JP2009070015A - Application service providing system - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide a system which satisfies two contradictory requirements that is, "to reduce information to be stored outside a company" and "to share information with a user outside the company" while using an SaaS type service. <P>SOLUTION: In a system which comprises a first service provision server 11 and a second service provision server 21 connected to the first server 11, and provides service using a same application by both servers 11 and 12, the first server 11 provides service to a first user who has used first user personal computers 14 and 15 and stores data or a file in the own-server 11 or the data server 12, and the second server 21 provides service to a second user who has used a second user personal computer 32 and stores the data or the file in the own-server 21 or a data server 22. <P>COPYRIGHT: (C)2009,JPO&INPIT

Description

  The present invention relates to an application use service providing system, and more particularly to a system that provides the same application use service by a plurality of service providing servers.

There is a service called SaaS (Software as a Service). Instead of installing software on a client personal computer, a method for connecting to an Internet site that provides software (application) using an Internet browsing browser (such as Microsoft Internet Explorer (registered trademark)) and using the software is used. Examples include Google Docs & Spreadsheets (registered trademark). This is a service in which software equivalent to Microsoft Word and Excel (registered trademark) can be used through a browser for browsing the Internet. Documents created using this service are basically stored on the Internet site providing the service, and are not stored on the client personal computer.
When using such a service, especially for companies, information (prepared documents, etc.) is stored on an external network (site that provides the service), so there is a possibility of information leakage or information loss. Is concerned. In order to solve these problems, a method for preventing information leakage and information loss by installing a site providing SaaS in an in-house network (intranet) can be considered. However, this method eliminates the means for sharing the created information with people outside the company. This is because a person outside the company cannot access a site that provides SaaS installed in the company network (see Non-Patent Document 1).
Nikkei Communications “The Location Free Age is Coming” p76-80 2007.1.1

  The present invention provides a method for minimizing information stored outside the company and sharing information with people outside the company while using a SaaS type service. It is an object to provide a service providing system that can satisfy two conflicting requirements of “Yes” and “Allow sharing information with outside users”.

  The present invention provides an in-house user in a configuration in which an in-house SaaS providing server is installed in an in-house network (intranet) and an in-house SaaS providing server is installed for an outside user (such as someone from another company). Uses the software by accessing the in-house SaaS providing server, and the data (file) created or edited is stored in the in-house SaaS providing server or a data server linked to the in-house SaaS providing server. The external user uses the software by accessing the external SaaS providing server, and the created or edited data (file) is stored in the external SaaS providing server or a data server linked with the external SaaS providing server. The In addition, by synchronizing the external server and the internal server as appropriate, data can be disclosed to external people only when necessary, and information that goes outside the company can be reduced as much as possible. It can also be secured.

  That is, the present invention includes a first service providing server and a second service providing server connected to the first service providing server, and both service providing servers provide services using the same application. In the service providing system, the first service providing server provides a service for using an application to a first user who has accessed using a first user personal computer, and has created or edited data or The file is stored in the server or a data server linked to the server, and the second service providing server uses the application to the second user who has accessed using the second user personal computer. Data that provides services and creates or edits data or files that are linked to the local server or the local server It is a service providing system to be stored in over server.

  Further, according to the present invention, the first service providing server or the data server linked to the server can use the data or file created by the first service providing server on the second user personal computer. In response to an instruction from the first user personal computer, the corresponding data or file stored in the first service providing server or a data server linked to the server is transferred to the second service providing server or the server. It is a service providing system for sending a copy to a linked data server.

  In the present invention, the second service providing server transmits a mail designating the location of the data or file to the set destination mail address, and the second user who receives the mail This is a service providing system capable of accessing, viewing, editing, etc. data (files) using a second user personal computer.

  Further, according to the present invention, in order for the second service providing server to access the data or file copied to the server or the data server linked with the server, the mail address set to be accessible to the data or file. This is a service providing system in which a password is sent to the second user, and the second user can use a second user personal computer to access the file using an email address and a password.

  In addition, the present invention is a service providing system in which domain authentication is performed based on preset contents in order to access data or a file copied to a second service providing server.

  The present invention is a service providing system in which a public level can be set in advance for data or a file copied to a second service providing server.

  Furthermore, the present invention is the service providing system in which the second service providing server stores the data or file copied to the own server or a data server linked to the own server based on a preset retention period.

  Further, the present invention is a service providing system in which the second service providing server controls access to data or a file copied to the server or a data server linked to the server based on a preset access right. is there.

  In the present invention, the second service providing server is a service providing system in which an operation is controlled based on an operation restriction set in advance for data or a file copied to the server or a data server linked to the server. It is.

  Further, according to the present invention, the first service providing server and the second service providing server store the same data or file sent to the second user when they are set to be editable. This is a service providing system that synchronizes original data and transmission data that are data based on the contents set at the time of transmission.

  Further, according to the present invention, when the first service providing server and the second service providing server are changed to either the original data or the transmission data as bidirectional synchronization of the original data and the transmission data, It is a service providing system that immediately reflects changes in one data.

  In the present invention, the first service providing server and the second service providing server are configured such that, when the original data is changed, as one-way synchronization from the original data to the transmission data, This is a service providing system in which a change is immediately reflected and the change is not reflected in the original data even if a change is made to the transmission destination data.

  Further, according to the present invention, when the first service providing server and the second service providing server change the transmission destination data as one-way synchronization from the transmission data to the original data, This is a service providing system in which a change is immediately reflected and the change is not reflected in transmission destination data even if the original data is changed.

  According to the present invention, it has heretofore been limited to “data” and shared internally and externally. However, since the application installed on the client PC was used, it was difficult for the “data publishing party” to control the application that uses the data (that is, created by Microsoft Word). When publishing a document, it is assumed that the application itself called Word is used by the other party to be published, and detailed settings when using the application depend on the other party). In the present invention, by providing the application (data sharing side) together with the data, it is possible to control how to handle the provided data, and an effect in terms of security can be seen (printing and printing). You can specify permission to copy, how long the other party can view).

  Currently, Microsoft Word, Adobe Systems' Acrobat Reader (registered trademark), etc. are in an oligopoly as software for opening document files. By using the present invention, it is possible to enter such an oligopolistic software market. (In other words, the reason why Word and Acrobat Reader are used a lot is because it is convenient for information sharing because many unspecified people use this software. Providing the application that the data uses, whether or not the other party is using the application is no longer a problem).

  Further, by using the present invention, there has conventionally been a problem that even if the same software (for example, Word) is used, the partner who received the file cannot open due to the difference in version. However, this problem can be solved by the present invention.

The best mode for carrying out the present invention will be described.
Embodiments of a service providing system according to the present invention will be described with reference to the drawings.

  Example 1 will be described. As shown in FIG. 1, the service providing system according to the present embodiment includes an in-house SaaS providing server (first service providing server) 11 and an external SaaS providing server (second service providing server) 21. For users 14 and 15, an in-house SaaS providing server 11 is installed in an in-house network (intranet) 13, and an external SaaS providing server 21 is installed for outside users (such as people from other companies) 32. In this configuration, the in-house users 14 and 15 use the software (application) by accessing the in-house SaaS providing server 11, and the created or edited data (file) is stored in the in-house SaaS providing server 11 or the in-house SaaS providing server 11. The data is stored in the data server 12 linked with the destination SaaS providing server. The external user 32 uses the same software (application) by accessing the external SaaS providing server 21 via the network 31, and the created or edited data (file) is stored in the external SaaS providing server 21 or The data is stored in the data server 22 linked to the external SaaS providing server.

A second embodiment will be described. In this embodiment, as shown in FIG. 2, when the in-house user 14 wants to send the data (file) 16 created by the in-house SaaS providing server 11 to a person 32 outside the company, the in-house SaaS providing server 11 or this The corresponding data (file) 16 stored in the data server 12 linked to the in-house SaaS providing server 11 is copied to the outside SaaS providing server 21 or the data server 22 linked to this outside SaaS providing server 21, and the data Saved as (file) 23. At that time, the sender 14 performs the following settings.
-E-mail address of destination 32 (e-mail address of person who can access data (file))
Data to be transmitted (file) 23
・ Settings for data (file) 23 to be transmitted-Publication level setting * Location (the presence / absence of location change, the frequency of change)
* Password (whether or not a password is set, whether or not a password is changed, and how often it is changed)
* Domain authentication (whether or not domain authentication is used, registration method of accessible domain, correspondence when reverse lookup is impossible)
・ Period held in the external SaaS providing server 21 (days, retention date, number of accesses, etc.)
・ Setting of access rights to data (file) 23 (editability, browsing only, data copying, etc.)
・ Operation limit settings for data (file) 23 (printability, whether to save to local disk, output in other formats, etc.)
-Settings related to synchronization between the original data 16 and the transmission data 23 (bidirectional synchronization, one-way synchronization, etc.)

  A third embodiment will be described. The present embodiment relates to the location, and as shown in FIG. 3, the location (URL) of the data (file) 23 is sent from the external SaaS providing server 21 to the mail address of the set destination 32. Is sent. The external user 32 who has received the mail 33 accesses the location and browses and edits the data (file) 23. Note that the location is changed periodically or whenever accessed. Security can be strengthened.

  Example 4 will be described. This embodiment relates to a password. As shown in FIG. 3, in order to access the data (file) 23 copied to the external SaaS providing server 21, the external SaaS providing server 21 receives the data. A password is sent to the e-mail address that is set to be accessible. The user 32 accesses the corresponding file with the e-mail address and password. This password is changed periodically or whenever it is accessed. Security can be strengthened.

Example 5 will be described. The present embodiment relates to domain authentication. As shown in FIG. 5, in order to access data (file) copied to an external SaaS providing server, domain authentication is performed based on preset contents. . There are three ways to register accessible domains:
-Enter an accessible domain during setup.
・ Target email address domains.
-Target the IP address when the user first accessed or the domain obtained by reverse lookup from the IP address.
As a processing procedure, when an external user accesses the corresponding data (file) (S101), it is determined whether reverse lookup is possible from the IP address at the time of access (S102). S103), it is confirmed whether or not it matches the domain set above (S104), and access is permitted (S105) or denied (S106). When reverse lookup is not possible, processing is performed based on the setting (S107), and the procedure ends.

  Example 6 will be described. This embodiment relates to a public level, and a public level can be set in advance for data (file) copied to an external SaaS providing server. This is to set how much authentication is strengthened when an external user accesses this data. Specifically, the level can be set according to the combination of authentication methods specified in the embodiments and thereafter.

Example 7 will be described. The present embodiment relates to a retention period, and data (file) copied to an external SaaS providing server is stored based on a preset retention period. The following three retention periods can be set.
-Retention days: Save the specified number of days including the set date.
-Retention date specification: Saved up to the specified date.
-Access count: Stored until the specified data is accessed the specified number of times.
Data (files) that have passed the retention period (number of times) are deleted immediately, or the relevant external user cannot be viewed or modified.

Example 8 will be described. This embodiment relates to the access right, and the data (file) copied to the external SaaS providing server is subjected to access control based on the preset access right. The following two access rights can be set.
-Editable: Data (file) can be edited.
-View only: Can only read (not edit) data (files).
Data copy: Data (file) can be copied to another area in the external SaaS providing server.

Example 9 will be described. The present embodiment relates to operation restrictions, and operations of data (files) copied to an external SaaS providing server are controlled based on preset operation restrictions. The following three operation restrictions can be set.
-Print settings: Settings for preventing data (files) from being printed on a printer or the like.
-Save settings: Settings to prevent data (files) from being saved on the local disk.
Output (save) setting in other formats: Settings for preventing data (files) from being output (saved) in existing software formats (.doc, .pdf, etc.).

Example 10 will be described. The present embodiment relates to synchronization, and when the data (file) sent to the external user is set to be editable, the same data stored in the internal SaaS providing server and the external providing server respectively. Data (that is, original data and transmission data) is synchronized based on the contents set at the time of transmission. The following three ways of synchronization can be set.
-Bidirectional synchronization of original data and transmission data: When a change is made to either original data or transmission data, the change is immediately reflected in the other data.
-One-way synchronization from the original data to the transmitted data: When changes are made to the original data, the changes are immediately reflected in the destination data (even if changes are made to the destination data, the original data The changes are not reflected in the data).
-One-way synchronization from transmission data to original data: When changes are made to the destination data, the changes are immediately reflected in the original data (even if changes are made to the original data, the destination Changes are not reflected in the data.)

  An application example of the present invention will be described. In this application example, it is possible to customize and use the same application (here, “Word”) for each user such as a company. The advantage of customization is an example in which even if data leaks, the data cannot be used unless the company-specific software (Word) is used, and the function can be improved in terms of security.

  As shown in FIG. 5, using the A company, B company, and C company personal computers 42a, 42b, and 42c accessing the dedicated application servers 41a, 41b, and 41c of the A company, B company, and C company, Use dedicated application files for Company A and Company B. The dedicated application servers 41a, 41b, and 41c of the A company, the B company, and the C company are the first or second service providing server in the embodiment. A common key is used for specific customization. In the data (file) created by this application (Word), the same key as that on the server side is embedded, and decryption using the key is performed at the time of use. In an application (Word) with a different key, even if the application (Word) itself is the same, it cannot be opened and a file cannot be used. Further, when the created data (file) is to be used by any application (Word), the key is not embedded in the data (file). Thus, the use of the company A dedicated application file on the former personal computer 42a that has accessed the company A dedicated application server 41a, the use of the company B dedicated application file on the personal computer 42b that has accessed the company B dedicated application server 41b, The company B dedicated application file can be used with the personal computer 421c that has accessed the company dedicated application server 41b. However, the use of the company A dedicated application file on the former personal computer 42a accessing the company B dedicated application server 41b, and the use of the company B dedicated application file on the personal computer 42c accessing the company C dedicated application server 41c, respectively. It is impossible.

  In this application example, the user of the personal computer 42a corresponds to an external user, the company A dedicated application server 41a corresponds to the second service providing server in the embodiment, and the company B dedicated application server 41b corresponds to the second application providing server in the embodiment. By corresponding to one service providing server, the processing described in each of the above embodiments can be realized. Similarly, the user of the personal computer 42c corresponds to an external user, the company B dedicated application server 41b corresponds to the second service providing server in the embodiment, and the company C dedicated application server 41c corresponds to the first in the embodiment. By corresponding to the service providing server, the processing described in each of the above embodiments can be realized.

  In this application example, whether to embed a key and under what conditions (text and data contents) are preset on the application server side. The user can change the setting here within the conditions set on the server side. That is, even if it is set not to embed the key on the server side, the user can embed the key independently on the user side. Conversely, if the server side is set to forcibly embed a key, it cannot be set unless the key is embedded in the data on the user side. It is preferable that the setting can be made on the user side so that security is further enhanced.

1 is an explanatory diagram of a service providing system according to a first embodiment. FIG. 3 is an explanatory diagram of a service providing system according to a second embodiment. Explanatory drawing of the service provision system of Example 3, 4. FIG. Explanatory drawing of an example of the service provision procedure in the service provision system of Example 5. FIG. Explanatory drawing of the example of application of the service provision system of this invention.

Explanation of symbols

DESCRIPTION OF SYMBOLS 11 1st service provision server 12 1st data server 13 Internal network 14, 15 Internal user, user personal computer 16 Data 21 Second service provision server 22 Second data server 23 Data 31 Internet 32 External user User PC 33 Mail 41a, 41b, 41c Company A, Company B, Company C dedicated application servers 42a, 42b, 42c Company A, Company B, Company C

Claims (13)

In a service providing system comprising a first service providing server and a second service providing server connected to the first service providing server and providing the service using the same application on both service providing servers,
The first service providing server provides a service for using an application to a first user who has accessed using a first user personal computer, and the created or edited data or file is stored in the own server. Or save it on a data server linked to your server,
The second service providing server provides a service for using an application to a second user accessed using a second user personal computer, and the created or edited data or file is stored in the own server. Alternatively, the service providing system is characterized in that it is stored in a data server that is linked to the server itself. The service providing system according to claim 1,
The first service providing server or a data server linked to the server is for the first user so that the data or file created by the first service providing server can be used on the second user personal computer. In response to an instruction from a personal computer, the corresponding data or file stored in the first service providing server or the data server linked to the server is copied to the second service providing server or the data server linked to the server. A service providing system characterized by transmitting the information. The service providing system according to claim 2,
The second service providing server transmits an email designating the location of the data or file to the set destination email address, and the second user who receives the email is for the second user. A service providing system characterized in that data (file) can be browsed and edited by accessing the location using a personal computer. The service providing system according to claim 3,
The second service providing server sends a password to an e-mail address set to be accessible to the data or file in order to access the data or file copied to the server or a data server linked to the server. The service providing system is characterized in that the second user can use a second personal computer to access the corresponding file using an e-mail address and a password. The service providing system according to claim 4,
A service providing system, wherein domain authentication is performed based on preset contents in order to access data or a file copied to a second service providing server. The service providing system according to claim 4,
A service providing system characterized in that a public level can be set in advance for data or a file copied to a second service providing server. The service providing system according to claim 1,
The second service providing server stores the data or file copied to the server or a data server linked to the server based on a preset retention period. The service providing system according to claim 1,
The second service providing server controls access to data or a file copied to the server or a data server linked with the server based on a preset access right. The service providing system according to claim 1,
The service providing system, wherein the second service providing server controls an operation based on an operation restriction set in advance for data or a file copied to the own server or a data server linked to the own server. The service providing system according to claim 1,
When the first service providing server and the second service providing server are set so that the data or file sent to the second user can be edited, the original data that is the same data stored respectively A service providing system characterized in that transmission data is synchronized based on contents set at the time of transmission. The service providing system according to claim 10,
The first service providing server and the second service providing server can immediately synchronize the other data when either the original data or the transmission data is changed as bidirectional synchronization of the original data and the transmission data. A service providing system that reflects changes. The service providing system according to claim 10,
In the first service providing server and the second service providing server, as a one-way synchronization from the original data to the transmission data, when the original data is changed, the change is immediately reflected in the destination data. A service providing system characterized in that even if a change is made to data at the transmission destination, the change is not reflected in the original data. The service providing system according to claim 10,
In the first service providing server and the second service providing server, as a one-way synchronization from the transmission data to the original data, when a change is made to the destination data, the change is immediately reflected in the original data. The service providing system is characterized in that even if a change is made to the original data, the change is not reflected in the destination data.

Images