JP2007148975A - Document file transfer tracking device, system, method, and program - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To track transfer of a document file between computers connected mutually via a network even when the name and content of the file are changed. <P>SOLUTION: This document file transfer tracking device transmitting/receiving a document file between the network is provided with a file access monitoring means monitoring access to the document file from the outside, a file positional information addition means adding file identification information to the document file before transfer, a file positional information reading means reading the positional information from the document file when the document file is stored in a transfer destination computer, and a file positional information update means creating and recording file transfer tracking information from the identification information added to the transferred document file. When the position of the document file in the transfer destination is associated with that in a transfer source, transfer of the document among the network is detected. <P>COPYRIGHT: (C)2007,JPO&INPIT

Description

  The present invention relates to an apparatus for tracking movement of a document file created on a computer, and more specifically, movement of a document file between networks using an e-mail program or a file transfer program, and a compression program or encryption program, The present invention relates to a document file movement tracking apparatus, a document file movement tracking system, a document file movement tracking method, and a program for monitoring movement of a document file through a file that includes a plurality of files in a separate file by a backup program.

  As a document file movement tracking device, there is InfoTrace of Soliton Systems Co., Ltd. (hereinafter referred to as Prior Art 1). This prior art 1 is a system that monitors a tool for copying and moving a file on a computer (hereinafter referred to as a filer) like Explorer of Microsoft Corporation and records the monitoring result in a log. The log of the prior art 1 includes a file name before the user operates with the filer, a file name after the operation, and types of user operations such as copy, move, and delete. Accordingly, tracking of copying and moving of a file is predicted based on the file name. For this reason, when the same file name is used in a plurality of computers, the file cannot be identified and traced.

  To deal with this problem, a method using a hash function (hereinafter referred to as Conventional Technology 2) is widely known as a method for identifying a file without using a file name. The hash function is a function that generates another value called “digest” from arbitrary data. This function (1) always outputs the same digest from the same data, and (2) the content of the data is a little. However, when it changes, the output digest also changes. Using this feature, the digest can be used as a document ID for tracking a file.

When the prior art 1 is used, there are the following problems.
When a document file is moved to another computer connected via a network using an e-mail program or a file transfer program, the document file received by the transfer destination computer cannot be specified which computer file. Therefore, since the document file before the movement and the document file after the movement cannot be associated with each other, the conventional technique 1 cannot track the movement of the document file.

  A method for solving this problem by combining the prior art 1 and the prior art 2, that is, using the same hash value for the transfer source file and the transfer destination file, treating this as a document ID, Can be tracked.

  However, when the content of the file is changed, the hash value changes before and after the change, and therefore, the file cannot be identified by the method of solving by combining the related art 1 and the related art 2.

  From the above, conventionally, there has been no technology that can track the movement of a document file between computers connected via a network even if the file name and the content of the file are changed.

  An object of the present invention is to make it possible to accurately detect movement of a document file between networks by associating a transfer source and a transfer destination document file position with respect to the document file transferred between networks. Note that the present invention achieves the above object while using a conventional program as it is without modifying the transfer program itself such as a file transfer program or an e-mail program.

  In order to achieve such an object, the invention described in claim 1 is a document file movement tracking device that transmits and receives a document file between networks, and associates the position of the document file at the transfer source and the transfer destination, respectively. It is characterized by detecting movement of a document file between networks.

  According to a second aspect of the present invention, in the first aspect of the present invention, there is provided a file access monitoring means for detecting an access to a predetermined document file by the file transfer program and determining the type of the detected access, and the access is started at the file reading start. If there is, file position information adding means for adding file position information to the document file to be accessed, and file position information for deleting the file position information added to the document file to be accessed if the access has been completed. A deletion means, and a file position information reading means for deleting the file position information after reading and temporarily storing the file position information added to the document file to be accessed, and the file position when the access is a file write end. Read by information reading means File position information update means for creating file movement tracking information indicating the storage position of the document file inserted, and file movement tracking information recording means for recording file movement tracking information created by the file position information update means. It is characterized by that.

  The invention according to claim 3 is the invention according to claim 2, wherein the file position information includes an absolute path of the document file and a file ID for identifying the document file added to the document file. Features.

  The invention described in claim 4 is the invention described in claim 3, wherein the file position information includes a revision indicating that a document file having the same file ID is copied.

  The invention according to claim 5 is the invention according to any one of claims 2 to 4, wherein the file movement tracking information recording means includes the date and time, the file ID, the absolute path of the transfer source, and the revision of the transfer destination. And the absolute path of the transfer destination are stored in association with each other.

  The invention according to claim 6 has a file ID recording means for recording a file ID in the invention according to any one of claims 2 to 5, wherein the file ID recording means is a correspondence between the file ID and the revision. A new file ID is created and a revision is updated based on the table.

  The invention according to claim 7 is characterized in that the document file movement tracking apparatus according to any one of claims 1 to 6 is connected via a network.

  The invention according to claim 8 is a document file tracking method performed by a document file movement tracking device for transmitting and receiving document files between networks, and by associating the positions of the document files at the transfer source and transfer destination, respectively. It is characterized by detecting movement of a document file.

  The invention according to claim 9 is the invention according to claim 8, wherein a file access monitoring step of detecting an access to a predetermined document file by the file transfer program and determining the type of the detected access, If there is a file position information addition step for adding file position information to the document file to be accessed and file position information for deleting the file position information added to the document file to be accessed if the access has been completed. A deletion step, and a file position information reading step for deleting the file position information after reading and temporarily storing the file position information attached to the document file to be accessed, and the file position when the access is a file writing end. information A file movement information update step for creating file movement tracking information indicating the storage position of the document file read in the loading step, and a file movement tracking information recording step for recording the file movement tracking information created in the file position information updating step. It is characterized by having.

  The invention according to claim 10 is the invention according to claim 9, wherein the file position information includes an absolute path of the document file and a file ID added to the document file for identifying the document file. Features.

  The invention described in claim 11 is characterized in that, in the invention described in claim 10, the file position information includes a revision indicating that a document file having the same file ID is copied.

  The invention according to claim 12 is the invention according to any one of claims 9 to 11, wherein the file movement tracking information recording step includes the date and time, the file ID, the absolute path of the transfer source, and the revision of the transfer destination. And the absolute path of the transfer destination are stored in association with each other.

  The invention according to claim 13 has a file ID recording step for recording a file ID in the invention according to any one of claims 9 to 12, wherein the file ID recording step is a correspondence between the file ID and the revision. A new file ID is created and a revision is updated based on the table.

  The invention according to claim 14 is a program for causing a document file movement tracking apparatus that transmits and receives a document file between networks to execute a document file tracking method, by associating the position of the document file at the transfer source and the transfer destination with each other, The document file movement tracking device is caused to execute processing for detecting movement of a document file between networks.

  According to a fifteenth aspect of the present invention, in the invention of the fourteenth aspect, a file access monitoring process for detecting an access to a predetermined document file by a file transfer program and determining a type of the detected access, and the access is started by reading a file. If there is, file position information addition processing for adding file position information to the document file to be accessed, and file position information for deleting the file position information added to the document file to be accessed if access has been completed. If the deletion and the access is a file write end, the file location information read processing for deleting the file location information after reading the file location information attached to the document file to be accessed and temporarily storing it, and the file location Information reading process A file position information update process for creating file movement tracking information indicating the storage position of the read document file, and a file movement tracking information recording process for recording the file movement tracking information created by the file position information update process A file movement tracking device is executed.

  According to a sixteenth aspect of the present invention, in the fifteenth aspect, the file position information includes an absolute path of the document file and a file ID added to the document file for identifying the document file. Features.

  The invention according to claim 17 is the invention according to claim 16, wherein the file position information includes a revision indicating that a document file having the same file ID is copied.

  According to an eighteenth aspect of the present invention, in the invention according to any one of the fifteenth to seventeenth aspects, the file movement tracking information recording process includes a date and time, a file ID, a transfer source absolute path, and a transfer destination revision. And the absolute path of the transfer destination are stored in association with each other.

  According to a nineteenth aspect of the present invention, in the invention according to any one of the fifteenth to eighteenth aspects of the present invention, a new file ID creation process and a revision update process are performed on a document file based on a file ID / revision correspondence table. A mobile tracking device is executed.

  According to the present invention, this occurs when a document file is sent to another computer using a transfer program such as a file transfer program or an e-mail program, and the computer that receives the sent document file saves the document file. As for the movement of the document file, the movement source and the movement destination of the document file can be accurately grasped.

  The best mode for carrying out the present invention will be described below in detail with reference to the accompanying drawings.

With reference to FIG. 2, the configuration of the document file movement tracking system and the document file movement tracking apparatus according to the embodiment of the present invention will be described.
The document file tracking system of this embodiment is the document file movement tracking apparatus of this embodiment, and has a plurality of computers 02 that can communicate with each other, and these are connected to each other via a network 01. Each computer 02 executes predetermined processing under the control of the file transfer program 03, and the document file movement tracking unit 04 executes a document file movement tracking method.

Next, paying attention to one of the plurality of computers 02 shown in FIG. 2, the configuration will be described with reference to FIG.
In FIG. 1, a computer 02 is an information processing apparatus that operates as a document file movement tracking apparatus according to the present embodiment, reads a document file in its own computer, and transfers data to another computer 02 via a network 01. A file transfer program 03 and a document file movement tracking unit 04 that monitors file access of the file transfer program 03 and acquires document file movement tracking information are configured.

  As shown in FIG. 1, the document file movement tracking unit 04 includes a file access monitoring unit 0401 that externally monitors a file access event generated by the file transfer program 03 for document file transfer, and a file access monitoring unit 0401. For a file in which a document file read start event is detected, the location information of the file (information composed of the absolute path of the file on the hard disk or a file ID for identifying the file) is stored in the document file. If the file location information is added to the file in which the file read end event is detected by the file location information adding unit 0402 to be added and the file access monitoring unit 0401, the file is deleted. To return to the default state If the file position information exists in the document file written by the file position information deleting unit 0403 and the file transfer program 03, the file position information reading unit 0404 for reading and deleting the file position information, and the file position information reading unit 0404 The file position information update unit 0405 for recording the file position information read by the file position information, the transfer source file position information acquired by the file position information read unit 0404, and the document file movement tracking information including the transfer destination file position information. A file movement tracking information DB 0406 to be recorded and a file ID DB 0407 that is a database for recording a file ID included in the file position information of the transfer source file and the transfer destination file are provided.

  1 and 2, the network 01 may be anything as long as it connects computers, and may be an internet line. The computer 02 may be a widely known personal computer or large computer.

  The file transfer program 03 has a file transmission function and a file reception function, and may be realized by a mail client, FTP (File Transfer Protocol) client software, or the like. In this specification, a mail client will be described as an example.

In the file transfer program 03, the file transmission function is a function of reading a document file existing in the computer 02 and transmitting the document file to another computer 02 via the network 01, and before starting to read the document file. A file reading start event is generated, and when the file reading is completed, a file reading end event is generated.
On the other hand, the file receiving function is a function for receiving a document file from another computer 02 via the network 01 and writing the document file in its own computer. When the writing of the document file is completed, a file writing end event is generated. These events occur in all well-known computers such as Windows (registered trademark) machines.

  The file access monitoring unit 0401 intercepts a file access event that has occurred in the file transfer program 03 and acquires the event type that has occurred and the name of the document file to be accessed. An example of a file access event is shown in FIG.

  In FIG. 3, an event type (T0301) is a type of event that has occurred, and is one of a file read start event, a file read end event, and a file write end event. The file name (T0302) is the name of the document file that is accessed by the file transfer program 03.

The next execution means is switched depending on the value of the event type T0301.
When the file reading start event is intercepted, the file name T0302 is transferred to the file position information adding unit 0402. When the file reading end event is intercepted, the file name T0302 is transferred to the file position information deleting unit 0403. When the file write end event is intercepted, the file name T0302 is transferred to the file position information reading unit 0404. The event intercepting function is provided as an API (Application Programming Interface) by the OS, and may be realized by using it.

  The file location information adding unit 0402 receives the file name T0302 from the file access monitoring unit 0401, reads the document file using this file name, adds the file location information in the document file, and overwrites and saves the file. This image is shown in FIG.

  In FIG. 5, a file 0501 indicates a file before adding the file position information 0502, and a file 0503 indicates a file after the file position information 0502 is added. However, this method is merely an example. For example, the file position information 0502 may be added to the head of the file.

  The file position information will be described with reference to FIG. As shown in FIG. 4, the file position information is an absolute path T0403 for uniquely identifying the file in the computer 02, and the original file is the same file even if the file name or file content is changed. A file ID T0401 for indicating, a revision number T0402 indicating how many copies and movements are repeated from the original file, and a magic number T0404 indicating that file position information is added are included.

  The magic number T0404 is a collection of special data that is not described in the normal file, and the later-described file position information deleting unit 0403 and the file position information reading unit 0404 determine whether the file has this magic number. By searching, it is possible to determine whether or not file position information is recorded in the file.

  The file ID T0401 sets an ID that can uniquely identify a file existing in all computers. Actually, the number of computers and the number of existing files are large, but numbers that can identify individual computers (IP address, MAC address, GUID that can be generated by Windows (registered trademark), etc.) ) And information for identifying the file in the computer may be used in combination.

  The file position information adding unit 0402 searches the file movement tracking information DB 0406 using the file name T0X02 as a key when creating the file position information to be added, and acquires the file ID T0401 and the revision T0402. If the corresponding data is found by this search, the file position information adding unit 0402 can acquire the file ID T0401 and the revision T0402 from the file movement tracking information DB 0406. If not found, the file position information adding unit 0402 0402 creates a new file ID and registers it in the file ID DB 0407, sets the new file ID as the file ID T0401, and sets the initial revision value 0 of the file ID as the revision T0402. Specific details of this search will be described in the file movement tracking information DB 0406. The file ID DB 0407 will be described in detail later.

  The absolute path T0403 stores the file name T0X02 received from the file access monitoring unit 0401. As the magic number T0404, a fixed value is stored in the file position information adding unit 0402, and this value is stored in the magic number T0404.

  When the file location information deleting unit 0403 receives the file name T0302 from the file access monitoring unit 0401, the file location information deleting unit 0403 reads the file using this file name, deletes the file location information added by the file location information adding unit 0403, and deletes the file. Save over. This image is shown in FIG. In FIG. 6, a file 0601 indicates a file before the file position information 0602 is deleted, and a file 0603 indicates a file after the file position information 0602 is deleted.

  This is to prevent troubles in use when another application reads a file with the file position information added. Thus, after the file transfer program 03 transfers the file, the transferred file contents can be kept in the same state as before the transfer.

  When the file location information reading unit 0404 receives the file name T0302 from the file access monitoring unit 0401, the file location information reading unit 0404 reads the file using this file name, and if the file location information identification information is recorded in the file, the file location information reading unit 0404 Read and store information temporarily. Delete the file location information from the file and overwrite the file. The temporarily stored file position information and file name T0302 are transferred to the file position information update unit 0405. Attention should be paid to the file name here. The file name T0302 is the file name of the file to be written locally by the file transfer program 03, and the absolute path T0403 of the file position information is the file name of the transfer source.

  The file location information updating unit 0405 receives the file location information and the file name T0302 from the file location information reading unit 0404, and records the file migration tracking information in the file migration tracking information DB 0406. The file movement tracking information is data in which the file position information of the transfer source and the file position information of the transfer destination are paired, and can be used for tracking the movement of the document file.

  FIG. 7 shows the configuration of the file movement tracking information DB 0406. The file movement tracking information DB 0406 is a database that records information related to a file transfer source and a transfer destination, and has the following schema.

  Date and time (T040601): A field for recording time information at the time of recording file movement tracking information. A timer value held in the computer 02 may be used.

  File ID (T040602): ID of the file before transfer. The value of the file IDT 0401 in the file position information sent from the file position information reading unit 0404 is recorded.

  Transfer source absolute path (T040603): Absolute path for uniquely identifying a file in the computer 02 before transfer. The value of the absolute path T0403 in the file position information sent from the file position information reading unit 0404 is recorded.

  Transfer destination revision (T040604): Revision of the file written after transfer. A value obtained by adding 1 to the value of the revision T0402 in the file position information sent from the file position information reading unit 0404 is recorded.

  Transfer destination absolute path (T040605): Absolute path for uniquely identifying a file written after transfer in the transfer destination computer 02. The file name sent from the file position information reading unit 0404 is recorded.

  The file location information update unit 0405 generates a transfer destination file based on the file location information of the transfer source file, and uses the current date and time, the transfer source file location information, and the transfer destination file location information to track the file movement (see FIG. 7) is generated and recorded in the file movement tracking information DB 0406.

  FIG. 21 shows the configuration of the file ID DB 0407. The file ID DB 0407 is a database that records a file ID set in correspondence with a file in the computer and a revision of the file ID, and has the following schema.

  File ID (T040701): ID for identifying a file existing in all computers. Actually, the number of computers and the number of existing files are large, but numbers that can identify individual computers (IP address, MAC address, GUID that can be generated by Windows (registered trademark), etc.) ) And information for identifying the file in the computer may be used in combination. That is, the file ID will never have the same ID if the computers are different. Even in the same computer, different files basically have different IDs, but when a file is copied or moved in the same computer using the file transfer program 03, the newly created file has the same ID as the original file. Take over the ID. A revision described later is used to identify these two files.

  Revision (T040702): A value indicating how much the file corresponding to the file ID is currently duplicated. When a file copy / move occurs within the same computer, the newly created file takes over the same ID as the original file ID, but uses revisions to identify the two files. When a user copies or moves a file with the file transfer program 03, the revision of the ID assigned to the original file is acquired from the revision T040702 of the file ID DB 0407, and the value is incremented by one and updated. The updated value is recorded again in revision T040702.

  Next, the operation of the present embodiment will be described in detail with reference to the flowchart with reference to FIG.

  Step S01: A step in which the user uses the file transfer program 03. The file transfer program reads the entire document file selected by the user and tries to transfer the read data to the transfer destination computer designated by the user. The file transfer program is not aware of the document file movement tracking device while it is operating. The file transfer program operates asynchronously with the document file movement tracking device.

  Step S02: A step in which the file access monitoring unit 0401 detects an event generated by the file transfer program 03. If the file access monitoring unit 0401 detects an event, the file name of the access target file is acquired, and the process proceeds to step S03.

  Step S03: The file access monitoring unit 0401 checks the type of event detected by itself, and branches to step S04, step S05, and step S06 depending on the type. If the detected event is a file read start event, the process branches to step S04. If the detected event is a file read end event, the process branches to step S05. If the detected event is a file write end event, the process branches to step S06. .

  Step S04: File position information adding means 0402 adds file position information to the file to be transferred by the file transfer program 03 and overwrites the file. After this processing, the process returns to step S01. This step is a process executed in the file position information adding unit 0402, and the flow of the process will be described later with reference to FIG.

  Step S05: The file position information deleting unit 0403 deletes the file position information added by the file position information adding unit 0402 in step S04. After this processing, the process returns to step S01. This step is a process executed in the file position information deleting unit 0403, and the flow of the process will be described later with reference to FIG.

  Step S06: A step for the file position information reading means 0404 to read and temporarily store the file position information added to the file received by the file transfer program 03 and delete the file position information in the file. This step is executed and the process proceeds to step S07. This step is a process executed in the file position information reading unit 0404, and the flow of the process will be described later with reference to FIG.

  Step S07: The file position information update unit 0405 registers the file movement tracking information in the file movement tracking information DB 0406. This step is executed, and the process returns to step S01. This step is a process executed in the file position information update unit 0405, and the flow of the process will be described later with reference to FIG.

  As described above, once activated, the document file movement tracking apparatus according to the present embodiment remains resident until the computer is terminated.

Next, step S04 in FIG. 8 will be described with reference to FIG.
Step S0401: The file location information adding unit 0402 searches the file migration tracking information DB 0406 for file migration tracking information including the transfer destination file name T040605 that matches the file name T0302 passed from the file access monitoring unit 0401. The file position information adding unit 0402 searches the file movement tracking information in the file movement tracking information DB 0406 from the newest date and compares the transfer destination file name T040605 that matches the file name T0302.

  Step S0402: A step of branching the process depending on the search result of the file movement tracking information in step S0401. If file movement tracking information is found in step S0401, the process proceeds to step S0403. If not found, a new file ID is generated, the initial value of the revision is set to 0, and those values are used as search results, and the process advances to step S0403.

  Step S0403: A step of generating file position information from the file movement tracking information found in step S0401. T040602, which is the file ID of the file movement tracking information, is stored in T0401, and the revision T040604 is stored in T0402. The computer name is added to the head of the file name T040605 and stored in T0403. A determined magic number (“Magic Number Tail Info”) is stored in T0404.

  Step S0404: A step of adding the file position information generated in step S0403 to the file indicated by the file name T0302.

Next, step S05 in FIG. 8 will be described with reference to FIG.
Step S0501: The file location information deleting unit 0403 searches the file location information from the file indicated by the file name T0302 passed from the file access monitoring unit 0401.

  Step S0502: A step of branching the process according to the search result of the file position information in Step S0501. If file position information is found in step S0501, the process proceeds to step S0503. If not found, step S05 ends.

  Step S0503: The file location information deleting unit 0403 deletes the file location information from the file indicated by the file name T0302.

Next, step S06 in FIG. 8 will be described with reference to FIG.
Step S0601: A step in which the file location information reading unit 0404 searches the file location information from the file indicated by the file name T0302 passed from the file access monitoring unit 0401.

  Step S0602: A step of branching the process according to the search result of the file position information in step S0601. If file position information is found in step S0601, the process proceeds to step S0603. If not found, step S06 ends.

  Step S0603: A step of reading the file position information in the file indicated by the file name T0302 by the file position information reading means 0404 and storing it in the temporary area.

  Step S0604: The file location information reading unit 0404 deletes the file location information found in step S0601 from the file indicated by the file name T0302 and overwrites and saves the file.

Next, step S07 in FIG. 8 will be described with reference to FIG.
Step S0701: The file location information update unit 0405 creates a shell entry of file movement tracking information in the temporary area, acquires the current date and time, and registers it in the entry T040601 of the file movement tracking information.

  Step S0702: The file location information update unit 0405 registers the file ID T0401 of the file location information acquired in Step S0603 in the entry T040602 of the file movement tracking information on the temporary area.

  Step S0703: The file location information update unit 0405 registers the file name T0403 of the file location information acquired in step S0603 in the entry T040603 of the file movement tracking information on the temporary area.

  Step S0704: The file location information update unit 0405 registers the revision T0402 of the file location information acquired in step S0603 in the entry T040604 of the file movement tracking information on the temporary area.

  Step S0705: The file position information update unit 0405 searches whether the file IDT040602 of the file movement tracking information on the temporary area is recorded in the file IDDB0407. If it is registered as a result of the search, the process advances to step S0706. If not registered, the process proceeds to step S0707.

  Step S0706: The file location information update unit 0405 increments the value of the revision T040702 corresponding to the file ID T040701 searched from the file ID DB 0407 in step S0705 and records it in T040702, and stores the increased revision T040702 on the temporary area. A step of registering in the entry T040604 of the file movement tracking information. After execution of this step, the process proceeds to step S0708.

  Step S0707: The file location information update unit 0405 generates a new file ID and registers it in the entry T040603 of the file movement tracking information on the temporary area, and the entry T040604 of the file movement tracking information on the temporary area has an initial value of revision 0. The step of registering. After execution of this step, the process proceeds to step S0708.

  Step S0708: The file position information update unit 0405 registers the file name T0302 in the file write event acquired in Step S06 in the entry T040605 of the file movement tracking information on the temporary area.

  Step S0709: A step of registering the file movement tracking information on the temporary area created by the file position information updating unit 0405 through steps S0701 to S0705 in the file movement tracking information DB 0406.

  When all the above steps are executed, the file movement tracking information DB 0406 records the file name T040603 of the file movement source and the file name T040605 of the movement destination, and can track that the file has been moved.

  Next, specific examples of the document file movement tracking system, the document file movement tracking apparatus, the document file movement tracking method, and the program described above will be described. First, the configuration of the present embodiment will be described with reference to FIG.

  As shown in FIG. 9, a computer 0201 and a computer 0202 are connected via a network 01, and each computer executes a predetermined process under the control of a file transfer program 03. A movement tracking method is executed. A file 0501 (“C: \ doc \ abc.doc”) exists in the computer 0201, and the file 0501 is transferred to the computer 0202 by the file transfer program 03. In the computer 0202, the transferred file 0501 is received by the file transfer program 03 and stored as a file 0502 (“D: \ proj \ xyz.doc”).

First, the operation of the transfer source will be described with reference to FIG.
Step S01: The user tries to transfer the file 0501 using the file transfer program 03. The file transfer program 03 reads the entire document file 0501 selected by the user and tries to transfer the read data to the transfer destination computer 0202 designated by the user. The file transfer program 03 is unaware of the document file movement tracking unit 04 while it is operating. The file transfer program 03 operates asynchronously with the document file movement tracking unit 04.

  Step S02: The file access monitoring unit 0401 detects a file reading start event of the file 0501 generated by the file transfer program 03. The detected event is shown in FIG. The file access monitoring unit 0401 acquires from T1402 the file name (“C: \ doc \ abc.doc”) of the file 0501 that the file transfer program 03 tried to read.

  Step S03: Since the event type T1401 detected by the file access monitoring unit 0401 is a file reading start event, the process branches to step S04. The file access monitoring means passes the file name T1402 of the file 0501 to the file position information adding means 0402.

  Step S04: Before the file transfer program 03 reads the file 0501, the file position information adding unit 0402 searches the file movement tracking information DB 0406 for the file movement tracking information of the file to be read. FIG. 16 shows the file movement tracking information discovered as a result of the search. File position information (FIG. 17) is created based on the found file movement tracking information, and the created file position information is added to the file.

Next, details of step S04 will be described with reference to FIG.
Step S0401: The file location information adding unit 0402 uses the file name T1402 ("C: \ doc \ abc.doc") passed from the file access monitoring unit 0401 (FIG. 15). ) Is searched for file movement tracking information in which the transfer destination file name T1505 and the file name T1402 match. As a result of the search, a matching file movement tracking information is found. The found file movement tracking information is shown in FIG.

  Step S0402: Since file movement tracking information matching the search condition is found in step S0401, the process proceeds to step S0403.

  Step S0403: File position information is generated from the file movement tracking information found in step S0401 (FIG. 16). FIG. 17 shows the generated file position information. The file ID T040602 of the file movement tracking information is stored in T1701, and the revision T040604 is stored in T1702. A computer name (“0201”) is added to the head of the file name T040605 and stored in T1703. A predetermined magic number (“Magic Number Tail Info”) is stored in T1704.

  Step S0404: The file position information shown in FIG. 17 is added to the file indicated by the file name T1402 (“C: \ doc \ abc.doc”). In this embodiment, file position information is added to the file as shown in FIG.

  When the above processing is completed, the event preemption interrupt by the file access monitoring unit 0401 is terminated, and the process returns to step S01.

  Step S01: The file transfer program 03 completes reading of the file 0501.

  Step S02: The file access monitoring unit 0401 detects a file reading end event of the file 0501 generated by the file transfer program 03. The detected event is shown in FIG. The file name (“C: \ doc \ abc.doc”) of the file 0501 to be read is acquired from T1802.

  Step S03: Since the event type T1801 detected by the file access monitoring unit 0401 is a file reading end event, the process branches to step S05. The file access monitoring means passes the file name T1802 of the file 0501 to the file position information deleting means 0403.

  Step S05: After the file transfer program 03 reads the file 0501, the file position information deleting unit 0403 deletes the file position information in the file.

Next, details of step S05 will be described with reference to FIG.
Step S0501: The file location information deleting unit 0403 searches the file location information from the file indicated by the file name T1402 ("C: \ doc \ abc.doc") passed from the file access monitoring unit 0401. As a result of the search, matching file position information (FIG. 17) is found.

  Step S0502: Since the file position information is found by searching the file position information in step S0501, the process proceeds to step S0503.

  Step S0503: The file position information deleting unit 0403 deletes the file position information from the file indicated by the file name T1402.

  When the above processing is completed, the event preemption interrupt by the file access monitoring unit 0401 is terminated, and the process returns to step S01.

  Step S01: The file transfer program 03 transmits the data read from the file 0501 to the computer 0202.

  Thus, all file transfer operations at the transfer source are executed.

Next, the operation at the transfer destination will be described with reference to FIG.
Step S01: The file transfer program 03 receives data from the computer 0201 and stores the data as a file 0502.

  Step S02: The file access monitoring means 0401 detects a file write end event of the file 0502 generated by the file transfer program 03. The detected event is shown in FIG. Also, the file name of the file 0502 that has been written is acquired.

  Step S03: Since the event type T1901 detected by the file access monitoring unit 0401 is a file write end event, the process branches to step S06. The file access monitoring means passes the file name T 1902 (“D: \ proj \ xyz.doc”) of the file 0502 to the file position information reading means 0404.

  Step S06: After the file transfer program 03 has written the file 0502 ("D: \ proj \ xyz.doc"), the file position information reading means 0404 reads the file position information (FIG. 17) in the file and stores it temporarily. Delete location information. After completion of this step, the process proceeds to step S07.

Next, details of step S06 will be described with reference to FIG.
Step S0601: The file location information reading unit 0404 searches the file location information from the file 0502 indicated by the file name T1902 ("D: \ proj \ xyz.doc") passed from the file access monitoring unit 0401. As a result of the search, matching file position information (FIG. 17) is found.

  Step S0602: Since the file position information is found by the search result of the file position information in Step S0601, the process proceeds to Step S0603.

  Step S0603: The file position information reading means 0404 reads the file position information (FIG. 17) in the file 0502 indicated by the file name T1902 (“D: \ proj \ xyz.doc”) and stores it in the temporary area.

  Step S0604: The file position information reading unit 0404 deletes the file position information found in step S0601 from the file 0502 indicated by the file name T1902, and overwrites the file. When the above process ends, the process proceeds to step S07.

  Step S07: The file position information update unit 0406 records the file position information stored in the temporary area in step S0603 in the file position information DB 0407. When this process ends, the event preemption interrupt by the file access monitoring unit 0401 ends, and the process returns to step S01.

Next, step S07 will be described with reference to FIG.
Step S0701: The file location information update unit 0405 creates an empty entry of file movement tracking information in the temporary area. The created entry is shown in FIG. The current date and time is registered in the entry T2001 of the created file movement tracking information.

  Step S0702: The file position information update unit 0405 registers the file ID T1701 of the file position information acquired in step S0603 in the entry T2002 of the file movement tracking information on the temporary area.

  Step S0703: File movement tracking on the temporary area is performed with the file name T0403 ("\\ 0201 \ C: \ doc \ abc.doc") of the file position information (FIG. 17) acquired by the file position information update unit 0405 in step S0603. Information is registered in the entry T2003.

  Step S0704: The file position information update unit 0405 registers the revision T1702 (“1”) of the file position information acquired in step S0603 in the entry T2004 of the file movement tracking information on the temporary area.

  Step S0705: The file position information update unit 0405 searches whether the file IDT 2002 of the file movement tracking information on the temporary area is recorded in the file ID DB 0407. In this embodiment, since the search result is not registered, the process proceeds to step S0707.

  Step S0707: The file location information update unit 0405 generates a new file ID ("EEEE-FFFF-GGGG-HHHH"), registers it in the entry T040603 of the file movement tracking information on the temporary area, and file movement tracking information on the temporary area. Registering “0”, which is the initial value of the revision, in the entry T2004. After execution of this step, the process proceeds to step S0708.

  Step S0708: The file position information update unit 0405 registers the file name T1902 ("D: \ proj \ xyz.doc") in the file write event acquired in step S06 in the entry T2005 of the file movement tracking information on the temporary area. .

  Step S0709: The file position tracking information update unit 0405 registers the file movement tracking information (FIG. 20) on the temporary area created through steps S0701 to S0705 in the file movement tracking information DB 0406.

  All the file reception operations at the transfer destination are executed as described above, and the file move tracking information DB 0406 records the file move source file name T2003 and the move destination file name T2005, and the file "\\ 0201 \ C : \ doc \ abc.doc "can be traced to" D: \ proj \ xyz.doc ".

  As mentioned above, although the Example of this invention was described, it is not limited to the said Example, A various deformation | transformation is possible in the range which does not deviate from the summary.

  INDUSTRIAL APPLICABILITY According to the present invention, the present invention can be applied to the use of monitoring the distribution route of each document in a usage form in which electronic documents are distributed using various file transfer programs in a network environment connected to a personal computer. Monitoring the distribution route of documents in this way is as basic data for (1) suppressing information leakage by employees with low morals, and (2) narrowing down suspects from monitoring results in the event of a leak. Is available.

It is a block diagram which shows the structure of the document file movement tracking apparatus which is embodiment of this invention. It is a block diagram which shows the structure of the document file movement tracking system which is embodiment of this invention. It is a figure which shows the example of the event information which generate | occur | produces at the time of file access. It is a figure which shows the example of file position information. It is a figure which shows the addition image of file position information. It is a figure which shows the deletion image of file position information. It is a figure which shows the example of the file movement tracking information produced by the file position information update means 0405. It is a flowchart which shows the document file movement tracking method which is embodiment of this invention. It is a figure which shows the example of the whole structure for demonstrating the specific Example of this invention. It is a flowchart which shows the process in S04. It is a flowchart which shows the process in S05. It is a flowchart which shows the process in S06. It is a flowchart which shows the process in S06. It is a figure which shows the example of the event information which generate | occur | produces at the time of a file reading start. It is a figure which shows the example of file movement tracking information DB. It is a figure which shows the example of file movement tracking information. It is a figure which shows the example of file position information. It is a figure which shows the example of the event information which generate | occur | produces at the time of completion | finish of file reading. It is a figure which shows the example of the event information which generate | occur | produces at the time of completion | finish of file writing. It is a figure which shows the example of file movement tracking information. It is a figure which shows the example of file IDDB.

Explanation of symbols

01 network 02 computer 03 file transfer program 04 document file movement tracking unit 0401 file access monitoring unit 0402 file position information adding unit 0403 file position information deleting unit 0404 file position information reading unit 0405 file position information updating unit 0406 file movement tracking information DB ( Database)
T0301 Event type field in event information T0302 File name field in event information T0401 File ID field in file position information T0402 Revision field in file position information T0403 Absolute path field in file position information T0404 Magic number field in file position information 0501 File 0502 File position Information 0601 File 0602 File position information T040601 Date and time field in file movement tracking information T040602 File ID field in file movement tracking information T040603 Transfer source absolute path field in file movement tracking information T040604 Transfer destination revision in file movement tracking information Field T040605 Transfer destination absolute path field in file movement tracking information S01 File access program 03 file access step S02 File access monitoring means 0401 file access event detection step S03 File access monitoring means 0401 detection event type determination step S04 File location information addition File position information adding step of means 0402 S05 File position information deleting step of file position information deleting means 0403 S06 File position information reading and deleting step of file position information reading means 0404 S07 File position information recording step of file position information updating means 0405 S0401 S04 file movement tracking information retrieval step S0402 S04 file movement tracking information Presence determination step S0403 S04 File position information generation step S0404 S04 File position information addition step S0501 S05 file position information search step S0502 S05 file position information presence / absence determination step S0503 S05 file position information deletion step S0601 S06 file position information search Step S0602 S06 file location information presence / absence determination step S0603 S06 file location information reading step S0604 S06 file location information deletion step S0701 Date and time registration to file migration tracking information in S07 S0702 File ID to file migration tracking information in S07 Registration step S0703 Transfer source absolute path registration step to file movement tracking information in S07 S0704 S0 Transfer destination revision registration step to file movement tracking information in step S0705 Transfer destination absolute path registration step to file movement tracking information in step S07 T1401 Event type field in event information T1402 File name field in event information T1501 Date field in file movement tracking information T1502 File ID field in file movement tracking information T1503 Transfer source absolute path field in file movement tracking information T1504 Transfer destination revision field in file movement tracking information T1505 Transfer destination absolute path field in file movement tracking information T1601 Date field in file movement tracking information T1602 File File ID field T1603 file in the movement tracking information Transfer source absolute path field in file movement tracking information T1604 Transfer destination revision field in file movement tracking information T1605 Transfer destination absolute path field in file movement tracking information T1701 File ID field in file position information T1702 Revision field in file position information T1703 File position information Absolute path field in T1704 Magic number field in file position information T1801 Event type field in event information T1802 File name field in event information T1901 Event type field in event information T1902 File name field in event information T2001 Date / time field in file movement tracking information 2002 File ID field in file movement tracking information T2003 Transfer source absolute path field in file movement tracking information T2004 Transfer destination revision field in file movement tracking information T2005 Transfer destination absolute path field in file movement tracking information T040701 File ID field in file IDDB T040702 file Revision field in IDDB

Claims (19)

A document file movement tracking device for sending and receiving document files between networks,
A document file movement tracking device that detects a movement of a document file between networks by associating the positions of the document file at a transfer source and a transfer destination. File access monitoring means for detecting access to a predetermined document file by a file transfer program and determining the type of the detected access;
If the access is a file read start, file position information adding means for adding file position information to the document file to be accessed;
If the access is a file reading end, file position information deleting means for deleting the file position information added to the document file to be accessed;
A file position information reading means for deleting the file position information after reading and temporarily storing the file position information attached to the document file to be accessed when the access is a file writing end;
File position information updating means for creating file movement tracking information indicating the storage position of the document file read by the file position information reading means;
File movement tracking information recording means for recording the file movement tracking information created by the file position information updating means;
The document file movement tracking apparatus according to claim 1, further comprising:   3. The document file movement tracking according to claim 2, wherein the file position information includes an absolute path of the document file and a file ID added to the document file for identifying the document file. apparatus.   4. The document file movement tracking apparatus according to claim 3, wherein the file position information includes a revision indicating that a document file having the same file ID is duplicated.   The file movement tracking information recording unit stores the date and time, the file ID, a transfer source absolute path, a transfer destination revision, and a transfer destination absolute path in association with each other. 5. The document file movement tracking device according to any one of 2 to 4. File ID recording means for recording the file ID;
6. The file ID recording unit according to claim 2, wherein the file ID recording unit newly creates the file ID and updates the revision based on a correspondence table between the file ID and the revision. Document file movement tracking device described.   A document file movement tracking system, wherein the document file movement tracking apparatus according to claim 1 is connected via a network. A document file tracking method performed by a document file movement tracking device that transmits and receives document files between networks,
A document file movement tracking method characterized by detecting movement of a document file between networks by associating the positions of the document file at the transfer source and the transfer destination. A file access monitoring step of detecting access to a predetermined document file by a file transfer program and determining the type of the detected access;
If the access is a file reading start, a file location information adding step for adding file location information to the document file to be accessed;
If the access is a file reading end, a file position information deletion step for deleting file position information added to the document file to be accessed;
If the access is a file write end, the file position information read step for deleting the file position information after reading and temporarily storing the file position information attached to the document file to be accessed;
A file position information update step for creating file movement tracking information indicating a storage position of the document file read in the file position information reading step;
A file movement tracking information recording step for recording the file movement tracking information created in the file position information update step;
9. The document file movement tracking method according to claim 8, further comprising:   The document file movement tracking according to claim 9, wherein the file position information includes an absolute path of the document file and a file ID added to the document file for identifying the document file. Method.   11. The document file movement tracking method according to claim 10, wherein the file position information includes a revision indicating that a document file having the same file ID is duplicated.   The file movement tracking information recording step stores the date and time, the file ID, a transfer source absolute path, a transfer destination revision, and a transfer destination absolute path in association with each other. The document file movement tracking method according to any one of 9 to 11. A file ID recording step for recording the file ID;
13. The file ID recording step according to claim 9, wherein the file ID is newly created and the revision is updated based on a correspondence table between the file ID and the revision. Document file movement tracking method described. A program that causes a document file movement tracking device that transmits and receives document files between networks to execute a document file tracking method,
A program that causes a document file movement tracking apparatus to execute processing for detecting movement of a document file between networks by associating the positions of the document file at the transfer source and the transfer destination. A file access monitoring process for detecting access to a predetermined document file by a file transfer program and determining the type of the detected access;
If the access is a file read start, file location information addition processing for adding file location information to the document file to be accessed;
When the access is a file reading end, a file position information deletion process for deleting file position information added to the document file to be accessed;
If the access is a file write end, file position information read processing for deleting the file position information after reading and temporarily storing the file position information added to the document file to be accessed;
A file position information update process for creating file movement tracking information indicating a storage position of the document file read in the file position information read process;
A file movement tracking information recording process for recording the file movement tracking information created in the file position information update process;
15. The program according to claim 14, wherein the document file movement tracking device is executed.   16. The program according to claim 15, wherein the file position information includes an absolute path of the document file and a file ID added to the document file for identifying the document file.   The program according to claim 16, wherein the file position information includes a revision indicating that a document file having the same file ID is copied.   The file movement tracking information recording process stores the date and time, the file ID, a transfer source absolute path, a transfer destination revision, and a transfer destination absolute path in association with each other. The program according to any one of 15 to 17.   19. The document file movement tracking apparatus according to claim 15, further comprising: causing the document file movement tracking apparatus to execute a process for newly creating the file ID and an update process for the revision based on a correspondence table between the file ID and the revision. The program described in the section.

Images