JP2007226464A - Information processor, information processing method - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide a technique for enabling data of a document to be browsed by an administrator even when the document to which an access control is set is leaked. <P>SOLUTION: It is determined whether or not policy data is added to data directed to be transmitted (S401). When the policy data is added, it is determined whether or not an administrator policy is included in the policy data (S404). When the policy is included, the data directed to be transmitted is transmitted (S406). When the policy is not included, the policy data including the administrator policy is obtained (S408, S410), added to the data directed to be transmitted, and transmitted (S409, S410). <P>COPYRIGHT: (C)2007,JPO&INPIT

Description

  The present invention relates to an external data transmission technique.

  In recent years, access authority control servers that can set various access control (for example, browsing, expiration date, copy, print, change, etc.) to files for individual users have appeared on the market. As a result, the creator who created the file can control access to the distributed file at the individual user level.

  For example, ADOBE SYSTEMS has announced LiveCycle Policy Server, which enables the above-described access control to PDF files.

  In addition, Microsoft (registered trademark) has announced Windows (registered trademark) Rights Management Services, and enables the above-described access control to the Office application manufactured by Microsoft (registered trademark).

  In recent years, leakage of confidential documents has become a problem in companies and the like. The confidential document may be in the form of electronic data or a paper medium. From such a background, a system for storing a print history and print data of a document in a server device has been proposed (see Patent Document 1). According to this system, when a confidential document leak occurs, the administrator (system administrator, network administrator, etc.) tracks the cause of the confidential document leak by analyzing the stored print history and print data. Investigation becomes possible.

On the other hand, recent multifunction peripherals have a function to send an electronic document by a method of attaching an electronic document to an e-mail or a method of directly sending it to a shared folder of a personal computer or a server computer by various protocols. Has appeared.
JP 2003-330677 A

  However, if access control is set so that the electronic data of leaked confidential documents can only be viewed by users other than the administrator, the documents accumulated by the administrator who will perform the follow-up investigation There was a problem that the data could not be viewed and the follow-up survey could not be conducted.

  The present invention has been made in view of the above problems, and an object of the present invention is to provide a technique for enabling an administrator to view data of a document even when a document for which access control is set leaks. To do.

  In order to achieve the object of the present invention, for example, an information processing apparatus of the present invention comprises the following arrangement.

That is, an information processing apparatus that transmits instructed data to the outside via a network,
First determination means for determining whether or not the policy data describing the permitted access contents for the attention data instructed to be transmitted is added to the attention data;
When it is determined that the first determination unit is added, it is determined whether or not the administrator policy data describing the access contents permitted for the attention data by the administrator is included in the policy data. A second determination means to:
Control means for controlling transmission processing of the data of interest according to the determination results by the first and second determination means.

  In order to achieve the object of the present invention, for example, an information processing apparatus of the present invention comprises the following arrangement.

That is, processing means for processing the instructed data;
Determining means for referring to access right information associated with the instructed data to determine whether or not a specific user is permitted to access the instructed document;
If the determination means determines that a specific user is permitted to access the specified document, the instruction is sent to the processing means without changing the access right information associated with the specified data. Data processing is executed, and if the determination means determines that a specific user is not permitted to access the specified document, the specific user accesses the specified data. And control means for causing the processing means to execute processing of the instructed data after changing access right information associated with the instructed data so as to be permitted.

  In order to achieve the object of the present invention, for example, an information processing method of the present invention comprises the following arrangement.

That is, an information processing method performed by an information processing apparatus that transmits instructed data to the outside via a network,
A first determination step of determining whether or not the policy data describing the permitted access contents for the attention data instructed to be transmitted is added to the attention data;
If it is determined that the policy data is added in the first determination step, it is determined whether the policy data includes administrator policy data describing an access content permitted for the attention data. A second determination step,
And a control step of controlling the process of transmitting the attention data according to the determination results of the first and second determination steps.

  In order to achieve the object of the present invention, for example, an information processing method of the present invention comprises the following arrangement.

A processing step for processing the instructed data;
A determination step of determining whether or not a specific user is permitted to access the indicated document with reference to access right information associated with the indicated data;
If it is determined in the determining step that a specific user is permitted to access the specified document, the instruction is given in the processing step without changing access right information associated with the specified data. The specified data is executed, and if it is determined in the determining step that the specific user is not permitted to access the specified document, the specific user accesses the specified data. A control step of changing the access right information associated with the instructed data so as to be permitted and executing the processing of the instructed data in the processing step.

  According to the configuration of the present invention, even if a document for which access control is set leaks, the data of the document can be viewed by the administrator.

  Hereinafter, the present invention will be described in detail according to preferred embodiments with reference to the accompanying drawings.

[First Embodiment]
FIG. 3 is a diagram illustrating a configuration example of a system according to the present embodiment. As shown in the figure, the system according to this embodiment includes a client computer 310, a policy server computer 320, a multi-function device 330, and a job archive server 340, each connected to a network 300 such as a LAN or the Internet. Yes. Therefore, each device can perform data communication with each other via the network 300. Although not shown in FIG. 3, various devices such as various server computers, client computers, and multifunction peripherals are connected to the network 300.

  The policy server computer 320 holds data (referred to as policy data) that defines an access right for each user for various data held by the multifunction device 330, the client computer 310, and the like. Examples of various data held by the multifunction device 330, the client computer 310, and the like include document data and image data. The access right includes, for example, an authority related to operations such as browsing, copying, printing, and changing, and a document expiration date. That is, policy data that describes user A's access rights to various data possessed by the multifunction device 330 and client computer 310, policy data that describes user B's access rights to various data possessed by the multifunction device 330, and so on. In addition, policy data describing access rights is held for each user. It should be noted that applying the policy data managed by the policy server computer 320 to the data so that the access right can be managed is expressed as “adding a policy to the data”.

  The multi-function device 330 has a copy function, a scanner function, a print function, and the like, and also has a transmission function for transmitting stored data to the outside via the network 300. Examples of data held by the multifunction device 330 include document data and image data. The form in which the multifunction device 330 acquires these data is not particularly limited, and may be acquired by a scanner function that the MFP 330 has, or may be acquired from an external device via the network 300. The multi-function device 330 communicates with the policy server computer 320 to give a policy when transmitting data instructed to transmission to the instructed destination among the data held by the multi-function device 330.

  The client computer 310 receives data transmitted from the multifunction device 330. When the multifunction device 330 executes various functions (execution of these various functions is referred to as a job), the multifunction device 330 transmits the operation history data of the job and the image data handled by the job to the job archive server 340. . The job archive server 340 associates the received operation history data with the image data and stores them in the hard disk.

  As described above, the network 300 is configured by a LAN, the Internet, or the like, and is, for example, a network that supports the TCP / IP protocol.

  FIG. 1 is a block diagram illustrating a hardware configuration example of the multifunction device 330. That is, the hardware configuration of the apparatus applicable to the multi-function device 330 can be modified as appropriate in addition to the hardware configuration shown in FIG.

  Reference numeral 101 denotes a CPU (Central Processing Unit), which controls the operation of each unit shown in the figure using programs and data stored in a ROM (Read Only Memory) 102 and a RAM (Random Access Memory) 104, and is combined. Each process described below performed by the machine 330 is executed.

  Reference numeral 102 denotes a ROM which stores setting data and boot programs for the multifunction device 330, programs and data for causing the CPU 101 to execute processes to be described later performed by the multifunction device 330, and the like. These programs and data are appropriately loaded into the RAM 104 according to the control by the CPU 101 and are processed by the CPU 101.

  A hard disk 103 stores an OS (operating system), data received from the outside, and the like. Note that a part of the program and data described as being stored in the ROM 102 may be stored in the hard disk 103 and loaded into the RAM 104 as necessary.

  A RAM 104 has an area for temporarily storing programs and data loaded from the hard disk 103 and the ROM 102 and programs and data received from the outside. The CPU 101 also has a work area used when executing each process. That is, the RAM 104 can provide various storage areas as appropriate.

  Reference numeral 106 denotes a display unit for displaying various information such as the state of the apparatus or input information. The display unit 106 is, for example, a touch panel type liquid crystal screen. By instructing the display unit 106 with a finger or the like, for example, the number of scan copies or the number of print copies can be instructed.

  An operation unit 107 includes physical keys such as a numeric keypad and a start key for performing input operations such as settings and commands by the user. If the display unit 106 is a touch panel type, a part of the operation unit 107 is included in the display unit 106.

  A communication control unit 108 is used to connect the apparatus to the network 300 and controls transmission / reception of various data and control commands.

  Reference numeral 109 denotes a network control device, which is connected to a PSTN (Public Switched Telephone Network) and executes predetermined line control at the time of outgoing / incoming calls to connect or disconnect the line. Various data and control signals are modulated / demodulated by a built-in modem device, and facsimile transmission / reception is executed.

  A reading device 111 has a scanner function and, as is well known, irradiates a recording medium such as paper with light and acquires data corresponding to the reflected light. The acquired data is sent to the communication control unit 108, the hard disk 103, and the recording device 112 via the print control unit 110.

  Reference numeral 112 denotes a recording device that performs an operation of recording information based on data received via the print control unit 110 on a recording medium such as paper. This operation control is performed by the print control unit 110.

  Reference numeral 113 denotes an image memory for temporarily recording data acquired via the reading device 111 or the communication control unit 108 as image data. The image memory 113 may be provided in the hard disk 103 or the RAM 104.

  An image processing unit 114 compresses and encodes data to be transmitted, decompresses and decodes received data, converts received print data into image data, and stores data to be stored appropriately or by a user. Format conversion to a specified format (for example, PDF), image correction processing according to the optical response characteristics of the reading device 111, variations in sender, etc. An image processing process corresponding to a doubling process or the like, or an image optimization process for making data suitable for the writing characteristics of the recording device 112 or the like is performed as required.

  The authentication processing unit 115 performs print job authentication in addition to user and workgroup authentication.

  The system bus 116 connects the CPU 101, ROM 102, hard disk 103, RAM 104, display unit 106, operation unit 107, communication control unit 108, print control unit 110, image memory 113, image processing unit 114, and authentication processing unit 115. .

  The multi-function device 330 includes a facsimile transmission function that transmits read image data via the PSTN, a transmission function that transmits data to the outside via the network 300, a copying function that records and outputs the read image data, and a PSTN and network 3001. A receiving print function for printing the image data received via the printer, and a printing function for receiving and printing the print data from the client computer. Therefore, the multi-function device 330 can be used not only as a copying machine but also as a facsimile device, a printer device, and a scanner device.

  Needless to say, the recording device 112 may be anything other than the electrophotographic recording method, such as an inkjet method, a thermal head method, a dot impact method, or the like.

  FIG. 2 is a block diagram showing a hardware configuration of a computer applicable to the client computer 310, the policy server computer 320, and the job archive server 340.

  Reference numeral 201 denotes a CPU that controls the entire computer using programs and data stored in the ROM 202 and the RAM 203 and executes each process described later performed by each device to which the computer is applied.

  A ROM 202 stores setting data, a boot program, and the like.

  A RAM 203 has an area for temporarily storing programs and data loaded from an HD (hard disk) 210, data received from the outside via the I / F 205, and the like. Furthermore, the RAM 104 also has a work area used when the CPU 201 executes various processes. That is, the RAM 203 can provide various areas as appropriate.

  Reference numeral 205 denotes an I / F for connecting the computer to the network 300, and the computer performs data communication with the outside via the I / F 205.

  Reference numeral 206 denotes a DKC (disk controller) that controls the operation of the storage medium drive device 209 and the HD 210.

  The storage medium drive device 209 reads out programs and data recorded on a storage medium such as a CD-ROM or DVD-ROM and sends them to the HD 210 or RAM 203. The HD 210 stores an OS (Operating System). When this computer is applied to the client computer 310, the HD 210 stores programs and data for causing the CPU 210 to execute each process described later that is performed by the client computer 310. When this computer is applied to the policy server computer 320, the HD 210 stores programs and data for causing the CPU 210 to execute each process described later performed by the policy server computer 320, and the policy data.

  These programs and data are loaded into the RAM 203 as appropriate under the control of the CPU 210. When the CPU 210 executes processing using the loaded program and data, each device to which the computer is applied executes each processing described later.

  Reference numeral 207 denotes a CRTC (CRT controller) that controls transmission of an image signal to the CRT 211. The CRT 211 displays the result of processing by the CPU 210 using an image or text. In addition to the CRT, a liquid crystal screen or the like may be used.

  Reference numeral 208 denotes a KBC (keyboard controller) which notifies the CPU 210 of a signal corresponding to an operation input input using the KB (keyboard) 212. In addition to the KB 212, for example, a mouse may be used as the operation device.

  A bus 204 connects the above-described CPU 210, ROM 202, RAM 203, I / F 205, DKC 206, CRTC 207, and KBC 208.

  Next, processing for assigning a policy to data will be described with reference to FIGS. In FIGS. 9 to 11, document data (sometimes simply referred to as a document) is described as an example of data to which a policy is attached. However, the object to which the policy is attached may be data other than a document.

  FIG. 9 is a diagram illustrating an example of a policy database managed by the policy server computer 320.

  Policy database 900 is stored on hard disk 210 of policy server computer 320. The policy database 900 holds a plurality of policy data that is information on access rights, and one policy data is uniquely identified by a policy ID 902. In one policy data, permission or non-permission of access (operation) to a document is set for each of one or more users specified by the user ID 904. Furthermore, it is possible to set a document expiration date 912 for one policy data. When the expiration date is exceeded, access to the document with the policy is disabled. That is, as an example of the access authority for the document, in FIG. 9, a viewing authority 906, a printing authority 908, and an editing authority 910 can be set. Of course, other access rights may be set. Such setting of permission / prohibition of one or more access rights may be simply referred to as a policy.

  If “OK” is set as the setting of each authority, the operation on the document is permitted, and if “NG” is set, the operation is prohibited.

  FIG. 10 is a diagram illustrating an example of a table 1000 that associates a document ID 1002 and a policy ID 1004 with a document to which a policy is assigned. This table is stored in the hard disk 210 of the policy server computer 320.

  The document ID 1002 is an ID that is uniquely specified by the policy server computer 320 issued to a document to which a policy is assigned. The policy ID 1004 corresponds to the policy ID 902 in the policy database 900 of FIG.

  In addition, since the document to which the policy is assigned is encrypted, a decryption key 1006 for decrypting the encrypted document is associated with the document ID 1002.

  The policy assignment when the policy server computer 320 receives a request from the client computer 310 to assign a policy to a document stored in the client computer 310 will be described.

  Based on the request from the client computer 310, the policy server computer 320 generates a document ID of a document to which access authority is granted. Then, the policy ID designated by the client computer 310 and the decryption key of the document are associated with each other and registered in the table 1000 stored in the hard disk 210. Then, the encryption key and the document ID are transmitted to the client computer 310 via the network 300. The client computer 310 encrypts the document to which the policy is assigned with the received encryption key, and adds the document ID and information (host name, IP address, etc.) specifying the policy server computer 320 to the encrypted document. After the encryption is completed, the received encryption key may be deleted.

  By performing the above processing, policy assignment to the document is completed.

  FIG. 11 shows each state of a document to which a policy is assigned.

  A document file 1102 is a document before a policy is assigned. The encrypted document file 1104 indicates a state where the document file 1102 is encrypted with the encryption key acquired from the policy server. In the document file 1106 to which the policy is assigned, the document ID and information for specifying the policy server computer 320 are added to the encrypted document file 1104. By generating the document 1106, a policy is assigned to the document.

  The document file 1106 to which the policy is attached may hold the policy data itself defined by the policy ID instead of the information specifying the policy server computer 320.

  On the other hand, a user who wants to access a document to which a policy is attached operates the client computer 310 and the like, and sends the document ID of the document and the user ID of the user to the policy server computer 320 via the network 300. Send.

  The policy server computer 320 transmits access authority information for the user ID and a decryption key corresponding to the received document ID to the client computer 310 from the policy data specified by the policy ID corresponding to the received document ID. An application program for operating the document running on the client computer 310 decrypts the document with the received decryption key. Then, based on the access authority information received from the policy server computer 320 and the expiration date, permission / prohibition of the operation on the document by the user is controlled.

  When a user accesses a document file that holds the policy data itself, it is possible to control whether the operation is permitted or prohibited for the document according to the policy data that the document file holds. In this case, it is not necessary to perform communication between the client computer 310 and the policy server computer 320.

  The above-described policy assignment processing and access processing for a policy-assigned document are applicable not only when the client computer 310 accesses the document, but also when the multifunction device 330 operates the document (for example, printing). It is.

  FIG. 4 illustrates a case where an instruction to transmit attention data (for example, data specified by the user) to the client computer 310 via the network 300 among data held by the multifunction device 330 is input to the multifunction device 330. 9 is a flowchart of processing performed by the multifunction device 330. As the attention data, not only data previously held in the multifunction device 330 but also data generated by the reading device 111 reading a paper document may be targeted. Note that programs and data for causing the CPU 101 to execute processing according to the flowchart of FIG. These programs and data are loaded into the RAM 104 as appropriate under the control of the CPU 101. Then, when the CPU 101 executes processing using the loaded program and data, the multi-function device 330 executes each processing described later. However, in the flowchart of FIG. 4, there are steps involving not only the multifunction device 330 but also the policy server computer 320.

  When transmission data is selected using the operation unit 107, the display unit 106, and the like, and a transmission instruction is input, first, in step S401, a process for checking data (transmission data) instructed to be transmitted is performed. As a result of this check process, if no policy is assigned to the data instructed to be transmitted (No in step S402), the process proceeds to step S403. Whether or not a policy has been assigned is checked based on whether or not a document ID or information specifying the policy server computer 320 is added to the transmission data, as in the document 1106 in FIG. Alternatively, for data to which a policy is attached by adding the policy data itself to the data, it can also be determined by whether or not the policy data is added to the data. In step S403, the transmission process of the data instructed to be transmitted is interrupted, and the data is not transmitted. FIG. 5 is a diagram illustrating a display example of a screen displayed on the display screen of the display unit 106 in step S403.

  In the present embodiment, in order to prevent transmission data from leaking, it is assumed that a policy is assigned to all the transmission data. Therefore, data that is not assigned a policy is not transmitted. However, depending on the operation, data that has not been assigned a policy can be viewed by an administrator who conducts an audit when it is leaked, and may be transmitted. In this case, the process in step S403 is skipped and the process proceeds to step S406. Alternatively, when a policy is not assigned to the transmission data, a transmission process may be performed after a policy that allows access to the transmission destination user and administrator is assigned.

  On the other hand, if a policy is assigned to the data instructed to be transmitted, the process proceeds to step S404 via step S402. In step S404, the policy data acquired from the policy server computer 320 or added to the transmission instruction data is checked. As a result of this check processing, if policy data that can be accessed by the administrator is attached to the data instructed to be transmitted (Yes in step S405), the processing proceeds to step S406. On the other hand, if no access right for the administrator is set in the policy data, it is determined No in step S405, and the process proceeds to step S407. In addition, the policy data in which some access authority to the administrator is set for the data instructed to be transmitted, but if the content is set to be inaccessible by the administrator, it is also determined No in step S405. To do. Then, the process proceeds to step S407. The “administrator” refers to a specific user who accesses the archive data stored in the job archive server 340 and performs a follow-up survey when a leak of a confidential document is detected. For example, a user who manages a system such as the multifunction device 330 or the network 300 corresponds to the administrator. There may be one administrator or a plurality of managers. It is assumed that the HDD 103 of the multi-function device 330 stores a user ID that identifies an administrator.

  In step S406, since the data that can be audited by the administrator when the data instructed to transmit is leaked, a process for transmitting the data instructed to transmit to the instructed transmission destination (client computer 310) is performed.

  On the other hand, in step S407, it is checked whether or not the policy data that includes the policy that can be accessed by the administrator is stored in the policy server computer 320 in the policy data currently added to the data instructed to be transmitted. For this purpose, the policy server computer 320 is requested to search for such policy data. "Policy data that includes the administrator policy in the policy data that is currently granted to the data that has been instructed to send" is added to the policy data that is currently granted to grant access authority information that allows the administrator to access Refers to the set policy data. Access authority information that allows access by an administrator is called an administrator policy. Upon receiving this request, the policy server computer 320 searches the HD 210. As a result of this search, if “policy data in which the administrator policy is included in the policy data currently given to the data instructed to be transmitted” is found (Yes in step S407), this policy data is instructed to be transmitted. Is given as a policy for the data that has been processed. On the other hand, if not found (No in step S407), information indicating that is transmitted to the multi-function device 330.

  The multi-function device 330 receives the information transmitted from the policy server computer 320. When the policy data itself is added to the transmission data, the policy data is received from the policy server computer 320. Otherwise, the policy data can be updated by simply changing the policy ID associated with the document ID of the transmission data in the policy server computer 320. Therefore, in this case, it is not necessary for the multi-function device 330 to receive information from the policy server computer (step S409 is also skipped). If the requested policy data is received from the policy server computer 320, the process proceeds to step S408. In step S408, the received policy data is temporarily stored in the RAM 104 or the like. In step S409, the policy data acquired in step S408 is replaced with the data instructed for transmission instead of the policy data originally added to the data instructed for transmission. Append to Then, the process proceeds to step S406.

  On the other hand, when the information received from the policy server computer 320 is “information indicating that policy data including an administrator policy is not found in the policy data currently added to the data instructed to be transmitted”. The process proceeds to step S410. In step S410, a request to newly create “policy data in which the administrator policy is included in the policy data currently added to the data instructed to transmit” is transmitted to the policy server computer 320. Upon receiving such a request, the policy server computer 320 creates the requested policy data and sends it back to the multifunction device 330. When the multifunction device 330 receives the policy data transmitted from the multifunction device 330, the multifunction device 330 stores the policy data in the RAM 104 or the like. In step S409, the policy data acquired in step S408 is added to the data instructed to transmit instead of the policy data originally added to the data instructed to transmit. Then, the process proceeds to step S406. In the case of data to which a policy is assigned without adding the policy data itself as in 1106 of FIG. 11, the policy server computer 320 is instructed to send a policy ID corresponding to the policy data newly created. Policy data is updated by associating it with the document ID of the data. In this case, step S408 is skipped.

  In step S406, the transmission data with the policy data created in step S409 is transmitted to the designated transmission destination. Then, history information and transmission data related to the transmission operation are transmitted to the job archive server 340. The history information related to the transmission operation includes information for identifying the user who has given the transmission instruction, information such as the transmission destination, transmission date and time, transmission time, transmission result (normal end, abnormal end), and transmission mode. The history information and the transmission data are associated and stored in the HDD in the job archive server 340. The administrator can refer to history information and transmission data in the job archive server.

  As described above, according to the present embodiment, the policy of the data stored as the history always includes the policy that permits the access of the administrator who performs the follow-up survey. Therefore, an administrator who conducts a follow-up survey of leaked data can always browse data stored as a history.

  At the same time, when it becomes clear that the data has been leaked, it becomes possible to specify the data policy from the leaked data, and by changing the specified policy, for example, all access rights will be deleted except for the administrator. It is possible to minimize information leakage.

  Note that the configuration of the system used in this embodiment is merely an example, and the number of client computers 310, policy server computers 320, and multifunction devices 330, the network configuration, and the like are not particularly limited. In addition, any device may be used instead of the multifunction device 330 as long as the device can transmit the data by adding the policy data.

  In the flowchart of FIG. 4, the case where the multifunction device 330 transmits data to the client computer 310 via the network 300 has been described, but the same applies to other operations performed by the multifunction device 330. Other processes performed by the multi-function device 330 include various image output processes such as facsimile transmission of data and print processing based on the data.

[Second Embodiment]
In the first embodiment, when it is determined in step S405 that no policy data accessible by the administrator is assigned, the policy server computer 320 is inquired in step S407. However, it may be difficult for various reasons to incorporate a function for making an inquiry to the policy server computer 320 due to product reasons.

  Therefore, in such a case, transmission of data instructed to be transmitted may be stopped. That is, in the flowchart of FIG. 4, if the policy data is not included in the policy data as a result of checking the policy data in step S404, the process proceeds to step S403 via step S405.

  FIG. 6 is a diagram illustrating a display example of a screen displayed on the display screen of the display unit 106 when the policy data is not included in the policy data as a result of checking the policy data in step S404.

[Third Embodiment]
In the first embodiment, when an administrator policy is not included in the policy data in step S407, a new policy creation request is transmitted to the policy server computer 320. However, it may be difficult for various reasons to insert a new policy creation function into the policy server computer 320 due to product reasons.

  Therefore, in such a case, if the policy data requested from the multifunction device 330 does not exist in the policy server computer 320, the transmission of the data instructed to be transmitted may be stopped. That is, in the flowchart of FIG. 4, “information indicating that no policy data including an administrator policy was found in the policy data currently added to the data instructed for transmission” from the policy server computer 320 in step S407. If received, the process proceeds to step S403 via step S407.

  FIG. 7 shows a case where “information indicating that policy data including an administrator policy is not found in the policy data currently added to the data instructed to be transmitted” is received from the policy server computer 320 in step S407. 6 is a diagram showing a display example of a screen displayed on the display screen of the display unit 106. FIG.

[Fourth Embodiment]
In the first embodiment, when an administrator policy is not included in the policy data, a search request or a new creation request is transmitted to the policy server computer 320. In this embodiment, in such a case, the multifunction device 330 requests the policy server computer 320 to newly include an administrator policy in the policy data currently added to the data instructed to be transmitted. Thereby, the policy data currently added to the data instructed to be transmitted is updated.

  FIG. 8 is a flowchart of processing performed by the multi-function device 330 when an instruction to transmit attention data to the client computer 310 among the data held by the multi-function device 330 is input to the multi-function device 330. Note that programs and data for causing the CPU 101 to execute processing according to the flowchart of FIG. These programs and data are loaded into the RAM 104 as appropriate under the control of the CPU 101. Then, when the CPU 101 executes processing using the loaded program and data, the multi-function device 330 executes each processing described later. However, in the flowchart of FIG. 8, there are steps involving not only the multifunction device 330 but also the policy server computer 320.

  Since each process of step S801 to step S806 in FIG. 8 is the same process as step S401 to step S406 in FIG.

  As a result of the check in step S804, if no access right for the administrator is set in the policy data, it is determined No in step S805, and the process proceeds to step S807. The policy data has some access authority to the administrator for the data that is instructed to be transmitted, but the content is the authority that the administrator has set to be inaccessible to the data that has been instructed to transmit. In some cases, it is determined No in step S805. Then, the process proceeds to step S807.

  In step S807, the policy data currently added to the instructed data is transmitted to the server computer 320, and a request is made to include the administrator policy in this policy data. When the policy server computer 320 receives such a request, the policy server computer 320 performs processing for updating the policy data by including the administrator policy in the policy data transmitted from the multifunction device 330. Then, the updated policy data is returned to the multifunction device 330. Upon receiving the updated policy data transmitted from the server computer 320, the multi-function device 330 temporarily stores it in the RAM 104 or the like. Then, the policy data acquired in step S408 is added to the data instructed to be transmitted. Then, the process proceeds to step S806.

  If the data instructed to be transmitted is data to which a policy is attached without adding the policy data itself as in 1106 of FIG. 11, step S807 performs the following processing. First, the document ID of the data is notified to the policy server computer 320, and a request for adding the administrator's access authority is made. Upon receiving such a request, the policy server computer 320 specifies a policy ID corresponding to the received document ID with reference to the table 1000 in FIG. Then, an access authority that permits the administrator's access to the policy data corresponding to the policy ID in the policy database 900 is additionally registered. As a result, a policy is granted to permit the administrator's access to the transmission data. Then, the process proceeds to step S806.

  As described above, according to the present embodiment, when the policy assigned to the transmission data is not a policy accessible to the administrator, additional registration is performed so as to permit the administrator's access to the currently assigned policy. . Therefore, it is not necessary to newly create new policy data in the policy server computer, and it is not necessary to increase the number of policy data held by the policy server computer. As a result, the consumption of the disk space of the policy server computer can be suppressed, and the performance of the policy server computer can be prevented from deteriorating.

[Other Embodiments]
Needless to say, the object of the present invention can be achieved as follows. That is, a recording medium (or storage medium) that records a program code of software that implements the functions of the above-described embodiments is supplied to a system or apparatus. Then, the computer (or CPU or MPU) of the system or apparatus reads and executes the program code stored in the recording medium. In this case, the program code itself read from the recording medium realizes the functions of the above-described embodiment, and the recording medium on which the program code is recorded constitutes the present invention.

  Further, by executing the program code read by the computer, an operating system (OS) or the like running on the computer performs part or all of the actual processing based on the instruction of the program code. Needless to say, the process includes the case where the functions of the above-described embodiments are realized.

  Furthermore, it is assumed that the program code read from the recording medium is written in a memory provided in a function expansion card inserted into the computer or a function expansion unit connected to the computer. After that, based on the instruction of the program code, the CPU included in the function expansion card or function expansion unit performs part or all of the actual processing, and the function of the above-described embodiment is realized by the processing. Needless to say.

  When the present invention is applied to the recording medium, program code corresponding to the flowchart described above is stored in the recording medium.

2 is a block diagram illustrating a hardware configuration example of a multifunction machine 330. FIG. FIG. 3 is a block diagram showing a hardware configuration of a computer applicable to a client computer 310, a policy server computer 320, and a job archive server 340. It is a figure which shows the structural example of the system which concerns on the 1st Embodiment of this invention. When an instruction to transmit attention data (for example, data specified by a user) to the client computer 310 via the network 300 among data held by the multifunction device 330 is input to the multifunction device 330, It is a flowchart of the process which 330 performs. It is a figure which shows the example of a display of the screen displayed on the display screen of the display part 106 in step S403. FIG. 10 is a diagram illustrating a display example of a screen displayed on the display screen of the display unit 106 when the administrator data is not included in the policy data as a result of checking the policy data in step S404. In step S407, the display unit 106 receives the information from the policy server computer 320 indicating that the policy data that includes the administrator policy is not found in the policy data currently added to the data instructed to be transmitted. It is a figure which shows the example of a display of the screen displayed on a display screen. 10 is a flowchart of processing performed by the multifunction device 330 when an instruction to transmit attention data to the client computer 310 among the data held by the multifunction device 330 is input to the multifunction device 330. It is a figure which shows an example of the policy database which the policy server computer 320 manages. It is a figure which shows the example of the table 1000 which associates document ID1002 and policy ID1004 with respect to the document to which the policy was provided. It is a figure which shows each state of the document to which a policy is provided.

Claims (10)

An information processing apparatus for transmitting instructed data to the outside via a network,
First determination means for determining whether or not the policy data describing the permitted access contents for the attention data instructed to be transmitted is added to the attention data;
When it is determined that the first determination unit is added, it is determined whether or not the administrator policy data describing the access contents permitted for the attention data by the administrator is included in the policy data. A second determination means to:
An information processing apparatus comprising: a control unit that controls a transmission process of the attention data according to a determination result by the first and second determination units.   The information processing apparatus according to claim 1, wherein when it is determined that the first determination unit is not added, the control unit stops transmission of the attention data.   The information processing apparatus according to claim 1, wherein if it is determined that the second determination unit is included, the control unit transmits the attention data. The control means includes
If it is determined that the second determination unit is not included, a third determination unit that determines whether or not policy data including the administrator policy data exists outside the information processing apparatus;
If it is determined that the third determination means exists, first acquisition means for searching the outside and acquiring policy data including the administrator policy data;
If it is determined that the third determination means does not exist, a second request is made to obtain the policy data from the outside by requesting the outside to create policy data including the administrator policy data. Acquisition means,
The information processing apparatus according to claim 1, wherein the attention data to which the policy data acquired by the first acquisition unit or the second acquisition unit is added is transmitted. The control means includes
When it is determined that the second determination unit is not included, the policy data added to the attention data is transmitted to the outside, and a request for updating the policy data including the administrator policy data is made. And having an acquisition means for acquiring the updated policy data from the outside,
The information processing apparatus according to claim 1, wherein the attention data to which the policy data acquired by the acquisition unit is added is transmitted. Processing means for processing the instructed data;
Determining means for referring to access right information associated with the instructed data to determine whether or not a specific user is permitted to access the instructed document;
If the determination means determines that a specific user is permitted to access the specified document, the instruction is sent to the processing means without changing the access right information associated with the specified data. Data processing is executed, and if the determination means determines that a specific user is not permitted to access the specified document, the specific user accesses the specified data. An information processing apparatus comprising: control means for causing the processing means to execute processing of the instructed data after changing access right information associated with the instructed data so as to be permitted . An information processing method performed by an information processing apparatus that transmits instructed data to the outside via a network,
A first determination step of determining whether or not the policy data describing the permitted access contents for the attention data instructed to be transmitted is added to the attention data;
If it is determined that the policy data is added in the first determination step, it is determined whether the policy data includes administrator policy data describing an access content permitted for the attention data. A second determination step,
And a control step of controlling a process of transmitting the attention data according to the determination results of the first and second determination steps. Processing steps for processing the instructed data;
A determination step of determining whether or not a specific user is permitted to access the indicated document with reference to access right information associated with the indicated data;
If it is determined in the determining step that a specific user is permitted to access the specified document, the instruction is given in the processing step without changing access right information associated with the specified data. The specified data is executed, and if it is determined in the determining step that the specific user is not permitted to access the specified document, the specific user accesses the specified data. An information processing method comprising: a control step of changing the access right information associated with the instructed data so as to be permitted, and executing the processing of the instructed data in the processing step .   A program for causing a computer to execute the information processing method according to claim 7 or 8.   A computer-readable storage medium storing the program according to claim 9.

Images