JP2011150388A - System for converting file storage destination path based on secrecy section information, and method - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide a system for converting file storage destination paths based on secrecy section information which can classify and store file storage destinations in accordance with a criterion such as cautiousness and importance in handling without imposing a load on a user; and to provide a method therefor. <P>SOLUTION: The system for converting file storage destination paths based on secrecy section information includes: a secrecy section-determining means which receives file-storage requests from clients, acquires keywords included in the files for which the storage requests are received, and determines secrecy sections which correspond to the keywords on the basis of information on secrecy sections which correspond to the keywords preliminarily stored in a secrecy section policy database; a storage path-converting means which converts the secrecy sections obtained from the result of the determination to the corresponding storage path information on the basis of storage path information which stores the secrecy sections obtained from the result of the determination in a path converting policy database and corresponds to the secrecy sections; and a means which stores the files for which the storage requests are made in virtual folders on converted storage paths, and stores the file names, secrecy sections, storage paths and virtual folder paths in a file information database. <P>COPYRIGHT: (C)2011,JPO&INPIT

Description

  The present invention relates to metadata management related to files and folders on a file server, and a file storage destination path conversion system and method corresponding to metadata information.

  Currently, from the viewpoint of security and compliance, appropriate security management according to file contents is required for files used by companies. ISO 27001, the de facto standard for information security, stipulates that information handled by companies including files should be classified according to its value, legal requirements, sensitivity and importance of handling, and handled according to appropriate handling standards. Many companies have a rule to classify file storage destinations according to the above characteristics.

Currently, files are shared mainly through file servers that are existing technologies. At this time, a general file server shares a folder storing files, sets a user ID or a user ID group that can access the folder, and implements file sharing and access control.
As a mechanism for sharing files with emphasis on manageability, a product in a field called a document management system (Non-Patent Document 1) is used. This type of document management system registers and shares files in the repository provided by the product, and implements file sharing and access control by setting user IDs or user ID groups that can access the files. is doing. The idea of grouping user IDs is mostly in the case of departments or post units as in the case of using a file server.

uCosminexus DocumentBroker http://www.hitachi.co.jp/Prod/comp/soft1/docbro/

In file sharing via a file server, folder and file names themselves are information for classification. For this reason, in order to satisfy the requirements required by ISO27001 described above, a folder corresponding to the criteria such as value, legal requirement, carefulness of handling, importance is created, and the user saves an appropriate storage destination from the contents of the file. It is necessary to determine the folder and save it.
In this case, a file may be stored in an inappropriate folder due to a user's judgment error, and inappropriate file browsing by an unintended user may occur.
Further, the operation of sequentially checking the contents of a file when saving the file places a heavy load on the user's daily work.

When sharing files using a document management system, it is necessary to register management metadata appropriate for the contents of the file at the timing of saving the file in the repository, so everything from miscellaneous to completed When sharing various files handled by a company according to criteria such as value, legal requirements, carefulness of handling, importance, etc., registration of metadata becomes a heavy burden on users.

  The object of the present invention is based on classified information that can classify the storage destination of a file according to criteria such as value, legal requirement, carefulness of handling, and importance without imposing a heavy operational load on the user. Another object is to provide a file storage destination path conversion system.

In order to solve the above problem, the file storage destination path conversion system based on the confidential classification information of the present invention receives a file storage request from a client computer, acquires a keyword included in the file that has received the storage request, and A security classification determination means for determining the security classification corresponding to the keyword based on the information of the security classification corresponding to the keyword stored in advance in the security classification policy database, and the security classification corresponding to the security classification corresponding to the security classification of the determination result stored in the path conversion policy database. A storage path conversion unit that converts the classified classification of the determination result into corresponding storage path information based on the storage path information, and stores the file requested to be stored in the virtual folder on the storage path after conversion, and the file name, The confidential information, storage path, and virtual folder path are set in the file information database. Characterized in that it comprises a means for storing the.
In the file storage destination path conversion method based on the security classification information of the present invention, the server that converts the file storage destination receives the file storage request from the client computer, acquires the keyword included in the file that has received the storage request, A first step of determining the classified classification corresponding to the keyword based on information of the classified classification corresponding to the keyword stored in the classified classification policy database in advance, and the classified classification corresponding to the classified classification result stored in the path conversion policy database A second step of converting the classified classification of the determination result into corresponding storage path information based on the storage path information of the file, storing the file requested to be stored in the virtual folder on the storage path after conversion, and the file name , Classified information, storage path, virtual folder path, file information database File destination path conversion method based on the classification levels information, characterized in that it comprises a third step of storing the.

  As described above, according to the file storage destination path conversion system and method based on the security classification information of the present invention, the value, legal requirement, carefulness of handling, importance, etc. can be obtained without imposing a large operational load on the user. The file storage destination can be classified according to the standard.

1 is a system configuration diagram showing an embodiment of the present invention. It is a block block diagram of a client computer. It is a specific example of the folder sharing state of a file server. It is a block block diagram of a path conversion server. It is a table structure of a confidential classification determination policy database. It is a table structure of a path conversion policy database. It is a table structure of a file information database. It is the processing flow of the whole file preservation | save process. It is a processing flow of confidential classification determination processing. It is a processing flow of a path conversion process. It is a processing flow of a file preservation | save process.

FIG. 1 is a system configuration diagram showing an embodiment of the present invention.
The file storage destination path conversion system based on the confidential classification information of this embodiment includes a path conversion server 100, a client PC 101 that shares a file via the path conversion server 100, and file servers (A) 102a and (B) 102b. Composed. The path conversion server 100, the client PC 101, and the file servers (A) 102a and (B) 102b are each connected to a wired LAN 103, and the client PC 101 is on the file servers 102a and 102b only through communication with the path conversion server 100. You can access files stored in

FIG. 2 is a block configuration diagram of the client PC 101.
The client PC 101 includes a file operation application 210, and the file operation application 210 includes a virtual folder / file information display unit 211 and a virtual folder / file operation unit 212.
A typical file operation application is Windows Explorer included in Windows (registered trademark of Microsoft Corporation), which is an OS (Operating System) developed and sold by Microsoft Corporation. The operation application 210 is different from Windows Explorer in that it does not directly display the folder on the file server, but displays and processes the virtual folder information associated with the file as a folder instead of the folder.

FIG. 3 is a specific example of the folder sharing state of the file servers 102a and 102b. In this specific example, the server name of the file server (A) 102a is set to “ServerA”, and the folder a301 is set to share with the folder name “Common”.
The file server (B) 102b has the server name set as “ServerB”, and the folder b311 is set to share with the folder name “TopSecret”.

FIG. 4 is a block configuration diagram of the path conversion server 100.
The path conversion server 100 includes a path conversion application 410, a security classification determination processing unit 420, a path conversion processing unit 430, a file system 440, and a mount processing unit 450.
The file system 440 and the mount processing unit 450 are existing technologies, and a shared folder of an existing file server can be assigned to the mount point (A) 441 and the mount point (B) 442. By accessing the point (A) 441 and the mount point (B) 42, it becomes possible to access the shared folder of the mounted file server.
In the system configuration showing an embodiment of the present invention, the folder a301 is mounted on the mount point (A) 441 with the shared name “\\ ServerA \ Common”, and the folder b311 is “ It is mounted with the shared name "\\ ServerB \ TopSecret".

FIG. 5 shows a table structure of the security classification determination policy DB 422.
As shown in the figure, it is composed of a confidential classification 501 and a related keyword 502.
In the confidential classification 501 and the related keyword 502, contents in accordance with the security policy of the company are registered when this system is introduced. For example, in the corporate security policy, if the rules are set to “categorize and manage information into three types: general, confidential, and confidential”, as shown in the figure, “general”, “confidential”, “externally confidential” Are registered in the security classification 501. In addition, if the keyword that is the condition for determining that the confidential classification of the file content is “confidential” is “confidential”, “management meeting”, “M & A”, etc., the relevant keyword is selected as shown in the figure. Register to the related keyword 502.
In the present invention, since it is possible to use a method other than simple keyword matching as a condition for determining the confidential classification of the file contents, the necessary elements are set according to the method used for the confidential classification determination. May be added to the table.

FIG. 6 shows the table structure of the path conversion policy DB 431.
As shown in the figure, it is composed of a security classification 601 and a storage route path 602.
In the confidential classification 601 and the storage route path 602, contents in accordance with the company security policy are registered when this system is introduced. For example, in the corporate security policy, when it is determined that “files with the confidential classification“ confidential ”are stored in the folder b 311 of the file server B 310”, as shown in the figure, the confidential classification 601 is classified according to the policy. The category “Top Secret” is registered, and the shared name “\\ ServerB \ TopSecret” of the folder b 311 is registered in the storage route path 602.

FIG. 7 shows the table structure of the file information DB 433.
As shown in the figure, the file name 701, the security classification 702, the storage path 703, and the virtual folder path 704 are configured. In each item, information on the result processed by the path conversion processing unit 430 in response to an end user file storage request is registered.

FIG. 8 is a flowchart showing an overview of the entire file storage process.
When the end user executes a file save operation on the virtual folder / file information display unit 211 of the file operation application 210 running on the client PC 200, the file operation unit 212 issues a file save request. In this process, the path conversion application 410 of the path conversion server 100 acquires a file storage request from the file operation unit 212 (step 801), and determines the confidential classification of the contents included in the file (step 802).
Next, the storage path information included in the file operation request (in this case, the virtual folder path information specified by the end user in the virtual folder / file information display unit 211) is converted into a storage path corresponding to the security classification (step) 803).
Next, according to the file operation request, the file is stored in the storage path converted in step 803 (step 804). By performing this series of file saving processing, it becomes possible to save the file in a shared folder on the file server in accordance with the security classification according to the content of the file, which is different from the virtual folder designated by the end user. .

FIG. 9 is a flow showing an outline of the security classification determination process according to the contents of the file.
In this process, the path conversion application 410 that has received the file save request of the end user receives the security classification determination request generated for the security classification determination processing unit 420, and acquires the file content / security classification information of the file. (Step 901), whether or not the file has already been classified as confidential and is registered in the file information DB 433 is checked (Step 902) and determined (Step 903). If registered, the classified information of the file assigned from the file information DB 433 is returned.

If the information of the file and the confidential classification of the file are not registered, the entire contents of the file are searched (step 904).
Next, in the search result, the confidential classification determination policy DB 422 is collated (step 905), and it is determined whether there is a match with the keyword registered in the related keyword 502 (step 906). If there is a keyword, a confidential classification corresponding to the keyword is assigned and returned (step 907).
If there is no keyword, a predetermined classified classification is assigned and returned (step 908).

By performing this series of security classification determination processing, it is possible to classify the file into an appropriate security classification without imposing a visual check on the file contents on the user.
Also, in this process, if the result of matching the full-text search result of the content included in the file with the confidentiality classification policy is that the content included in the file does not include any keyword related to any confidentiality classification Can be set to assign the confidential classification “confidential”, so that it is possible to eliminate omission of registration of the confidential classification for files stored in the file server.

  FIG. 10 is a flowchart showing an outline of the path conversion process. In this process, the file name and confidential classification information of the file are acquired (step 1001), and it is determined whether the file information is registered in the file information DB 433 (step 1002). Next, when the file information is registered in the file information DB 433, the storage path information registered in association with the file information is acquired and returned (step 1003). If the file information is not registered in the file information DB 433, the storage route path information corresponding to the security classification assigned to the file is acquired from the path conversion policy DB 431 and returned (step 1004). By performing this series of path conversion processing, it is possible to select an appropriate storage destination path according to the confidential classification of the file.

FIG. 11 is a flowchart showing an outline of the file saving process.
In this process, the file name, confidential classification, storage path, and virtual folder path information of the file that is the target of the storage request are acquired (step 1101), and the file is stored in the specified storage path (step 1102).
Next, the file name, confidential classification, storage path, and virtual folder path information of the stored file are registered in the file information DB 433 (step 1103). By performing this series of file storage processing, it is possible to realize file storage in an appropriate storage destination folder and retention of file management information in accordance with the confidential classification of the file.

DESCRIPTION OF SYMBOLS 100 ... Path conversion server, 101 ... Client PC, 102a ... File server (A), 102b ... File server (B), 103 ... LAN, 201 ... File operation application, 202 ... Virtual folder and file information display part , 203 ... Virtual folder / file operation section, 301 ... Folder a, 311 ... Folder b, 410 ... Path conversion application, 411 ... File operation request acquisition section, 412 ... File operation request return section, 420 ... Security classification determination processing section, 421: Confidential division determination unit, 422 ... Confidential division determination policy DB, 430 ... Path conversion processing unit, 431 ... Path conversion policy DB, 432 ... Database processing unit, 433 ... File information DB, 440 ... File system, 441 ... Mount point 1,442 ... Mount point , 450 ... mount processing unit

Claims (2)

  Receives a file save request from a client computer, obtains a keyword contained in the file for which the save request is accepted, and based on the classified information corresponding to the keyword stored in advance in the classified classification policy database, the classified classification corresponding to the keyword A security classification judging means for judging, a storage path converting means for converting the security classification of the judgment result into corresponding storage path information based on the security path corresponding to the security classification stored in the path conversion policy database as the security classification of the judgment result; Storing a file requested to be stored in a virtual folder on the converted storage path, and storing a file name, a security classification, a storage path, and a virtual folder path in a file information database. File storage path conversion system based on security classification information Temu. A storage path conversion method for storing a file in a file storage path based on confidential information,
A keyword in which a server that converts a file storage location receives a file storage request from a client computer, acquires a keyword included in the file for which the storage request has been received, and previously stores a security classification corresponding to the keyword in the security classification policy database And a storage path corresponding to the classified classification result based on the storage path information corresponding to the classified classification stored in the path conversion policy database. The second step of converting to information and the file requested to be stored in the virtual folder on the storage path after conversion are stored, and the file name, confidential classification, storage path, and virtual folder path are stored in the file information database. Security classification characterized by comprising a third step File destination path conversion method based on the broadcast.

Images