JP2006048193A - Network system and its document management method - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide a system for preventing any secret document from leaking to the outside by a simple operation without especially introducing any complicate system. <P>SOLUTION: In this network system having a section connected and transmitted from an internal network to an external network, an image pattern management device 10 for preparing and storing image data as an image pattern, and for inserting the image pattern into the document stored by a server 2 is connected to the internal network, and a document to be transmitted to the external network is retrieved by a gateway 20. As for all documents to be transmitted, the insertion of the image pattern is retrieved by the gateway 20, and when the image pattern is detected, the connection is disconnected by the gateway 20, and when the image pattern is not detected, the connection is interrupted by a relay part. <P>COPYRIGHT: (C)2006,JPO&NCIPI

Description

  The present invention relates to a network system that connects a server and a plurality of client terminals via a network, and relates to a network system that prevents a document stored in a server from flowing out of the network system and a document management method thereof.

In recent years, with the rapid spread of personal computers, documents in organizations such as companies are created using application software such as word processors and spreadsheet software. The personal computer is also connected to the network by the development of the network system, and the created document is stored in a server connected to the network.
Further, the internal network inside the organization is connected to the Internet or the like and is also connected to an external network.

There are many important documents stored in this server, and it is absolutely necessary to prevent them from leaking out or being accessed from outside. However, in a state where the internal network and the external network are connected, a confidential document may be easily inadvertently leaked through this network.
For this reason, many methods for preventing leakage of confidential documents from the network have been proposed.

For example, a confidential label is attached to a document that needs confidential management handled in the company, and information indicating the confidential level of the document is added to the confidential label. Then, there is one that controls the sending of the document to the outside based on the information indicating the confidential level added to the label (see, for example, Patent Document 1).
However, when this document is to be viewed in-house via the internal network, a confidential label is added to this document, so a client terminal that does not have a mechanism (program) that can interpret the confidential label cannot view the document. It becomes impossible. Therefore, in order to properly operate document management in the company, it is necessary to set detailed rules in the company corresponding to the confidentiality level attached to the sensitivity label, and operation management based on the rules becomes complicated and management is required. The burden on the person will also increase.

Some software for electronically signing a document restricts access to the document based on the electronic signature of a person who has the authority to approve the document (see, for example, Patent Document 2).
However, in this case, it is necessary to set detailed rules for managing electronic signatures, and operation management based on the rules becomes complicated, which increases the burden on the administrator.
Further, it is searched whether or not a predetermined keyword is included in a document to be transmitted or a document attached to the document, and if a keyword is included, the transmission is automatically cut off. .

However, it is difficult to select the keyword appropriately, and maintenance for replenishing the new keyword is necessary. In addition, since the transmission of a document other than a confidential document is cut if the keyword is included, it is necessary to further examine whether the document picked up by the keyword is a confidential document individually, and the system management is complicated. It takes time and effort.
Further, in order to prevent copying of confidential documents, there is a type in which a copying machine reads a confidential mark attached to a confidential document at the time of copying, identifies the confidential document, and prevents copying (for example, see Patent Document 3). ).
However, when a confidential document is identified, a confidential mark is read. However, image processing is required when collating the confidential mark, and it is time-consuming and it is difficult to process a large amount of documents quickly.
JP 2003-173284 A JP 2001-229323 A JP-A-7-56483

  Therefore, an object of the present invention is to provide a system that prevents a confidential document from leaking to the outside with a simple operation without introducing a particularly complicated system.

According to another aspect of the present invention, there is provided a network having a portion for connecting a server for storing a document and a plurality of client terminals via an internal network in the organization, and connecting and transmitting from the internal network to the external network. In the system,
Create and save image data as an image pattern, and connect an image pattern management device that inserts an image pattern into a document stored on a server to the internal network.
A gateway for searching for a document to be transmitted to the external network is provided in a portion for connecting and transmitting from the internal network to the external network, and all documents transmitted from the internal network to the external network are searched for image pattern insertion by the gateway, A network system characterized in that when an image pattern is detected, the gateway disconnects the connection from the internal network to the external network, and when the image pattern is not detected, the relay unit relays the connection from the internal network to the external network. It is.

According to the present invention, image data is created and stored as an image pattern, and an image pattern management apparatus for inserting an image pattern into a document stored in a server is connected to an internal network. For this reason, an image pattern indicating a confidential document or the like is created and stored in advance by the image pattern management device, and the image pattern is easily inserted into a document created by a client terminal connected to the internal network. Can be saved.
Since the gateway that searches for documents to be sent to the external network is provided in the part that connects to the external network from the internal network and sends it, all the confidential documents sent to the external network can be found only by installing a gateway at the exit part of the network. Searching can be performed, and the leakage of confidential documents can be easily prevented by a simple system.

  All documents sent from the internal network to the external network are searched for the insertion of the image pattern by the gateway, and if the image pattern is detected, the connection from the internal network to the external network is disconnected by the gateway and is not detected. The relay unit relays the connection from the internal network to the external network. For this reason, since the search for gateways searches for image patterns such as binary data, it is possible to search faster and more accurately than searching for image data, and a large amount of documents can be processed quickly with a simple system. When an image pattern is detected, the connection with the external network is immediately disconnected, so that it is possible to reliably prevent the confidential document from leaking to the external network.

According to a second aspect of the present invention, an image pattern management apparatus includes an image pattern generation unit that creates image data as an image pattern, an image pattern storage unit that saves the created image pattern, and stores the saved image pattern in a server. And an image pattern insertion part to be inserted into a document to be
The gateway includes an image pattern storage unit that stores an image pattern created by the image pattern management device, an image pattern that is inserted into a document transmitted from the internal network to the external network, and an image pattern that is stored in the image pattern storage unit. The image pattern detection unit that compares the image, the connection unit that connects the internal network and the gateway, and the same image pattern as the image pattern stored in the image pattern storage unit is detected in the document transmitted from the internal network to the external network In this case, a disconnection unit that disconnects the connection from the internal network to the external network, and an image pattern that is identical to the image pattern stored in the image pattern storage unit is detected in a document transmitted from the internal network to the external network. If not a network system having a relay unit that relays the connection from the internal network to the external network.

  According to the second aspect of the present invention, the image pattern management device stores an image pattern generation unit that generates image data as an image pattern, an image pattern storage unit that stores the generated image pattern, and stores the stored image pattern in a server. And an image pattern insertion unit to be inserted into the document to be processed. For this reason, image data can be created in advance as an image pattern, stored in the image pattern storage unit, and the image pattern stored in the image pattern storage unit can be inserted into a confidential document. The image pattern can be quickly inserted, and the same image pattern can be transmitted to the gateway described later.

  The gateway includes an image pattern storage unit that stores an image pattern created by the image pattern management device, an image pattern inserted into a document transmitted from the internal network to the external network, and an image pattern stored in the image pattern storage unit. And an image pattern detection unit that matches the image pattern, and when searching for the image pattern of the transmission document by the gateway, the image pattern stored in the image pattern storage unit can always be verified, so that the verification can be performed quickly and reliably. it can.

  When the same image pattern as the image pattern stored in the image pattern storage unit is detected in the document that is transmitted from the internal network to the external network and the connection unit that connects the internal network and the gateway, the internal network is transferred to the external network. A disconnect unit that disconnects the connection, and a relay that relays the connection from the internal network to the external network if the same image pattern as the image pattern stored in the image pattern storage unit is not detected in the document sent from the internal network to the external network Since the communication information that the gateway sends from the internal network to the external network can be searched reliably, and the confidential information is included in the communication information, the connection can be immediately disconnected. so That.

  The present invention of claim 3 is a network system in which the image pattern is data expressed by binary data.

  In the present invention of claim 3, since the image pattern is data expressed by binary data, the search in the image pattern detection unit does not need to perform image processing for each image data, and can be performed quickly and accurately. The transmission document search in the gateway can be performed quickly and accurately.

  The present invention of claim 4 is a network system in which an image pattern can be visually recognized as image data in a client terminal.

  In the present invention of claim 4, since the image pattern can be visually recognized as image data at the client terminal, it is easily determined whether or not it is a confidential document when viewing the document stored in the server at the client terminal. It is possible to reduce the transmission of confidential documents to the outside by mistake.

  The present invention of claim 5 is a network system in which a plurality of image patterns are stored in an image pattern storage unit so as to be selectable.

  In the present invention of claim 5, since a plurality of image patterns are stored in the image pattern storage unit so as to be selectable, each image data and its image pattern corresponding to the level of security management can be stored, and an appropriate document can be stored. You can manage.

  According to a sixth aspect of the present invention, the image pattern insertion unit is a network system capable of automatically inserting an image pattern into a plurality of documents stored in a server.

  According to the sixth aspect of the present invention, since the image pattern insertion unit can automatically insert an image pattern into a plurality of documents stored in the server, the document creator or the document manager can use the same type of document. For example, an image pattern can be efficiently inserted into a document stored in the same file.

  The present invention of claim 7 is a network system in which the image pattern detection unit searches for the compressed data after the decompression process and recompresses after the search when the document data is compressed.

  In the present invention of claim 7, when the document data is compressed, the image pattern detection unit searches the compressed data after the decompression process and recompresses after the search. Patterns can be automatically searched by the gateway in the same way as normal documents and image patterns.

  The present invention of claim 8 is a network system in which the gateway is also provided between the internal network and a printer connected to the internal network.

  In the present invention of claim 8, since the gateway is also provided between the internal network and the printer connected to the internal network, it is possible to prevent the confidential document from being printed out and to prevent the confidential document from being taken out. it can.

  The present invention of claim 9 is a network system in which the external network is the Internet.

  According to the present invention of claim 9, it is possible to automatically search all of e-mails and the like that are used in a large amount every day with a simple device. Can be prevented.

  The present invention of claim 10 is the network system according to any one of claims 1 to 9, wherein the document stored in the server is a document expressed in PDF.

  In the present invention of claim 10, since the document stored in the server is a document expressed in PDF, the binary data of the image pattern can be stored as it is, and the search of the image pattern is also performed as it is. Can be used.

The present invention of claim 11 is a document management method for a network system for searching for a document to be transmitted from an internal network to an external network.
A server connected to a network using an image pattern management device, creating image data as an image pattern, inserting an image pattern into a document created on a client terminal or obtained from the outside, inserting the image pattern And store the document with the image pattern inserted,
When documents stored on the server from the internal network are transmitted to the external network, all the documents to be transmitted to the external network are searched and searched by the gateway provided in the portion connecting from the internal network to the external network. If an image pattern is detected in the document, the gateway disconnects the internal network to the external network. If no image pattern is detected, the gateway relay connects the internal network to the external network. A network system document management method characterized by relaying.

  In the present invention of claim 11, an image pattern management device is used to create image data as an image pattern, and the image pattern management device is used to insert an image pattern into a document created by a client terminal or obtained from the outside. Then, the document in which the image pattern is inserted is stored in a server connected to the network. For this reason, the image pattern created in advance by the image pattern management device is obtained from a document created at the client terminal or from outside, and the same image pattern is securely inserted into the document that is obliged to maintain confidentiality, and stored on the server. Can do.

  When documents stored on the server from the internal network are transmitted to the external network, all the documents to be transmitted to the external network are searched and searched by the gateway provided in the portion connecting from the internal network to the external network. If an image pattern is detected in the document, the gateway disconnects the internal network to the external network. If no image pattern is detected, the gateway relay connects the internal network to the external network. Relay. For this reason, all documents transmitted to the outside can be searched by the gateway. Further, since the search searches for the image pattern of binary data as it is, the search can be performed more quickly and accurately than the search for image data, and a large amount of documents can be processed quickly with a simple system. When an image pattern is detected, the connection with the external network is immediately cut off, so that it is possible to reliably prevent the confidential document from leaking to the external network.

According to the present invention of claim 12, the image pattern management device includes an image pattern generation unit that generates image data as an image pattern, an image pattern storage unit that stores the generated image pattern, and stores the stored image pattern in a server. And an image pattern insertion part to be inserted into a document to be
The gateway includes an image pattern storage unit that stores an image pattern created by the image pattern management device, an image pattern inserted into a document transmitted from the internal network to the external network, and an image pattern stored in the image pattern storage unit. The image pattern detection unit that compares the image pattern, the connection unit that connects the internal network and the gateway, and the same image pattern as the image pattern stored in the image pattern storage unit is detected in the document transmitted from the internal network to the external network. In the case of the image pattern stored in the image pattern storage unit, a disconnection unit that disconnects the connection from the internal network to the external network, and a document transmitted from the internal network to the external network. If but not detected, a document management method of a network system and a relay unit that relays the connection from the internal network to the external network.

  According to the present invention of claim 12, the image pattern management device includes an image pattern generation unit that generates image data as an image pattern, an image pattern storage unit that stores the generated image pattern, and stores the stored image pattern in a server. And an image pattern insertion unit to be inserted into the document to be processed. For this reason, image data can be created in advance as an image pattern, stored in an image pattern storage unit, and an image pattern stored in a confidential document can be inserted. The same image pattern can be quickly inserted, and a gateway described later can be used. The same image pattern can also be transmitted.

  The gateway includes an image pattern storage unit that stores an image pattern created by the image pattern management device, an image pattern that is inserted into a document transmitted from the internal network to the external network, and an image pattern that is stored in the image pattern storage unit. Therefore, when searching for an image pattern of a transmission document by the gateway, it is possible to always collate with the image pattern of the image pattern storage unit.

  When the same image pattern as the image pattern stored in the image pattern storage unit is detected in the document transmitted from the internal network to the external network, the disconnection unit disconnects the connection from the internal network to the external network, and the internal network When the same image pattern as the image pattern stored in the image pattern storage unit is not detected in the document transmitted from the network to the external network, the relay unit relays the connection from the internal network to the external network. For this reason, all communication information transmitted from the internal network to the external network can be searched reliably, and if a confidential document is included in the document transmitted to the external network, the connection can be immediately disconnected. .

  According to the present invention of claim 13, the gateway is provided between the internal network and the printer connected to the internal network, and when the document is transmitted to the printer, the gateway searches for the document, and the detection is performed by the gateway. The image pattern detection unit detects the insertion of the predetermined image pattern. If detected, the disconnection unit disconnects the connection to the printer. If not detected, the relay unit relays the connection to the printer. This is a document management method for a network system.

  According to the present invention of claim 13, since the gateway is provided between the internal network and the printer connected to the internal network, it is possible to prevent all confidential documents from being printed out and to take out the confidential documents printed out. Can be prevented.

In the present invention, it is possible to prevent a document stored in the server from leaking outside by a simple system. In other words, an image pattern can be created and stored in advance by the image pattern management apparatus, and the image pattern can be easily inserted into a document created by a client terminal connected to the internal network and stored in the server.
Since the gateway that searches for documents to be sent to the external network is provided in the part that connects to the external network from the internal network and sends it, all confidential documents that are sent to the external network simply by installing a gateway at the exit part of the network Thus, it is possible to easily prevent confidential documents from being leaked by a simple system.
Since the search for gateways searches for image patterns such as binary data, the search can be performed more quickly and accurately than the search for image data, and a large amount of documents can be processed quickly with a simple system.

Embodiments of the present invention will be described with reference to the drawings.
FIG. 1 is a configuration diagram showing a network system of the present invention.
In an organization such as a company, an internal network 3 is formed in which a plurality of document creator client terminals 1, a document manager client terminal 1a, and a server 2 are connected via a network. Here, the server 2 stores documents, tables, etc. created by the client terminal 1, documents obtained from the outside, and the like.
The internal network 3 is also connected to an external network 4 outside the organization such as the Internet.

  In the network system of the present invention, an image pattern management apparatus 10 (to be described later) is connected to the internal network 3, and a gateway 20 (to be described later) is connected to a portion where the internal network 3 and the external network 4 are connected. When a firewall (not shown) is connected to a portion where the internal network 3 and the external network 4 are connected, it is preferable that the gateway 20 is connected between the firewall and the internal network 3.

The image pattern management apparatus 10 includes an image pattern generation unit 11, an image pattern storage unit 12, an image pattern insertion unit 13, and an image pattern registration unit 14.
If the text is a format that can store the binary data of the portion into which the image is inserted, such as PDF (Portable Document Format), the additional portion can be used for searching the image. The image pattern generation unit 11 generates image data to be inserted into the document or the like stored in the server 2. As shown in FIG. 5, an example of a binary representation of an image pattern in the PDF format when an image of “secret” which is a confidential type is inserted into a predetermined location of a document is shown in FIG. An example of document data when inserted is shown in FIG. The binary representation of the image pattern shown here can be confirmed using, for example, an od command of a UNIX (registered trademark) OS or a binary editor.
In addition, image data to be inserted into a document, etc. is provided with a plurality of displays such as “secret”, “confidential”, “non-affiliated” secret, etc., and a plurality of corresponding image patterns are generated to maintain confidentiality. It is preferable that the selection can be made according to the degree.

The image pattern generated as binary data in this manner is stored in the image pattern storage unit 12 and is transmitted to the gateway 20 described later via the image pattern registration unit 14. Here, the image pattern registration unit 14 is a part that issues a command to save the image pattern to the gateway 20 in order to register the generated image pattern in the gateway 20, and a part that transmits and connects to the gateway 20. is there.
The image pattern may be stored in the image pattern storage unit 12 at the same time as the generation by the image pattern generation unit 11 as described above. After the image pattern is stored in the gateway 20 as described below, the image pattern is stored based on the response from the gateway 20. May be.

  As shown in FIG. 2, the image pattern registration to the gateway 20 is performed by transmitting an image pattern registration request from the image pattern registration unit 14 to the gateway 20 in order to register the created image pattern in the gateway 20. Then, as will be described later, the gateway 20 registers the image pattern and returns the registration result to the image pattern registration unit 14. The image pattern registration unit 14 checks the registration result against the image pattern remaining in the image pattern generation unit 11, and if the image pattern is correctly registered, the image pattern registration unit 14 stores the image pattern in the image pattern storage unit 12. Complete pattern registration. If the image pattern is not correctly registered, the image pattern registration operation is performed again or an error is displayed and the registration is terminated.

The image pattern insertion unit 13 inserts the image pattern stored in the image pattern storage unit 12 before storing the document in the server 2 or inserts the image pattern in the document stored in the server 2.
FIG. 6 is a flowchart for inserting an image pattern into a single document, and FIG. 7 is a flowchart for sequentially inserting the same image pattern into a plurality of documents.
As shown in FIG. 6, when an image pattern is inserted into a single document, first, a target document into which an image pattern is to be inserted is selected, then an image pattern to be inserted is selected, and the image pattern of the target document is Specify the insertion position, insert the image pattern by stamping.

Details of the stamping process for inserting an image pattern are shown in FIG. In the stamping process, first, the document manager issues a command for starting the stamping process from the client terminal 1a to the image pattern management apparatus 10 for the designated image pattern to the designated location of the target document.
The image pattern management apparatus 10 inserts an image pattern designated in the target document based on the command. Thereafter, it is confirmed whether the inserted image pattern is stored in the image pattern storage unit 21 of the gateway 20. The image pattern registration unit 14 of the image pattern management apparatus 10 issues an inquiry request for the inserted image pattern to the image pattern registration unit 25 of the gateway 20, and whether or not the image pattern storage unit 21 of the gateway 20 has the image pattern. Explore. The searched result is returned to the image pattern management apparatus 10 as an introduction result response.

If the image pattern is stored in the gateway 20, the stamping process is completed. In this way, the image pattern inserted into the document is reliably stored in the gateway 20 and can be reliably detected when the document is transmitted to the external network 4.
If the image pattern is not stored in the gateway 20, the stamping process is repeated again or recorded as an error, and the current stamping process is completed. If there is an error record, it can be dealt with separately.

As shown in FIG. 7, when inserting an image pattern into a plurality of documents, first, a plurality of target documents are designated, or a target folder in which a plurality of documents are stored is designated.
Next, stamping information is called to select an image pattern to be inserted, and specify a common insertion location of the image pattern. Then, an image pattern is inserted at a common insertion position for a plurality of designated documents or documents in a folder. After that, the document of the folder is called sequentially, and the operation of inserting the image pattern into the designated part is repeated. When there are no more target documents, or when the image pattern has been inserted into all the documents in the folder, the insertion operation is completed.

Next, as shown in FIG. 1, the gateway 20 includes an image pattern storage unit 21, an image pattern detection unit 22, a cutting unit 23, a connection unit 24, an image pattern registration unit 25, and a relay unit 26.
The image pattern storage unit 21 stores the image pattern created by the image pattern management apparatus 10 as described above. As described above, when the image pattern is generated by the image pattern generation unit 11, the image pattern management unit 10 issues a registration request for the image pattern to the gateway 20, and the image pattern registration of the image pattern management unit 10 is performed. The image pattern is stored in the image pattern storage unit 21 from the unit 14 via the image pattern registration unit 25 described later of the gateway 20.

Further, when there is a confirmation request from the image pattern management apparatus 10 whether an image pattern is stored in the image pattern storage unit 21 of the gateway 20, it is confirmed whether the image pattern is stored in the image pattern storage unit 21, A response is made to the image pattern management apparatus 10 via the image pattern registration unit 25 and the image pattern registration unit 14.
Thereby, the image pattern inserted into the document and the image pattern stored in the gateway 20 completely match, and the document transmitted to the outside can be reliably searched.

  The connection unit 24 connects the connection using the TCP protocol between the internal network 3 and the external network 4 as a connection to the connection unit 24 once, and transmits the communication data from the internal network 3 to the relay unit 26 described later. Give control. As a result, the relay unit 26 can send communication data to an image pattern detection unit 22 to be described later, with the communication connected. As a result, all communication data from the internal network 3 to the external network 4 can be searched by the gateway 20.

  The relay unit 26 is between the internal network 3 and the external network 4 and relays communication data. All communication data between the internal network 3 and the external network 4 passes through the relay unit 26. When the gateway 20 is installed between the internal network 3 and a printer (not shown), all communication data transmitted from the internal network 3 to the printer passes through the gateway 20 and the communication data is The presence or absence of confidential documents can be searched.

  The image pattern detection unit 22 searches for all communication data transmitted from the internal network 3 to the external network 4. Specifically, as shown in FIG. 9, first, the image pattern detection unit 22 receives the communication data read by the relay unit 26. The communication data is compared with the image pattern stored in the image pattern storage unit 21. If the same image pattern as that stored in the image pattern storage unit 21 is included in the communication data, the search is terminated. The above search is repeated for the number of image patterns stored in the image pattern storage unit 21 to search for all image patterns. When a plurality of documents are included in the communication data, this search is repeated for each document.

At this time, the comparison of the image patterns can be compared accurately in a short time because the binary data are compared with each other, rather than comparing the image data by image processing every time. Therefore, even a large amount of communication data such as a large amount of documents can be searched quickly.
When the same image pattern as that stored in the image pattern storage unit 21 is included in the communication data, a request is sent to the disconnection unit 23 described later to disconnect the connection.

  The disconnection unit 23 receives a signal from the image pattern detection unit 22 and disconnects the connection between the internal network 3 and the external network 4. When the image pattern detection unit 22 includes the same image pattern as that stored in the image pattern storage unit 21 in the transmission document, it is configured to perform default processing and disconnect the connection. Yes.

Next, a management method when a document stored in the server 2 in this network system is transmitted to the external network 4 will be described.
FIG. 11 is a flowchart showing an outline of the document management method.
When a document is created by the client terminal 1, it is transmitted to the document manager's client terminal 1a, and the document that the document manager needs to search for the document created by the client terminal 1a and keep the secret is a secret. An appropriate confidentiality symbol is determined depending on the degree. When the client terminal 1a instructs the corresponding document to be assigned a confidentiality symbol, an instruction signal is transmitted to the image pattern insertion unit 13 of the image pattern management apparatus 10, and the image pattern insertion unit 13 inserts the image pattern into the corresponding document. The
The image pattern can be inserted even by using the client terminal 1 by the document creator.

  The document into which the image pattern is inserted is distributed to a necessary department and stored in the server 2 when distribution is necessary. When the distributed document is viewed on the client terminal 1, the image pattern can be recognized as image data. For example, symbols such as “confidential” and “confidential” are displayed on the document as shown in FIG. And can recognize the need for confidentiality. In addition, when the document is viewed on the client terminal 1 after being stored in the server 2, symbols such as “confidential” and “confidential” can be seen in the same manner, and the necessity of confidentiality can be recognized. it can.

Next, when a document stored in the server 2 is transmitted to the external network 4, transmission data is created by the client terminal 1 and the document stored in the server 2 is attached. When the transmission procedure is performed, the transmission data and the attached document are transmitted to the gateway 20 via the internal network 3.
Transmission from the client terminal 1 is transmitted by the connection unit 24 of the gateway 20 and then transmitted to the image pattern detection unit 22 via the relay unit 26. The image pattern detection unit 22 searches the transmission data and the attached document and detects an image pattern therein.

As shown in the flowchart of FIG. 9, the image pattern is detected by comparing the transmission data with the image pattern stored in the image pattern storage unit 21. If the transmission data includes an image pattern stored in the image pattern storage unit 21, the search is completed and a request is sent to the cutting unit 23. When receiving the request, the disconnecting unit 23 disconnects the connection between the internal network 3 and the external network 4 as a default process. A comparison is made with all the image patterns stored in the image pattern storage unit 21. When the transmission data does not include an image pattern, the verification of the image pattern is completed.
Further, instead of the default disconnection, it is possible to perform processing specialized for a specific protocol. For example, in the case of POP (mail reception) and SMTP mail protocol, it is possible to draw attention to the sender in the mail software mechanism by sending a mail whose mail address or content has been changed to the sender.

When the transmission data does not include all the image patterns stored in the image pattern storage unit 21, the transmission data is transmitted to the external network 4.
In addition, when the gateway 20 is installed between the internal network 3 and the printer (not shown), all communication data transmitted from the internal network 3 to the printer is similarly searched in the gateway 20, and the image of the gateway 20 is obtained. Communication data including the same image pattern as the image pattern held in the pattern storage unit 21 can be prevented from being printed out.

  If the transmission data and the attached document are compressed files, the gateway 20 decompresses the compressed data before searching the image pattern of the transmission data and the attached document as shown in FIG. As a result, it is possible to search for an image pattern in the same manner as normal data. If there is an image pattern stored in the gateway 20 in the transmission data, the connection is disconnected. If the image data stored in the gateway 20 does not exist in the transmission data after the search for the image pattern is completed, the transmission data is again compressed and communication is performed.

  In protocols such as smtp, pop, and http, document files may be attached and transmitted by MIME Base64 encoding. In Base64 encoding, three types of common patterns can be specified from one binary data. By using this common pattern as an image pattern, the transmission data and the image pattern are directly compared. Therefore, it is possible to search for a pattern of a document encoded as an attached file. As a result, it is possible to search whether an image pattern designated in advance is inserted in the attached document. However, in MIME encoding, a line feed character may be automatically inserted into the data, so it is necessary to ignore characters corresponding to the line feed character on the transmission data side when comparing the transmission data with the image pattern.

It is a system configuration figure showing an embodiment of the invention. It is a flow chart of image pattern generation in an embodiment of the invention. 3 shows a sample binary image display of an image pattern in an embodiment of the present invention. The example which inserted the pattern of the confidential display in the PDF document in embodiment of this invention is shown. The example which carried out the confidential display to the document in embodiment of this invention is shown. It is a flowchart in the case of inserting an image pattern in the single document in embodiment of this invention. It is a flowchart in the case of inserting an image pattern in the some document in embodiment of this invention. It is a flowchart of the stamping process in the embodiment of the present invention. It is a flowchart of the image pattern search process in the embodiment of the present invention. It is a flowchart of the image pattern search process of the document which has a compression file in embodiment of this invention. It is a flowchart of the communication management by the image pattern in embodiment of this invention.

Explanation of symbols

DESCRIPTION OF SYMBOLS 1 Client terminal 2 Server 3 Internal network 4 External network 10 Image pattern management apparatus 11 Image pattern production | generation part 12 Image pattern storage part 13 Image pattern insertion part 14 Image pattern registration part 20 Gateway 21 Image pattern storage part 22 Image pattern detection part 23 Disconnection Section 24 Connection section 25 Image pattern registration section 26 Relay section

Claims (13)

In a network system having a part for connecting a server for storing documents and a plurality of client terminals via an internal network in an organization, and connecting and transmitting from the internal network to an external network,
Image data is created and stored as an image pattern, and an image pattern management device that inserts an image pattern into a document stored in the server is connected to the internal network.
A gateway for searching for a document to be transmitted to the external network is provided in a portion that connects to the external network from the internal network and transmits,
All documents sent from the internal network to the external network are searched for the insertion of the image pattern by the gateway, and when the image pattern is detected, the gateway connects the internal network to the external network. A network system characterized in that the connection from the internal network to the external network is relayed by the relay unit when disconnected and not detected. The image pattern management device includes an image pattern generation unit that creates image data as an image pattern, an image pattern storage unit that saves the created image pattern, and an image that is inserted into a document stored in the server. A pattern insertion portion,
The gateway is stored in an image pattern storage unit that stores an image pattern created by the image pattern management apparatus, an image pattern inserted in a document transmitted from the internal network to an external network, and the image pattern storage unit. An image pattern detection unit that compares the image pattern, a connection unit that connects the internal network and the gateway, an image pattern stored in the image pattern storage unit in a document transmitted from the internal network to the external network, and When the same image pattern is detected, a disconnection unit that disconnects the connection from the internal network to the external network, and an image stored in the image pattern storage unit in a document transmitted from the internal network to the external network. Network system according to claim 1 when the same image pattern and Jipatan is not detected with a relay unit for relaying a connection from the internal network to the external network.   The network system according to claim 1, wherein the image pattern is data expressed by binary data.   The network system according to claim 1, wherein the image pattern is visually recognizable as image data at the client terminal.   5. The network system according to claim 1, wherein a plurality of image patterns are stored in the image pattern storage unit so as to be selectable.   The network system according to claim 1, wherein the image pattern insertion unit can automatically insert an image pattern into a plurality of documents stored in the server.   7. The network system according to claim 1, wherein, when the document data is compressed, the image pattern detection unit searches the compressed data after decompression processing and recompresses after the search. 8.   The network system according to claim 1, wherein the gateway is also provided between the internal network and a printer connected to the internal network.   The network system according to any one of claims 1 to 8, wherein the external network is the Internet.   The network system according to claim 1, wherein the document stored in the server is a document expressed in PDF. In a document management method for a network system for searching for a document to be transmitted from an internal network to an external network,
Using image pattern management device, create image data as image pattern,
Use the image pattern management device for documents created on the client terminal or obtained from the outside, insert the image pattern, and store the document with the image pattern inserted in a server connected to the network,
When documents stored in the server from the internal network are transmitted to the external network, all the documents to be transmitted to the external network are searched by a gateway provided in a portion connected from the internal network to the external network. ,
When the image pattern is detected in the document to be searched, the gateway disconnection unit disconnects the connection from the internal network to the external network. When the image pattern is not detected, the gateway relay unit A document management method for a network system, comprising relaying a connection from an internal network to an external network. The image pattern management apparatus inserts an image pattern generation unit that generates image data as an image pattern, an image pattern storage unit that stores the generated image pattern, and the stored image pattern into a document stored in the server. An image pattern insertion portion,
The gateway is stored in an image pattern storage unit that stores an image pattern created by the image pattern management apparatus, an image pattern inserted in a document transmitted from the internal network to an external network, and the image pattern storage unit. An image pattern detection unit that compares the image pattern, a connection unit that connects the internal network and the gateway, an image pattern stored in the image pattern storage unit in a document transmitted from the internal network to the external network, and When the same image pattern is detected, a disconnection unit that disconnects the connection from the internal network to the external network, and an image stored in the image pattern storage unit in a document transmitted from the internal network to the external network. Document management method of a network system according to claim 10 having the relay unit when the same image pattern and Jipatan is not detected for relaying a connection from the internal network to the external network.   The gateway is provided between the internal network and a printer connected to the internal network. When the document is transmitted to the printer, the gateway searches for the document, and the search is performed on the gateway. The insertion of a predetermined image pattern is detected by an image pattern detection unit, and if detected, the connection to the printer is disconnected by the cutting unit, and if not detected, the connection to the printer is relayed. The document management method for a network system according to claim 10 or claim 11.

Images