
FIG. 20 is a diagram showing an embodiment of an access right setting screen.
FIG. 21 is a diagram showing an example of a group list screen.
FIG. 22 is a diagram showing an embodiment of an access right setting screen.
FIG. 23 is a diagram showing one embodiment of a user setting screen.
FIG. 24 is a conceptual diagram of user management via a WAN line.
FIG. 25 is a diagram illustrating an embodiment of a password management inheritance method.
FIG. 26 is a diagram showing an example of a dialog box displayed when selecting a group right using conventional OS management software.
[Explanation of symbols]
1, 1 'server (information processing device)
2 Memory device (data management device)
3 communication network
4, 4-1, 4-2, 6, 6-1 and 6-2 Terminal (information processing device)
21, 22, 23 Data box

Claims (9)

Setting a data box including a divided area obtained by dividing a storage area, associating a user group with at least one of the data boxes, and associating a user with at least one of the user groups;
A data management method, wherein only a user associated with a user group belonging to the data box can access data stored in a data box associated with the user group. A storage device of the information processing device, comprising a data box obtained by dividing the storage area,
A data management device, wherein only a user belonging to a user group associated with the data box can access data stored in the data box associated with the group. A storage device of an information processing device, wherein a data box obtained by dividing a storage area, group management information in which a data box is associated with a user group that can access the data box, and a user group and a user are associated with each other. Data management comprising user management information, wherein only users belonging to a user group associated with the user management information can access data stored in a data box associated with the group management information. apparatus. 4. The data management device according to claim 2, wherein the storage area includes a common area in which access by a user can be performed without restriction. A data box setting means for setting a divided area obtained by dividing the storage area of the storage device in the storage device as a data box; a group setting means for associating the set data box with a user group; An information processing apparatus comprising: a user setting unit for setting; an access right setting unit for setting an access right of the data box; and a setting operation control unit for controlling the units to execute a setting operation. apparatus. An information processing apparatus having different storage devices, comprising: data box setting means for setting each of the different storage devices as a data box; group setting means for associating a set data box with a user group; User setting means for setting the access authority of the data box, and setting operation control means for controlling each of the setting means to execute a setting operation. Characteristic information processing device. A communication network system comprising: a plurality of terminals that exchange data with the information processing apparatus according to claim 5 through a communication network,
The user associated with the user group by the user setting unit is a data stored in a data box associated with the user group to which the user belongs by the group setting unit from one of the plurality of terminals. A communication network system, wherein A communication network system comprising a plurality of terminals connected to a server comprising the information processing apparatus according to claim 5 or 6 via a communication network,
The communication network system according to claim 1, wherein said data box setting means includes means for setting a data box in a storage device of said terminal. A communication network system comprising a plurality of terminals connected to a server comprising the information processing apparatus according to claim 5 or 6 via a communication network, wherein the terminal sets a data box when starting an application program. Storage device selecting means for selecting a storage device selected, a data box selecting device for selecting a data box set in the storage device selected by the storage device selecting device, and a data box selected by the data box selecting device. A communication network system comprising: a data selection unit that selects data stored in a data box; and a selection operation control unit that controls each of the selection units to execute a selection operation.

Images