JP2007193826A - Data control device, data control and processing method, and computer readable recording medium with program recorded to make computer execute the same method - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To control access right to data properly and efficiently in a data control device which determines whether access is possible to an object which is hierarchically stored based on the access right information for each of the stored objects. <P>SOLUTION: A data control device comprises: an access right information setting part 301 that sets access right information only for the object (cabinet) 310 stored in the highest layer of the stored objects 300; a reference part 302 that refers to the access right information set in the cabinet 301 when there is an access request to the objects (a folder 320, a document 330, a section 340) for which access right information is not set, other than the cabinet 310; and an access determination part 303 that determines whether access is to be permitted to the objects 320, 330 and 340 for which access right information is not set based on the access right information referred to. <P>COPYRIGHT: (C)2007,JPO&INPIT

Description

  The present invention relates to a data management apparatus and data management for hierarchically storing data registered in a predetermined format as objects and determining whether or not each stored object can be accessed based on access right information. The present invention relates to a method and a computer-readable recording medium recording a program for causing a computer to execute the method.

  In a data management apparatus such as a conventional document filing system, data is stored as an object according to a predetermined rule as a hierarchical structure in order to efficiently search and use the data. At that time, information about the access right to access the data (object) is set for each object.

  However, in the conventional data management apparatus, access right information must be added to all data (objects) when registering data. As the number of objects increases, the efficiency of data registration increases. There was a problem that could not be planned.

  In addition, each time data (object) is copied / moved to another system, access information must be updated or newly created, and the efficiency of data copying / moving processing cannot be improved. there were.

  The present invention eliminates the problems caused by the above-described conventional example, a data management apparatus, a data management method, and a program for causing a computer to execute the data management apparatus capable of appropriately and efficiently managing access rights to data. It is an object of the present invention to provide a computer-readable recording medium on which is recorded.

  In order to solve the above-described problems and achieve the object, the data management device according to the invention of claim 1 hierarchically stores data registered in a predetermined format as an object and accesses each stored object. In the data management apparatus for determining whether or not access to the object is possible based on the right information, access right information setting means for setting the access right information only to an object stored in the highest hierarchy among the stored objects; When there is an access request for an access right information non-setting object other than the object stored in the highest hierarchy, the access right information set in the object stored in the highest hierarchy by the access right information setting means Reference means to refer to and access right information referred to by the reference means Based characterized by comprising a an access determination means for determining whether access to the access right information unset objects.

  According to the first aspect of the present invention, it is possible to manage access rights without setting access right information for each object belonging to the object, by setting only one access right information for an object stored in the highest hierarchy. Can be done.

  The data management apparatus according to the invention of claim 2 hierarchically stores data registered in a predetermined format as an object, and stores each object stored in the object based on access right information. In the data management apparatus that determines whether access is permitted, an access right information setting unit that sets access right information for an arbitrary object among stored objects, and an access request is set by the access right information setting unit. Discriminating means for discriminating whether the access right information has been set for the access right information setting object or whether the access right is set for the access right information non-set object other than the access right information setting object set by the access right information setting means; As a result of discrimination by the discrimination means, When there is an access request for the access right information setting object, a first access determination unit that determines whether or not access is possible based on the access right information; Refers to access right information set in the access right information setting object stored in a higher hierarchy relative to the hierarchy in which the access right information non-setting object is stored when there is an access request to Means, and second access determining means for determining whether or not access to the access right information non-setting object is possible based on the access right information referred to by the reference means.

  According to the invention of the second embodiment, the access right can be inherited to an object stored in a relatively lower hierarchy of the arbitrary object only by setting the access right information for the arbitrary object.

  According to a third aspect of the present invention, in the data management apparatus according to the second aspect, the second access determination means stores an access right information setting object in which the access right information referred to by the reference means is set. Access right conversion means for converting the access right information based on the hierarchy in which the access right information non-setting object is stored, and based on the access right information converted by the access right conversion means Whether to access the access right information non-setting object is determined.

  According to the invention of claim 3, the trouble of changing the authority content of the access right information associated with the different layers can be omitted.

  According to a fourth aspect of the present invention, there is provided the data management device according to the third aspect, wherein the access right conversion means does not exceed an access right in a hierarchy in which the access right information setting object is stored. The access right is converted so that the access authority in the hierarchy in which the access right information non-setting object is stored is wider than the access authority in the hierarchy in which the access right information setting object is stored. .

  According to the invention of claim 4, since the authority content of the access right information is changed and applied within a range not exceeding the authority content of the access right information set for the object stored in the relatively higher hierarchy, There is no contradiction in the authority contents of access right information.

  The data management apparatus according to the invention of claim 5 hierarchically stores data registered in a predetermined format as an object, and accesses each object stored on the basis of access right information. In the data management apparatus for determining whether or not to permit, in copy / move means for copying or moving any of the stored objects to another object, and access right information of the object copied or moved by the copy / move means A determination unit that determines whether or not the information about the user is valid in the copy / destination object; and, as a result of the determination by the determination unit, if the information about the user is valid in the copy / destination object, Access rights information for the user And additional means for adding the access information to access right information of the copy / move the object, characterized by comprising a.

  According to the fifth aspect of the invention, when copying / moving an object, the access right information of the copy / move source can be utilized, so that the setting / change of the access right information accompanying the copy / move can be performed efficiently. Can do.

  The data management device according to the invention of claim 6 hierarchically stores data registered in a predetermined format as an object, and accesses each object stored on the basis of access right information. In the data management apparatus for determining whether or not to permit, in copy / move means for copying or moving any of the stored objects to another object, and access right information of the object copied or moved by the copy / move means A determination unit that determines whether or not the information about the user is valid for the copy / destination object; and, as a result of the determination by the determination unit, the information about the user includes information that is not valid for the copy / destination object And a warning means for giving a warning. It is characterized in.

  According to the invention of claim 6, when copying / moving an object, the access right information of the copy / move source can be utilized, and addition of access right information not managed at the copy / move destination is prevented. can do.

  Further, the data management device according to the invention of claim 7 is characterized in that, in the invention of claim 6, further comprising a display means for displaying the contents of warning cancellation processing for eliminating the warning with respect to the warning. To do.

  According to the seventh aspect of the invention, when copying / moving an object, the access right information of the copy / move source can be used, and the access right information can be efficiently changed along with the copy / move. it can.

  Further, the data management method according to the invention of claim 8 hierarchically stores data registered in a predetermined format as an object, and accesses each object stored on the basis of access right information. In the data management method for determining availability, an access right information setting step for setting access right information only to an object stored in the highest hierarchy among stored objects, and an access other than the object stored in the highest hierarchy When there is an access request for the right information non-set object, a reference step for referring to the access right information set in the object stored in the highest hierarchy by the access right information setting step, and a reference by the reference step The access right information non-setting option based on the access right information provided. Characterized in that contains an access determining step of determining whether access to the object, the.

  According to the invention of claim 8, it is possible to manage access rights without setting access right information for each object belonging to the object, by setting only one access right information for an object stored in the highest hierarchy. Can be done.

  Further, the data management method according to the invention of claim 9 hierarchically stores data registered in a predetermined format as an object, and accesses each object stored on the basis of access right information. In the data management method for determining availability, an access right information setting step for setting access right information to an arbitrary object among stored objects, and an access request for which access right is set by the access right information setting step A determination step for determining whether the access right information setting object has been set or an access right information non-set object other than the access right information setting object for which the access right has been set by the access right information setting step; As a result of discrimination by the process, A first access determination step for determining whether or not access is possible based on the access right information when there is an access request to the access right information setting object; Refers to access right information set in the access right information setting object stored in a higher hierarchy relative to the hierarchy in which the access right information non-setting object is stored when there is an access request to And a second access determination step of determining whether or not access to the access right information non-setting object is made based on the access right information referred to by the reference step.

  According to the ninth aspect of the present invention, the access right can be inherited to an object stored in a relatively lower hierarchy of the arbitrary object only by setting the access right information for the arbitrary object.

  According to a tenth aspect of the present invention, in the data management method according to the ninth aspect of the present invention, the second access right determination step includes an access right information setting object in which the access right information referred to in the reference step is set. An access right conversion step of converting the access right information based on the stored hierarchy and the hierarchy in which the access right information non-setting object is stored, and based on the access right information converted by the access right conversion step Determining whether or not access to the access right information non-setting object is possible.

  According to the invention of claim 10, it is possible to omit the trouble of changing the authority content of the access right information associated with the different layers.

  The data management method according to the invention of claim 11 is the data management method according to claim 10, wherein the access right conversion step does not exceed the access authority in the hierarchy in which the access right information setting object is stored. The access right is converted so that the access authority in the hierarchy in which the access right information non-setting object is stored is wider than the access authority in the hierarchy in which the access right information setting object is stored. .

  According to the invention of claim 11, since the authority content of the access right information is changed and applied within a range not exceeding the authority content of the access right information set for the object stored in the relatively higher hierarchy, There is no contradiction in the authority contents of access right information.

  The data management method according to the invention of claim 12 hierarchically stores data registered in a predetermined format as an object, and accesses each object stored on the basis of access right information. In a data management method for determining availability, when copying or moving any of stored objects to another object, information on the user in the access right information of the copied or moved object is copied / moved object A determination step for determining whether or not the information on the user is valid in the copy / move destination object by the determination step, and an access right for the user in the access right information Copy / move information Characterized in that including the additional step of adding to the access right information-object, the.

  According to the twelfth aspect of the present invention, when copying / moving an object, the access right information of the copy / move source can be used, so that the setting / change of the access right information accompanying the copy / move can be performed efficiently. Can do.

  According to a thirteenth aspect of the present invention, there is provided a data management method that hierarchically stores data registered in a predetermined format as an object, and accesses each object stored on the basis of access right information. In a data management method for determining availability, when copying or moving any of stored objects to another object, information on the user in the access right information of the copied or moved object is copied / moved object A determination step for determining whether the information is valid or not, and a warning step for giving a warning when it is determined by the determination step that information relating to the user includes information that is not valid for the copy / destination object. It is characterized by including.

  According to the invention of claim 13, when copying / moving an object, the access right information of the copy / move source can be utilized, and addition of access right information not managed at the copy / move destination is prevented. can do.

  According to a fourteenth aspect of the present invention, there is provided a data management method according to the thirteenth aspect of the present invention, further comprising: a display step of displaying the contents of warning cancellation processing for eliminating the warning in response to the warning performed by the warning step. It is characterized by including.

  According to the fourteenth aspect of the present invention, when copying / moving an object, the access right information of the copy / move source can be utilized, and the access right information associated with the copy / move can be efficiently changed. it can.

  Further, the recording medium according to the invention of claim 15 records the program for causing a computer to execute the method described in claims 8 to 14, so that the program can be read by a machine. The 14 operations can be realized by a computer.

  As described above, according to the invention of claim 1, the access right information setting means sets the access right information only for the objects stored in the highest hierarchy among the stored objects, and the reference means When there is an access request for an access right information non-setting object other than the object stored in the highest hierarchy, the access right information set in the object stored in the highest hierarchy by the access right information setting means The access determining unit determines whether to access the access right information non-set object based on the access right information referred to by the reference unit, and thus accesses one object stored in the highest hierarchy. Just set the right information, set access right information for each object belonging to the object Without Rukoto, it is possible to manage the access rights, thereby, an effect that the management of access to data properly and efficiently the data management apparatus capable of performing obtained.

  According to the invention of claim 2, the access right information setting means sets the access right information for an arbitrary object among the stored objects, and the determination means has the access request as the access right information setting. Whether the access right was set for the access right information setting object set by the access right or the access right information non-set object other than the access right information setting object set for the access right by the access right information setting means The first access determining means determines whether or not access is possible based on the access right information when there is an access request for the access right information setting object as a result of the determination by the determining means, Means for determining whether the access right information is not set as a result of the determination by the determining means. When there is an access request to an object, the access right information set in the access right information setting object stored in the upper hierarchy relative to the hierarchy in which the access right information non-setting object is stored is referred to. Since the second access determining means determines whether or not the access right information non-setting object is accessible based on the access right information referred to by the referring means, it is only necessary to set the access right information for an arbitrary object. A data management apparatus capable of inheriting access rights to an object stored in a relatively lower hierarchy of the arbitrary object, thereby enabling appropriate and efficient management of access rights to data The effect that is obtained.

  According to the invention of claim 3, in the invention of claim 2, the second access determination means stores an access right information setting object in which the access right information referred to by the reference means is set. Access right conversion means for converting the access right information based on a hierarchy and a hierarchy in which the access right information non-setting object is stored, and the access right based on the access right information converted by the access right conversion means Since it determines whether or not access to the information non-setting object is possible, it is possible to save the trouble of changing the authority content of the access right information due to different hierarchies, thereby managing the access right to the data. There is an effect that a data management device that can be appropriately and efficiently performed is obtained.

  According to a fourth aspect of the present invention, in the third aspect of the invention, the access right conversion means does not exceed the access right in the hierarchy in which the access right information setting object is stored. Since the access right is converted so that the access right in the hierarchy in which the non-set object is stored is wider than the access right in the hierarchy in which the access right information setting object is stored, the access right between the hierarchies There is no contradiction in the authority content of the information, and there is an effect that a data management apparatus capable of appropriately and efficiently managing the access right to the data can be obtained.

  According to the invention of claim 5, the copying / moving means copies or moves an arbitrary object among the stored objects to another object, and the judging means is copied or moved by the copying / moving means. The information on the user in the access right information of the object to be copied is determined whether it is valid for the copy / move destination object, and the adding means determines that the information on the user is the copy / move destination object as a result of the determination by the determination means. When the object is copied / moved by adding the access right information for the user among the access right information to the access right information of the copy / move destination object, the access right of the copy / move source Information can be used, so access right information when copying / moving Set / change can be performed efficiently, thereby, an effect that the management of access to data properly and efficiently the data management apparatus capable of performing obtained.

  According to the sixth aspect of the present invention, the copying / moving means copies or moves any of the stored objects to another object, and the judging means is copied or moved by the copying / moving means. The information on the user in the access right information of the object to be copied is determined whether it is valid in the copy / move destination object, and the warning means determines that the information on the user is included in the information on the copy / move destination When information that is not valid is included, a warning is issued. Therefore, when copying / moving an object, the access right information of the copy / move source can be used, and access not managed at the copy / move destination Right information can be prevented, so that the right to manage access to data An effect that efficient data management apparatus capable of performing can be obtained.

  According to the invention of claim 7, in the invention of claim 6, the display means displays the contents of the warning elimination processing for eliminating the warning with respect to the warning, so when copying / moving the object, The access right information of the copy / move source can be used, and the access right information can be efficiently changed along with the copy / move, thereby appropriately and efficiently managing the access right to the data. There is an effect that a data management device capable of performing the above is obtained.

  According to the invention of claim 8, the access right information setting step sets the access right information only for the objects stored in the highest hierarchy among the stored objects, and the reference step in the highest hierarchy. When there is an access request for an access right information non-set object other than the stored object, the access right information is set by referring to the access right information set in the object stored in the highest hierarchy in the access right information setting step. Since the determining step determines whether or not the access right information non-setting object is accessible based on the access right information referred to in the reference step, one access right information is set for the object stored in the highest hierarchy. Without setting access right information for each object belonging to the object, You can manage permissions, thereby, an effect that the data management method capable of managing the access to the data properly and efficiently is obtained.

  According to the invention of claim 9, the access right information setting step sets the access right information to an arbitrary object among the stored objects, and the determination step is performed by the access right information setting step. Determine whether the access right was set for the access right information setting object set, or whether the access right was set for an access right information non-set object other than the access right information set object set by the access right information setting step. The first access determination step determines whether or not access is possible based on the access right information when there is an access request to the access right information setting object as a result of the determination in the determination step. As a result of determination by the determination step, the access right information non-set object The access right information set in the access right information setting object stored in the higher hierarchy relative to the hierarchy in which the access right information non-setting object is stored, Since the second access determination step determines whether or not to access the access right information non-setting object based on the access right information referred to by the reference step, it is only necessary to set the access right information for an arbitrary object. There is provided a data management method capable of inheriting access rights to an object stored in a relative lower hierarchy of the arbitrary object, and appropriately and efficiently managing access rights to data. The effect is obtained.

  According to the invention of claim 10, in the invention of claim 9, the second access right determination step stores an access right information setting object in which the access right information referred to by the reference step is set. And an access right conversion step for converting the access right information based on the layer in which the access right information non-setting object is stored, and the access right based on the access right information converted by the access right conversion step. Since it determines whether or not access to the rights information non-setting object is possible, it is possible to save time and effort to change the authority contents of the access rights information associated with different hierarchies, thereby managing the access rights to the data There is an effect that a data management method capable of appropriately and efficiently performing the above is obtained.

  According to an eleventh aspect of the present invention, in the tenth aspect of the present invention, the access right information is within a range in which the access right conversion step does not exceed an access right in a hierarchy in which the access right information setting object is stored. Since the access right is converted so that the access authority in the hierarchy in which the non-setting object is stored is wider than the access authority in the hierarchy in which the access right information setting object is stored, Since the authority content of the access right information is changed and applied within the range not exceeding the authority content of the access right information set for the stored object, the authority content of the access right information between the hierarchies will not conflict. This makes it possible to manage data access rights appropriately and efficiently. How an effect that can be obtained.

  According to the twelfth aspect of the present invention, when the determining step copies or moves an arbitrary object among the stored objects to another object, the information about the user in the access right information of the copied or moved object is obtained. It is determined whether or not the copy / move destination object is valid, and when the adding unit determines that the information about the user is valid in the copy / move destination object in the determination step, the access right information By adding the access right information for the user to the access right information of the copy / move destination object, the copy / move source access right information can be used when copying / moving the object. / Efficiently setting / changing access rights information when moving It can be, thereby, an effect that the data management method capable of managing the access to the data properly and efficiently is obtained.

  According to the invention of claim 13, when the determining step copies or moves an arbitrary object among the stored objects to another object, the information related to the user in the access right information of the copied or moved object is obtained. It is determined whether or not the copy / move destination object is valid, and a warning process is performed when it is determined by the determination process that the information related to the user includes information that is not valid in the copy / move destination object. Therefore, when copying / moving an object, the access right information of the copy / move source can be used, and addition of access right information not managed at the copy / move destination can be prevented. As a result, data that enables appropriate and efficient management of access rights to data An effect that physical methods are obtained.

  According to the invention of claim 14, in the invention of claim 13, the display step further displays the contents of the warning cancellation processing for eliminating the warning in response to the warning made by the warning step. When copying / moving an object, the access right information of the copy / move source can be used, and the access right information can be efficiently changed along with the copy / move. There is an effect that a data management method capable of appropriately and efficiently managing access rights is obtained.

  According to the invention of claim 15, by recording a program that causes a computer to execute the method described in claims 8 to 14, the program can be read by a machine. There is an effect that a recording medium whose operation can be realized by a computer can be obtained.

  Exemplary embodiments of a data management device, a data management method, and a computer-readable recording medium recording a program for causing a computer to execute the method will be described below in detail with reference to the accompanying drawings.

(Embodiment 1)
First, the hardware configuration of a networked data management system including the data management apparatus according to the first embodiment will be described. FIG. 1 is a block diagram showing a system configuration of a data management system including a data management apparatus according to Embodiment 1 of the present invention.

  In FIG. 1, reference numeral 101 denotes a network server, and reference numeral 102 denotes a network terminal device (personal computer) which is a client for the network server 101. Reference numeral 103 denotes a scanner for inputting a document, and reference numeral 104 denotes a printer for printing the document.

  The network server 101, personal computer 102, scanner 103, and printer 104 are each connected to the network 100, and documents input by the scanner 103 can be stored in the network server 101 or personal computer 102. A document created by the personal computer 102 can be printed by the printer 104, and the operations of the scanner 103 and the printer 104 can be monitored and controlled by operating the network server 101 and the personal computer 102.

  Next, the hardware configuration of the data management apparatus will be described. FIG. 2 is a block diagram showing a hardware configuration of the network server 101 in the data management system according to the first embodiment. The data management apparatus can be configured by the network server 101 or the personal computer 102 alone, or can be configured by the network server 101 and the personal computer 102 connected by the network 100.

  In the data management apparatus of FIG. 2, 201 is a CPU that controls the entire system, 202 is a ROM that stores a boot program, 203 is a RAM that is used as a work area of the CPU 201, and 204 is an HD that is controlled by the CPU 201. HDD (hard disk drive) that controls reading / writing of data with respect to (hard disk) 205, 205 for storing data written under the control of HDD 204, 206 for FD (floppy disk) 207 under the control of CPU 201 Reference numeral 207 denotes an FDD (floppy disk drive) that controls reading / writing of data, and detachable FD that stores data written by the control of the FDD 206.

  Reference numeral 208 denotes a display for displaying a window relating to data such as a document, an image, and function information including a cursor, an icon or a tool box. Reference numeral 209 denotes a network NET 100 connected to the network NET 100 via a communication line 210. Each interface (I / F) that controls the interface is shown.

  211 is a keyboard having a plurality of keys for inputting characters, numerical values, various instructions, and 212 is a cursor movement, range selection, window movement, size change, icon selection, movement, etc. The mouse to perform is shown. Reference numeral 213 denotes a bus for connecting the above-described units.

  Next, a functional configuration of the data management apparatus will be described. FIG. 3 is a functional block diagram functionally showing the configuration of the data management apparatus according to the first embodiment. In FIG. 3, the data management apparatus includes an access right information setting unit 301, a reference unit 302, and an access determination unit 303.

  The cabinet 310, the folder 320, the document (file) 330, the section (file) 340, etc. are each one object 300. These objects are stored hierarchically. That is, in FIG. 3, the cabinet 310 is stored in the highest hierarchy, the folder 320 is stored in the lower hierarchy, and the document (file) 330 is stored in the next hierarchy. A section (file) 340 is stored in the lower hierarchy. Accordingly, the hierarchical order is cabinet 310 → folder 320 → document (file) 330 → section (file) 340 in order from the top to the bottom.

  The cabinet 310 indicates a container (cabinet) for registering a document. The folder 320 shows a box for classifying documents. A document (file) 330 indicates a group of documents. A section (file) 340 indicates an image file or application file read by the scanner 103.

  The access right information setting unit 301 sets access right information (for example, access control list “ACL”) only to the object stored in the highest hierarchy among the stored objects, that is, the cabinet 310. The ACL is set individually for each user. The set ACL is stored in a predetermined area. Details of the ACL will be described later.

  When there is an access request to the access right information non-setting object other than the object (cabinet 310) stored in the highest hierarchy, that is, the folder 320, the document (file) 330, and the section (file), the reference unit 302 In addition, the access right information set unit 301 refers to the access right information set in the object (cabinet 310) stored in the highest hierarchy.

  The access determination unit 303 determines whether or not access to the access right information non-setting object (folder 320, document (file) 330 or section (file) 340) is permitted based on the access right information referred to by the reference unit 302.

  Note that the access right information setting unit 301, the reference unit 302, and the access determination unit 303 are described in programs recorded in a recording medium such as the ROM 202, the RAM 203, the hard disk (HD) 205, and the floppy disk (FD) 207, respectively. The function of each unit is realized by the CPU 201 or the like executing instruction processing according to the instruction.

  Next, the contents of objects stored hierarchically and the contents of access right information (ACL) will be described. FIG. 4 is an explanatory diagram showing the principle of data management of the data management apparatus according to the first embodiment. FIG. 5 is an explanatory diagram showing the contents of access right information (ACL) of the data management apparatus according to the first embodiment.

  In FIG. 4, the cabinet 401 stores a folder A 402 in the immediately lower hierarchy, and the folder A 402 stores a folder B 403 and a folder C 404 in the lower hierarchy. In the folder B403, a document A406 is stored. On the other hand, in the folder C404, a folder D405 is further stored in a lower hierarchy. Therefore, the folder D405 is a subfolder of the folder C404. In the folder D405, a document B407 is stored in a lower hierarchy.

  Here, the access right information setting unit 301 sets access right information (ACL) for the cabinet 401 stored in the highest hierarchy. The setting is performed for an individual user using the operator keyboard 211 or the mouse 212 according to the menu displayed on the display 208, for example. Reference numeral 408 denotes access right information (ACL) that has been set. The ACL 408 includes an account, that is, an individual user name (“kato”, “tanaka”, “takahashi”, “yamamoto”) and contents of access rights (O ”,“ R ”,“ W ”given to each individual user). , “D”) is set.

  As shown in FIG. 5, “O” indicates the owner of the object (cabinet 401) in the contents of the access right. “R” indicates that the user has authority to read the object, “W” indicates that the object has authority to write, and “D” indicates that the object can be deleted. Indicates that you have permission to do so.

  Therefore, in ACL 408, it can be seen that the user “kato” is the owner of the cabinet 401 and can read and write to the cabinet 401. However, the user “kato” cannot delete the cabinet 401. It can also be seen that only the user “yamamoto” has the authority to delete the cabinet 401.

  Further, it can be seen that the users “tanaka” and “takahashi” can only read the cabinet 401 and no other authority is given to both.

  In this state, when there is an access request to the folders 402 to 405 or the documents 406 and 407 in the cabinet 401, the reference unit 302 refers to the ACL 408 of the cabinet. Then, the access determination unit 303 determines whether to permit access to the cabinet ACL 408 based on the contents.

  Specifically, when the user “kato” who has the write authority for the cabinet 401 requests writing of the document A 406, the user “tanaka” who does not have the write authority for the cabinet 401 is permitted to write the document A 406. When writing is requested, the writing is not permitted. In this way, all objects (folders 402 to 405, documents 406 and 407) in the cabinet 401 inherit the access right to the cabinet 401.

  Next, the object management structure will be described. FIG. 6 is an explanatory diagram showing the object management structure of the data management apparatus according to the first embodiment, and corresponds to the explanatory diagram showing the principle of data management shown in FIG. In FIG. 6, 601 is the object management structure of the cabinet 401, 602 is the object management structure of the folder A402, 603 is the object management structure of the folder B403, and 606 is the object management structure of the document A406. Illustration of the folder C404, the folder D405, and the document B407 is omitted.

  Each object includes items of “object type”, “object name”, “reference information to parent”, “reference information to cabinet”, and “other attributes”. Here, “reference information to the cabinet” of the document A 606 is normally “none”, but when there is an access request to the document A, the cabinet 601 is directly referred to. Thereafter, the cabinet 601 refers to the ACL of the cabinet based on the item “reference information to ACL”.

  FIG. 7 is a flowchart showing a procedure of data management processing of the data management apparatus according to the first embodiment. In the flowchart of FIG. 7, it is first determined whether or not there is an access request (step S701). If there is an access request after waiting for an access request (Yes in step S701), no matter what the target object for which there was an access request is, the top level of the hierarchy to which the target object belongs is assigned. Reference is made to the ACL of the stored object (step S702).

  Next, as a result of referring to the ACL in step S702, it is determined whether or not the requested access is possible (step S703). If it is determined that access is possible (Yes at step S703), a notification that access to the object of interest is permitted is given (step S704). Thereafter, the object of interest can be accessed.

  On the other hand, if it is determined in step S703 that access is not possible (No in step S703), a notification that access to the object of interest is rejected (step S705).

  Note that whether or not to notify access permission or access denial performed in step S704 or step S705 is an optional process, and access may be permitted or access may be denied without notification. .

  As described above, according to the data management apparatus according to the first embodiment, only one ACL is set for an object (cabinet) stored in the highest hierarchy, and an ACL is set for each object belonging to the cabinet. It is possible to manage access rights without any problems.

(Embodiment 2)
Next, a data management apparatus according to Embodiment 2 will be described. As for the hardware configuration of the networked data management system including the data management device according to the second embodiment and the hardware configuration of the data management device, the hardware configuration of the data management system of the first embodiment (see FIG. 1). ) And the hardware configuration of the data management apparatus (see FIG. 2), the description thereof will be omitted.

  FIG. 8 is a functional block diagram functionally showing the configuration of the data management apparatus according to the second embodiment. In FIG. 8, the data management apparatus includes an access right information setting unit 801, a determination unit 802, a first access determination unit 803, a reference unit 804, and a second access determination unit 805. Further, the second access determination unit 805 has an access right conversion table 806.

  The access right information setting unit 801 sets access right information (ACL) for an arbitrary object among the stored objects. The ACL is set individually for each user. The set ACL is stored in a predetermined area. Details of the ACL will be described later.

  The determination unit 802 determines whether the access request is for the access right information setting object for which the access right is set by the access right information setting unit 801 or the access right information for which the access right is set by the access right information setting unit 801 It is determined whether there is an access right information non-setting object other than the setting object.

  The first access determination unit 803 determines that the access right information setting object (the cabinet 310, the folder 320, the document (file) 330 or the section (file) 340) is requested as a result of the determination by the determination unit 802. , Whether to access the object is determined based on the ACL.

  As a result of determination by the determination unit 802, the reference unit 804 determines that the access right information is not included in the access right information non-setting object (folder 320, document (file) 330 or section (file) 340). The ACL set in the access right information setting object stored in the upper hierarchy relative to the hierarchy in which the non-setting object is stored is referred to.

  Here, the “relatively higher hierarchy” will be described. In the case of the folder 320, the cabinet 310 to which the folder 320 itself belongs is an object stored in a relatively higher hierarchy. Similarly, if it is a document (file) 330, the cabinet 310 and folder 320 to which the document (file) itself belongs, and if it is a section (file) 340, the cabinet 310, folder 320 and document to which the section (file) 340 itself belongs. (File) 330 is an object stored in a relatively higher hierarchy.

  Based on the ACL referred to by the second access determining unit 805, it is determined whether or not the access right information non-setting object is accessible. The second access determination unit 805 includes an access right conversion table 806, and determines whether or not the access right information non-set object can be accessed based on the ACL converted by the access right conversion table 806.

  The access right conversion table 806 converts the ACL based on the hierarchy storing the access right information setting object in which the ACL referred to by the reference unit 804 is set and the hierarchy storing the access right information non-setting object. This is a conversion table.

  The access right conversion table 806 stores the access right information setting object in the hierarchy in which the access right information non-setting object is stored within a range not exceeding the access right in the hierarchy in which the access right information setting object is stored. The ACL may be converted so that the access authority is wider than the access authority in the hierarchy.

  The access right information setting unit 801, the determination unit 802, the first access determination unit 803, the reference unit 804, the second access determination unit 805, and the access right conversion table 806 are the ROM 202, the RAM 203, or the hard disk (HD) 205, respectively. The functions of each unit are realized by the CPU 201 and the like executing instruction processing in accordance with instructions described in a program recorded on a recording medium such as a floppy disk (FD) 207.

  Next, the contents of objects stored hierarchically and the contents of access right information (ACL) will be described. FIG. 9 is an explanatory diagram showing the principle of data management of the data management apparatus according to the second embodiment.

  In FIG. 9, the cabinet 901 stores a folder A 902 in the immediately lower hierarchy, and the folder A 902 stores a folder B 903 and a folder C 904 in the lower hierarchy. Document A906 is stored in folder B903. On the other hand, in the folder C904, a folder D905 is further stored in a lower hierarchy. Therefore, the folder D905 is a subfolder of the folder C904. In the folder D905, a document B907 is stored in the lower hierarchy.

  Here, the access right information setting unit 801 sets access right information (ACL) for the cabinet 901, the folder 904, and the document A 906, which are arbitrary objects. As in the first embodiment, the ACL setting is performed for an individual user using the operator keyboard 211 or the mouse 212 according to the menu displayed on the display 208, for example.

  Reference numeral 910 denotes access right information (ACL) set for the cabinet 901. The ACL 910 includes individual user names (“kato”, “tanaka”, “takahashi”, “yamamoto”) and contents of access rights (O ”,“ R ”,“ W ”,“ D ”given to each individual user). )) Is set.

  As in the first embodiment, as shown in FIG. 5, “O” indicates the owner of the object (cabinet 901) in the contents of the access right. “R” indicates that the user has authority to read the object, “W” indicates that the object has authority to write, and “D” indicates that the object can be deleted. Indicates that you have permission to do so.

  Therefore, in the ACL 910, as in the first embodiment, the user “kato” is the owner of the cabinet 901 and can read and write to the cabinet 901. However, the user “kato” cannot delete the cabinet 901. It can also be seen that only the user “yamamoto” has the authority to delete the cabinet 901.

  Further, it can be seen that the users “tanaka” and “takahashi” can only read the cabinet 901 and no other authority is given to both.

  Similarly, ACL 920 and ACL 930 are set with the contents of access rights for users “kato”, “tanaka” and “takahashi”, respectively.

  In such a state, the folder A 902 and the folder B 903 inherit the access right of the cabinet 901. Folder C904 has a unique access right. Further, the folder D905 and the document B907 inherit the access right of the folder C904. Further, the document A 906 has a unique access right.

  That is, if there is an access request to the cabinet 901, the folder C904 in which the ACL in the cabinet 901 is set, and the document (file) A906, if the first access determination unit 803 is the cabinet 901, the ACL 910 and the folder C904 may be used. For example, in the case of ACL 920 and document (file) A 906, whether to permit access is determined based on the contents of ACL 930.

  On the other hand, when there is an access request to the folder A 902 or the folder B 903 in which no ACL is set in the cabinet 901, the reference unit 804 is set to an object stored in a higher hierarchy relative to the folder A 902 and the folder B 903. Reference is made to the ACL 910 of the cabinet 901. Then, the second access determination unit 905 determines whether to permit access based on the contents of the ACL 910 of the cabinet 901.

  As in the first embodiment, the content of the specific determination as to whether or not to permit specific access is the case where the user “kato” who has the write authority for the cabinet 901 requests writing to the folder B903 or the folder B904. Allows the writing, but if the user “tanaka” who does not have the writing authority of the cabinet 901 requests the writing of the sentence folder B903 or the folder B904, the writing is not permitted. In this way, the access right to the cabinet 901 is inherited.

  Similarly, when there is an access request to the folder D905 or the document (file) B907 in which no ACL is set in the cabinet 901, the reference unit 804 has a higher rank relative to the folder D905 or the document (file) B907 folder A902. Of the objects stored in the hierarchy, the ACL 920 of the folder C904 stored in the latest upper hierarchy where the ACL is set is referred to. Then, the second access determination unit 905 determines whether to permit access based on the contents of the ACL 920 of the folder C904.

  Next, the object management structure will be described. FIG. 10 is an explanatory diagram showing the object management structure of the data management apparatus according to the second embodiment, and corresponds to the explanatory diagram showing the principle of data management shown in FIG. In FIG. 10, 1001 is the object management structure of the cabinet 901, 1002 is the object management structure of folder A902, 1003 is the object management structure of folder B903, 1005 is the object management structure of folder D905, and 1007 is This is an object management structure of a document (file) B907. Note that illustration of the folder B 903 and the document A 906 is omitted.

  Each object includes items of “object type”, “object name”, “reference information to parent”, “reference information to ACL”, and “other attributes” as in the first embodiment. Here, since “reference information to ACL” of the object management structure 1007 of the document B 907 is normally “none”, when an access request is made to the document B, the parent object folder D 905 is referred to. The folder D 905 also refers to the parent object folder C 903 because “reference information to ACL” in the object management structure 1005 is “none”. In the folder C 903, the ACL 920 of the cabinet is referred to based on the item “reference information to ACL” of the object management structure 1003.

  FIG. 11 is an explanatory diagram showing the contents of the access right information conversion table of the data management apparatus according to the second embodiment. The table in FIG. 11 shows an example of an access right conversion rule inherited among cabinets, folders, and documents (files) as objects.

  In this conversion rule, for example, a user who has “create folder” authority for a cabinet operates as having “create subfolder”, “delete folder”, and “change” authority for a folder that has inherited the authority.

  Similarly, a user who has the “Create Document” permission in a folder adds a comment to the document body with a “change” or “annotation (image to paste a comment with a comment) attached to a document that has inherited that permission. Function) Operates with the authority of “change” and “document deletion”. Further, the “change” and “cabinet delete” authority of the cabinet is not inherited by other objects.

  FIG. 12 is a flowchart illustrating a procedure of data management processing of the data management apparatus according to the second embodiment. In the flowchart of FIG. 12, it is first determined whether or not there is an access request (step S1201). If there is an access request after waiting for an access request (Yes in step S1201), it is next determined whether or not an ACL is set for the object for which the access request has been made (step S1202).

  If the ACL is not set in step S1202 (No in step S1202), the parent object stored in the hierarchy one level higher than the object is referred to (step S1203), and then the process proceeds to step S1202. If the ACL is set in step S1202 (Yes in step S1202), the ACL is referred to (step S1204).

  Next, as a result of referring to the ACL in step S1204, it is determined whether or not the requested access is possible (step S1205). If it is determined that access is possible (Yes at step S1205), a notification that access to the object of interest is permitted is sent (step S1206). Thereafter, the object of interest can be accessed.

  On the other hand, if it is determined in step S1205 that access is not possible (No in step S1205), a notification that access to the object of interest is rejected (step S1207).

  Note that whether or not to notify access permission or access denial performed in step S1206 or step S1207 is an arbitrary process, and access may be permitted or access denied without notification. .

  As described above, according to the data management apparatus according to the second embodiment, an access right is inherited to an object stored in a relatively lower hierarchy of the arbitrary object only by setting an ACL for the arbitrary object. be able to.

  Further, since the ACL authority content is changed and applied within a range not exceeding the ACL authority content set for the object stored in the relatively higher hierarchy, the ACL authority content is changed each time the hierarchy is different. The trouble of changing can be omitted.

(Embodiment 3)
Next, a data management apparatus according to Embodiment 3 will be described. As for the hardware configuration of the networked data management system including the data management device according to the third embodiment and the hardware configuration of the data management device, the hardware configuration of the data management system of the first embodiment (see FIG. 1). ) And the hardware configuration of the data management apparatus (see FIG. 2), the description thereof will be omitted.

  FIG. 13 is a functional block diagram functionally showing the configuration of the data management apparatus according to the third embodiment. In FIG. 13, the data management apparatus includes a copy / move unit 1301, a determination unit 1302, and an addition unit 1303.

  The copy / move unit 1301 copies or moves an arbitrary object among the stored objects to another object. Also, the determination unit 1302 determines whether information regarding the user in the ACL of the object copied or moved by the copy / move unit 1301 is valid for the copy / move destination object.

  If it is determined by the determination unit 1302 that the information about the user is valid in the copy / move destination object, the adder 1303 converts the ACL for the user in the ACL to the ACL of the copy / move destination object. to add.

  Next, the contents of the adding process of the adding unit 1303 accompanying the copying / movement of the access right (ACL) set to the hierarchically stored object will be described. FIG. 14 is an explanatory diagram showing an object management structure of the data management apparatus according to the third embodiment.

  In FIG. 14, reference numeral 1401 denotes an object management structure of a copy source object (document A (file)), and 1402 denotes an object management structure of a copy destination object (document A (file)). 1410 is an ACL set for the copy source object (document A (file)), and 1420 is an ACL set for the copy destination object (document A (file)).

  Each object includes items of “object type”, “object name”, “reference information to parent”, “reference information to ACL”, and “other attributes” as in the first embodiment. Here, the ACL 1410 is normally referred to as the “ACL reference information” of the object management structure 1401 of the copy source document A, and the “ACL reference information” of the object management structure 1402 of the copy destination document A is Reference is made to ACL 140.

  When comparing the ACL 1410 and the ACL 1420, the account “yamada” is added to the ACL 1420 based on the rules of the copy destination system, but the ACL reproduces the ACL state of the copy source document A. In this manner, the adding unit 1303 adds the accounts “kato”, “tanaka”, and “takahashi”, respectively.

  FIG. 15 is a flowchart showing a procedure of object copy / move processing of the data management apparatus according to the third embodiment. In the flowchart of FIG. 15, it is first determined whether or not an object copy / move process has been performed (step S1501).

  If there is a copy / move process in step S1501, and there is a copy / move process (Yes in step S1501), it is next determined whether or not an ACL is set for the object that is the object of the copy / move process. (Step S1502).

  If the ACL is not set in step S1502 (No in step S1502), the series of processing ends without doing anything. On the other hand, if the ACL is set (Yes in step S1502), it is next checked whether the account (user name) registered in the set ACL is already set in the copy destination. Determination is made (step S1503).

  In step S1503, if all accounts are already set in the copy destination (No in step S1503), the series of processing ends without doing anything. On the other hand, if there is an account that is not set at the copy destination (Yes at step S1503), it is next determined whether or not the account is valid at the copy destination (step S1504).

  If it is determined in step S1504 that the account is not valid at the copy destination (No in step S1504), the series of processing ends without doing anything. On the other hand, if the account is valid at the copy destination (Yes at step S1504), the account is added to the copy destination ACL, and all the processes are terminated.

  As described above, according to the data management apparatus of the third embodiment, when copying / moving an object, the copy / movement source ACL can be used and is not managed at the copy / movement destination. ACL addition can be prevented, and the efficiency of ACL setting can be improved.

(Embodiment 4)
Next, a data management apparatus according to Embodiment 4 will be described. The data management apparatus according to the third embodiment adds an account using the adding unit 1303, whereas the data management apparatus according to the fourth embodiment does not automatically add an account but the warning unit 1603 issues a warning. To emit. Further, the display unit 1604 is different in that the content of warning cancellation processing for canceling the warning made by the warning unit 1603 is displayed.

  Note that the hardware configuration of the networked data management system including the data management device according to the fourth embodiment and the hardware configuration of the data management device are the same as those of the data management system of the first embodiment (see FIG. 1). ) And the hardware configuration of the data management apparatus (see FIG. 2), the description thereof will be omitted.

  FIG. 16 is a functional block diagram functionally showing the configuration of the data management apparatus according to the fourth embodiment. In FIG. 16, the data management apparatus includes a copy / move unit 1601, a determination unit 1602, a warning unit 1603, and a display unit 1604.

  Copy / move unit 1601 copies or moves an arbitrary object among stored objects to another object, similar to copy / move unit 1301 in the third embodiment. Similarly to the determination unit 1302 in the third embodiment, the determination unit 1602 also determines whether the information about the user in the access right information of the object copied or moved by the copy / move unit 1601 is valid for the copy / move destination object. Judge whether or not.

  The warning unit 1603 gives a warning when the information about the user includes information that is not valid in the copy / move destination object as a result of the determination by the determination unit 1602. In addition, the display unit 1604 displays the content of warning cancellation processing for eliminating the warning for the warning by the warning unit 1603.

  Next, the content of warning and the content of warning cancellation processing performed by the warning unit 1603 will be described. FIG. 17 is an explanatory diagram illustrating an example of the content of a warning performed by the warning unit 1603 of the data management apparatus according to the fourth embodiment.

  In FIG. 17, the warning dialog 1701 contains “account information that is not valid for the copied (or moved) object in the ACL. ”Is displayed, a“ confirm ”button 1702 is provided, and the warning dialog 1701 is deleted by pressing the“ confirm ”button.

  FIG. 18 is an explanatory diagram showing an example of the content of the warning cancellation process displayed by the display unit 1604 of the data management apparatus according to the fourth embodiment. In FIG. 18, in the warning cancellation processing dial log 1801, two processes are displayed, and radio buttons 1802 and 1803 are also displayed so as to select only one of them.

  The two processes are: “Invalid ACL is deleted. The first process and “The user information that is insufficient in the full ACL of the above hierarchy is added to resolve the contradiction.” The second process can be considered. The second process is the process described in the third embodiment.

  The operator clicks one of the radio buttons 1802 or 1803 with a mouse or the like to select one of the processes. When the “OK” button is pressed while either one of the radio buttons 1802 and 1803 is selected, the warning elimination process is completed. Note that the display of the content of the warning cancellation processing may be performed simultaneously with the warning.

  FIG. 19 is a flowchart showing a procedure of object copy / move processing of the data management apparatus according to the fourth embodiment. In the flowchart of FIG. 19, it is first determined whether or not an object copy / move process has been performed (step S1901).

  If there is a copy / move process in step S1901, and if there is (YES in step S1901), it is next determined whether or not an ACL is set for the object that is the object of the copy / move process. (Step S1902).

  If the ACL is not set in step S1902 (No in step S1902), the series of processing ends without doing anything. On the other hand, if the ACL is set (Yes in step S1902), it is next checked whether the account (user name) registered in the set ACL is already set in the copy destination. Judgment is made (step S1903).

  In step S1903, if all accounts have already been set in the copy destination (No in step S1903), the series of processing ends without doing anything. On the other hand, if there is an account that is not set in the copy destination (Yes in step S1903), it is next determined whether there is an account that is not valid in the copy destination among the accounts that are not set (step S1903). S1904).

  If there is no account that is not valid in step S1904 (No in step S1904), the series of processing ends without doing anything. On the other hand, if there is an account that is not valid (Yes at step S1904), a warning to that effect is given (step S1905).

  Subsequent to the warning, the content of the warning cancellation process is displayed (step S1906). Then, after waiting for an instruction for processing for resolving the warning, if there is an instruction (step S1907), the canceling process is performed according to the instruction (step S1908), and all the processes are terminated.

  As described above, according to the data management apparatus according to the fourth embodiment, when copying / moving an object, the copy / movement source ACL can be utilized and is not managed at the copy / movement destination. The addition of an ACL account (user information) can be prevented.

  Further, according to the data management apparatus of the fourth embodiment, when copying / moving an object, it is possible to utilize the ACL of the copy / move source, and the ACL account (user information) associated with the copy / move. Changes can be made efficiently.

  The data management method described in this embodiment is realized by executing a program prepared in advance on a computer such as a personal computer or a workstation. This program is recorded on a computer-readable recording medium such as a hard disk, floppy disk, CD-ROM, MO, and DVD, and is executed by being read from the recording medium by the computer. The program can be distributed via the recording medium and a network such as the Internet.

It is a block diagram which shows the system configuration | structure of the data management system containing the data management apparatus by Embodiment 1 of this invention. 2 is a block diagram illustrating a hardware configuration of a data management device according to Embodiment 1. FIG. 2 is a functional block diagram functionally showing the configuration of the data management apparatus according to the first embodiment. FIG. FIG. 3 is an explanatory diagram illustrating a data management principle of the data management device according to the first embodiment. 6 is an explanatory diagram showing the contents of access right information (ACL) of the data management apparatus according to Embodiment 1. FIG. 3 is an explanatory diagram illustrating an object management structure of the data management apparatus according to Embodiment 1. FIG. 4 is a flowchart illustrating a procedure of data management processing of the data management apparatus according to the first embodiment. It is a functional block diagram which shows functionally the structure of the data management apparatus by Embodiment 2 of this invention. It is explanatory drawing which shows the principle of the data management of the data management apparatus by Embodiment 2. FIG. It is explanatory drawing which shows the object management structure of the data management apparatus by Embodiment 2. FIG. It is explanatory drawing which shows the content of the access right information conversion table of the data management apparatus by Embodiment 2. FIG. 10 is a flowchart illustrating a procedure of data management processing of the data management apparatus according to the second embodiment. It is a functional block diagram which shows functionally the structure of the data management apparatus by Embodiment 3 of this invention. It is explanatory drawing which shows the object management structure of the data management apparatus by Embodiment 3. FIG. 14 is a flowchart showing a procedure of object copy / move processing of the data management apparatus according to the third embodiment. It is a functional block diagram which shows functionally the structure of the data management apparatus by Embodiment 4 of this invention. It is explanatory drawing which shows an example of the content of the warning performed by the warning part of the data management apparatus by Embodiment 4. It is explanatory drawing which shows an example of the content of the warning cancellation process displayed by the display part of the data management apparatus by Embodiment 4. FIG. 15 is a flowchart illustrating a procedure of object copy / move processing of the data management apparatus according to the fourth embodiment.

Explanation of symbols

100 Network 101 Network Server 102 Network Terminal Device (Personal Computer)
103 Scanner 104 Printer 201 CPU
202 ROM
203 RAM
204 HDD
205 HD
206 FDD
207 FD
208 Display 209 I / F
210 communication line 211 keyboard 212 mouse 214 bus 300 object 301 access right information setting unit 302 reference unit 303 access determination unit 310, 401 cabinet 320, 402, 403, 404, 405 folder 330, 406, 407 document (file)
340 sections (files)
408, 910, 920, 930, 1410, 1420 Access right information (ACL)
601 to 606, 1001 to 1007, 1401 and 1402 Object management structure 801 Access right information setting unit 802 Discrimination unit 803 First access determination unit 804 Reference unit 805 Second access determination unit 806 Access right conversion tables 1301 and 1601 Copy / move unit 1302, 1602 Judgment unit 1303 Addition unit 1603 Warning unit 1604 Display unit 1701 Warning dialog 1702 "Confirm" button 1801 Warning cancellation processing dialog 1802, 1803 Radio button 1804 "OK" button

Claims (15)

In a data management device that hierarchically stores data registered in a predetermined format as an object, and determines whether or not to access the object based on access right information for each stored object,
Access right information setting means for setting access right information only to objects stored in the highest hierarchy among stored objects;
When there is an access request for an access right information non-set object other than the object stored in the highest hierarchy, the access right information set for the object stored in the highest hierarchy by the access right information setting means A reference means for referring to
Access determining means for determining whether or not to access the access right information non-setting object based on the access right information referred to by the reference means;
A data management apparatus comprising: In a data management device that hierarchically stores data registered in a predetermined format as an object, and determines whether or not to access the object based on access right information for each stored object,
Access right information setting means for setting access right information to any object among stored objects;
The access request is for the access right information setting object for which the access right is set by the access right information setting means, or access other than the access right information setting object for which the access right is set by the access right information setting means A discriminating means for discriminating whether there is a right information non-setting object;
As a result of determination by the determination means, when there is an access request for the access right information setting object, first access determination means for determining whether or not access is possible based on the access right information;
As a result of the determination by the determining means, when there is an access request for the access right information non-setting object, the access stored in the higher hierarchy relative to the hierarchy in which the access right information non-setting object is stored A reference means for referring to the access right information set in the right information setting object;
Second access determination means for determining whether or not access to the access right information non-setting object is possible based on the access right information referred to by the reference means;
A data management apparatus comprising: The second access determining means includes
Access for converting the access right information based on the hierarchy in which the access right information setting object in which the access right information referred to by the reference means is stored and the hierarchy in which the access right information non-setting object is stored A right conversion means,
3. The data management apparatus according to claim 2, wherein whether to access the access right information non-setting object is determined based on the access right information converted by the access right conversion unit.   The access right converting means stores the access right information setting object in a hierarchy in which the access right information non-setting object is stored within a range not exceeding an access right in the hierarchy in which the access right information setting object is stored. 4. The data management apparatus according to claim 3, wherein the access right is converted so that the access right has a wider range than the access right in the hierarchy. In a data management device that hierarchically stores data registered in a predetermined format as an object, and determines whether or not to access the object based on access right information for each stored object,
Copying / moving means for copying or moving any of the stored objects to another object;
Judging means for judging whether or not the information regarding the user in the access right information of the object copied or moved by the copying / moving means is valid for the object to be copied / moved;
As a result of the determination by the determination means, when the information about the user is valid in the copy / move destination object, the access right information for the user in the access right information is copied / move destination object access right information. Additional means to add to
A data management apparatus comprising: In a data management device that hierarchically stores data registered in a predetermined format as an object, and determines whether or not to access the object based on access right information for each stored object,
Copying / moving means for copying or moving any of the stored objects to another object;
Judging means for judging whether or not the information regarding the user in the access right information of the object copied or moved by the copying / moving means is valid for the object to be copied / moved;
As a result of determination by the determination unit, a warning unit that issues a warning when information related to the user includes information that is not valid in the copy / destination object;
A data management apparatus comprising:   The data management apparatus according to claim 6, further comprising display means for displaying a content of warning cancellation processing for canceling the warning with respect to the warning. In a data management method for hierarchically storing data registered in a predetermined format as an object and determining whether or not to access the object based on access right information for each stored object,
An access right information setting step for setting access right information only for objects stored in the highest hierarchy among stored objects;
When there is an access request for an access right information non-set object other than the object stored in the highest hierarchy, the access right information set in the object stored in the highest hierarchy by the access right information setting step A reference process referring to
An access determination step for determining whether or not access to the access right information non-setting object is made based on the access right information referred to by the reference step;
A data management method characterized by including: In a data management method for hierarchically storing data registered in a predetermined format as an object and determining whether or not to access the object based on access right information for each stored object,
An access right information setting step for setting access right information for an arbitrary object among the stored objects;
The access request is for the access right information setting object for which the access right is set by the access right information setting step, or access other than the access right information setting object for which the access right is set by the access right information setting step A determination step of determining whether the object is a right information non-setting object;
As a result of determination by the determination step, when there is an access request for the access right information setting object, a first access determination step of determining whether or not access is possible based on the access right information;
As a result of the determination in the determination step, when there is an access request for the access right information non-set object, the access stored in the higher hierarchy relative to the hierarchy in which the access right information non-set object is stored A reference process for referring to access right information set in the right information setting object;
A second access determining step of determining whether or not access to the access right information non-setting object is made based on the access right information referred to by the reference step;
A data management method characterized by including: The second access right determination step includes:
Access for converting the access right information based on the hierarchy in which the access right information setting object in which the access right information referred to in the reference step is set is stored and the hierarchy in which the access right information non-set object is stored Including the rights conversion process,
10. The data management method according to claim 9, wherein whether to access the access right information non-setting object is determined based on the access right information converted by the access right conversion step.   In the access right conversion step, the access right information setting object is stored in the hierarchy in which the access right information non-setting object is stored within a range not exceeding the access right in the hierarchy in which the access right information setting object is stored. The data management method according to claim 10, wherein the access right is converted so that the access right is wider than the access right in the hierarchy. In a data management method for hierarchically storing data registered in a predetermined format as an object and determining whether or not to access the object based on access right information for each stored object,
When copying or moving any of the stored objects to another object, a determination is made as to whether or not the information about the user in the access right information of the copied or moved object is valid for the copied / moved object Process,
When it is determined in the determination step that the information about the user is valid for the copy / move destination object, the access right information for the user is copied from the access right information. Additional steps to add to
A data management device characterized by comprising In a data management method for hierarchically storing data registered in a predetermined format as an object and determining whether or not to access the object based on access right information for each stored object,
When copying or moving any of the stored objects to another object, a determination is made as to whether or not the information about the user in the access right information of the copied or moved object is valid for the copied / moved object Process,
A warning step for giving a warning when it is determined by the determination step that the information about the user includes information that is not valid in the copy / destination object;
A data management device characterized by comprising   14. The data management apparatus according to claim 13, further comprising a display step of displaying a content of warning cancellation processing for canceling the warning for the warning performed by the warning step.   A computer-readable recording medium having recorded thereon a program for causing a computer to execute the method according to any one of claims 8 to 14.

Images