JP2011209868A - Relay device - Google Patents

Abstract

PROBLEM TO BE SOLVED: To set access rights for a file stored in an external storage device and realize file sharing accompanied by access restriction based on the access rights, without converting a file system implemented on the external storage device connected to a relay device to a different system and without using a dedicated device for access restriction.SOLUTION: An external storage device 40 is connected to a router 30, and the external storage device 40 has a file system having a directory structure for hierarchically storing files. When an instruction is given from a subordinate communication terminal 22 to set access rights for a file stored in the external storage device, the router 30 writes an access right file for specifying the access rights in a directory at the same level as that of the file to which access rights are set, and thereafter determines whether access to the file is allowed, according to the contents of the access right file.

Description

  The present invention relates to a relay device such as a router or a switching hub, and more particularly to a technique for realizing file sharing using a relay device.

  In companies and the like, it is common practice to construct a company-wide information system by connecting a LAN (Local Area Network: hereinafter referred to as an intra-site LAN) installed at each site such as a branch office to a general public network such as the Internet. ing. A relay device called a router is used to connect the local LAN to the general public network. Generally, a router connects from the first layer (physical layer) to the third layer (network layer) of the OSI reference model, and relays data transmitted according to a network layer communication protocol such as IP (Internet Protocol). It is a relay device that performs.

  File sharing is one of the techniques for enabling smooth operations in such an information system. File sharing refers to, for example, connecting a computer device called a file server to a local LAN, and executing various data files and program execution format files (hereinafter simply “files”) stored in the file server to the local LAN. This refers to enabling access from a connected communication terminal or a communication terminal connected to a general public network. Here, accessing a file means reading the contents (or rewriting the contents) if the file is a data file. If the file is an executable file of a program, the contents are read. In addition to reading and writing, it means operating a CPU (Central Processing Unit) according to the executable file.

  By the way, when performing file sharing as described above, in order to prevent leakage of confidential information, falsification of information, etc., access authority should be defined for each file, and access restriction based on the access authority should be performed. Is preferred. However, if the file system of the file server does not always support setting of access rights, and if it does not support setting of access rights, such as FAT (File Allocation Table) 32, access restrictions are imposed. Cannot be realized. The FAT32 is a file system that is normally adopted in a Windows (registered trademark) 9x OS (Operating System). Therefore, various techniques for solving such problems have been proposed, and examples thereof include those disclosed in Patent Documents 1 to 4. The techniques disclosed in Patent Documents 1 to 3 are techniques for solving the above problem by providing a dedicated device in charge of only access control separately from the file server. The technique disclosed in Patent Document 4 is a symbolic link. This is a technique for solving the above problem by constructing a virtual file system according to the access authority using.

Japanese Patent Laid-Open No. 11-212849 JP 2002-342144 A JP 2004-303023 A Japanese Patent No. 4342242

  Incidentally, in recent years, it has been proposed that a relay device such as a router has a file server function. Specifically, an external storage device (for example, a USB (Universal Serial Bus) memory) storing various files is connected to the relay device, and the various files stored in the external storage device are subordinate to the relay device. The communication terminal (communication terminal connected to the local LAN connected to the general public network by the relay device and using the relay device as a default gateway) or the communication terminal connected to the general public network is shared. . By doing so, it is expected that it is not necessary to separately introduce a file server, and the system construction cost can be reduced.

However, the problem here is that an external storage device such as a USB memory often employs a file system such as FAT32 that does not support setting of access authority. It is a point that the file sharing with the access restriction based on cannot be realized. Of course, it is possible to realize setting of access authority using the techniques disclosed in Patent Documents 1 to 4, even in a mode in which the file sharing function is realized by causing the relay device to bear the file server function. is there. However, as disclosed in Patent Documents 1 to 3, separately providing a dedicated device that is in charge of only the access restriction is not suitable for the original purpose of reducing the system construction cost by causing the relay device to have a file server function. . In addition, the OS of the relay device does not always support symbolic links, and the technique disclosed in Patent Document 4 cannot always be applied. However, other file systems that support setting of access authority for the file system of the external storage device (for example, NTFS (NT File System) or ext2 (second extended file)
Although it is possible to eliminate the above-mentioned problems by converting to (system), etc.), there is a problem that it takes a lot of time to convert such a file system. For example, it takes about 3 to 4 hours to convert a FAT32 format file system having a storage capacity of 500 GB to NTFS.
The present invention has been made in view of the above problems, and converts a file system built in an external storage device connected to a relay device into another one or uses a dedicated device for access restriction. Rather, it is an object of the present invention to provide a technique for setting access authority to a file stored in the external storage device and realizing file sharing with access restriction based on the access authority.

  In order to solve the above problems, the present invention, when receiving a packet transmitted from a subordinate communication terminal, forwards the packet to its destination, and receives a packet transmitted to the subordinate communication terminal Includes a packet transfer control means for transferring the packet to the destination communication terminal, an external device connection means for connecting an external storage device having a directory-structured file system for storing files hierarchically, and the external device When an instruction to set access authority for a file or directory stored in an external storage device connected to the connection means is received from a communication terminal, the access authority for each owner of the file or directory and each other person Create an access authority file that specifies the file or directory and store the file or directory. When a request for access to a file or directory stored in an external storage device connected to the external device connection means is received from a communication terminal, the file or directory is stored. A file sharing service providing means for executing access control processing for determining access permission by referring to an access authority file stored in a directory or a higher-level directory. A relay device is provided.

  According to such a relay device, an access authority file (hereinafter, referred to as a file or directory to be accessed (hereinafter, the file and the directory may be collectively referred to as “file etc.”) is stored. In accordance with an access authority file stored in the same directory as the file to be accessed) or an access authority file stored in a higher-level directory, whether to access the file or the like is determined. For this reason, even if the file system built in the external storage device does not support the setting of access authority like FAT32, the file system is converted to the other file system without converting it to another file system. By setting access authority, file sharing with access restriction based on the access authority can be realized. As another aspect of the present invention, an aspect in which a program that causes the computer device to execute the access authority setting process and the access control process is also conceivable.

  In a more preferred aspect, the file sharing service providing means of the relay device generates the access authority file as a hidden file in the access authority setting process. In general, a hidden file is displayed as an icon or the like corresponding to the hidden file unless a special setting for displaying the hidden file is made to the file manager (Explorer in the case of Windows (registered trademark)). Is never done. Therefore, if the access authority file is a hidden file, it is possible to prevent the access authority file from being accidentally deleted or the contents of the access authority file being altered using an editor or the like. As another mode for preventing falsification, in the access authority setting process, the generated access authority file is encrypted and stored in the external storage device, and is referenced in the access control process. It is also conceivable to decrypt the encrypted access authority file.

  In a more preferred aspect, communication terminals that communicate via the relay device are divided into groups that are allowed to share files or directories stored in the external storage device and groups that are not allowed to share. The file sharing service providing means executes the access authority setting processing only when the setting instruction is received from a communication terminal belonging to the former group, and the access request is received from the communication terminal belonging to the group. The access control process is executed only when a message is received. In a further preferred aspect, a plurality of external storage devices are connected to the external device connection means, and a group of communication terminals that permits sharing of files or directories stored in the external storage device for each external storage device Is defined. According to these aspects, finer access restrictions can be realized. Here, various ways of grouping communication terminals may be considered in relation to the type of relay device. For example, when the relay device is a switching hub, file sharing is possible or not (or stored in any external storage device) for each port connected to another communication device such as a communication terminal, another switching hub, or a router. Grouping may be performed by deciding whether or not to share a file or the like that is shared, and when the relay device is a router, grouping may be performed using a VLAN (Virtual LAN) tag. The switching hub is a relay device that relays data in the data link layer, which is a protocol layer one level lower than the network layer.

It is a figure which shows the structural example of the communication system containing the router 30 of one Embodiment of this invention. 3 is a diagram showing an example of a directory structure of an external storage device 40 connected to the router 30. FIG. 3 is a block diagram showing a configuration example of the router 30. FIG. 4 is a diagram showing an example of a file format and access authority information of an access authority file stored in the external storage device 40. FIG. FIG. 6 is a diagram for explaining access authority setting processing executed by a control unit 310 of the router 30. It is a figure which shows an example of the screen displayed on the display part of the communication terminal 22, when setting an access authority. It is a figure for demonstrating the update of the access authority file accompanying deletion or movement of a file.

Hereinafter, embodiments of the present invention will be described with reference to the drawings.
(A: Configuration)
FIG. 1 is a diagram illustrating a configuration example of a communication system including a router 30 which is an embodiment of a relay device of the present invention. This communication system is configured, for example, by connecting an intra-site LAN 20 laid at a company base to a general public network 10 via a router 30. In FIG. 1, only one local LAN is illustrated, but a plurality of local LANs may be connected to the general public network 10 via separate routers. The general public network 10 is an IP network such as the Internet (communication network that mediates IP-compliant data communication), and is shared by an unspecified number of people. Communication terminals 22A, 22B and 22C used by respective users (employees of the company) are connected to the local LAN 20. Of course, these communication terminals may be shared by a plurality of users, but in this embodiment, one user is predetermined for each of these communication terminals in order to avoid complicated description. . Hereinafter, the user of the communication terminal 22A is called “user A”, the user of the communication terminal 22B is called “user B”, and the user of the communication terminal 22C is called “user C”. These users are grouped into a plurality of groups in advance according to their departments. For example, in this embodiment, user A belongs to “group 1”, user B and user C belong to “group 2”, and so on.

  Each of the communication terminals 22A, 22B, and 22C in FIG. 1 is a personal computer, and is another communication device (a WWW server connected to the general public network 10 or another communication connected to the local LAN 20). Data communication can be performed with a terminal according to a predetermined protocol. Below, when it is not necessary to distinguish each of communication terminal 22A, 22B, and 22C, it describes with "communication terminal 22". The communication terminal 22 stores in advance an identifier that uniquely identifies the user of the device (hereinafter, a user identifier) and an identifier that uniquely identifies a group to which the user belongs (hereinafter, a group identifier). Although FIG. 1 illustrates the case where three communication terminals are connected to the in-site LAN 20, four or more communication terminals may be connected to the in-site LAN 20, and 1 or 2 Communication terminals may be connected to the local LAN 20.

  The router 30 is a communication device that serves as a default gateway for the communication terminal 22. For this reason, the communication address of the router 30 (for example, an IP address or a MAC (Media Access Control) address) is stored in the communication terminal 22 as data indicating the default gateway. As shown in FIG. 1, an external storage device 40 is connected to the router 30. The external storage device 40 is a USB memory, for example. In the external storage device 40, a file system having a directory structure (see FIG. 2A) for storing files hierarchically is constructed, and a plurality of files are hierarchically stored. Specifically, as shown in FIG. 2A, a directory “A”, a directory “B”, and a file fileC are stored in the root directory “¥” of the file system, and a file fileA1 is stored in the directory “A”. The file fileA2 and the file “fileB” are stored in the directory “B”. These files fileA1, fileA2, fileB, and fileC are text files and program executable files. In the present embodiment, FAT32 is adopted as the file system. In the present embodiment, the external storage device 40 is a USB memory. However, the external storage device 40 may be a USB-connected hard disk or a SCSI (Small Computer System Interface) -connected hard disk, and may be an SD memory card or the like. Of course, it may be a flash memory card. In short, any storage device having a file system capable of storing files and the like in a hierarchical manner may be used as long as the storage device is externally attached to the router 30 through some interface.

  The router 30 according to the present embodiment has a function for realizing the above-described file sharing (hereinafter referred to as a file sharing service providing function), and a file stored in the external storage device 40 connected to the own device. Can be shared by the users of the communication terminals under the control of the own device (communication terminal having the router 30 as a default gateway: that is, the communication terminal 22). As described above, FAT32 does not support setting of access authority. However, in this embodiment, access authority to the above-mentioned file or the like is obtained by causing the router 30 to perform processing that clearly shows the features of this embodiment. And file sharing with access restriction based on the access authority is realized. Hereinafter, description will be made focusing on the router 30 that clearly shows the features of the present embodiment.

  FIG. 3 is a block diagram illustrating a configuration example of the router 30. As shown in FIG. 3, the router 30 includes a control unit 310, a first communication interface (hereinafter, I / F) unit 320, a second communication I / F unit 330, an external device I / F unit 340, a storage unit 350, And a bus 360 that mediates data exchange between these components.

  The control unit 310 is a CPU, for example. The control unit 310 functions as a control center that controls the operation of each unit of the router 30 by executing various programs stored in the storage unit 350 (more precisely, the nonvolatile storage unit 354). Details of processing executed by the control unit 310 according to various programs will be clarified later.

  The first communication I / F unit 320 and the second communication I / F unit 330 are both NIC (Network Interface Card) and are connected to different communication networks. Specifically, the first communication I / F unit 320 is connected to the general public network 10, and the second communication I / F unit 330 is connected to the local LAN 20. The first communication I / F unit 320 and the second communication I / F unit 330 divide a packet (communication message by a predetermined data size by a predetermined amount of data received from each connection destination communication network, The data block obtained by adding the header is transferred to the control unit 310 and the packet transferred from the control unit 310 is sent to each communication network of the connection destination.

  The external device I / F unit 340 is a collection of interfaces that exchange data with an external device such as a USB memory or a serial console according to a predetermined protocol (USB or RS-232C). For example, when a USB memory or a USB-connected hard disk is used as an external device, a USB interface may be included in the external device I / F unit 340. Similarly, when an SD memory card is used as an external device, an SD memory card reader may be included in the external device I / F unit 340. When an SCSI hard disk is used as an external device, a SCSI interface card or the like is used. It may be included in the external device I / F unit 340. When a serial console is used as an external device, a serial interface such as an RS-232C interface may be included in the external device I / F unit 340. In the present embodiment, since the external storage device 40 is connected to the router 30, the external device I / F unit 340 includes a USB interface.

The storage unit 350 includes a volatile storage unit 352 and a nonvolatile storage unit 354. The volatile storage unit 352 is a volatile memory such as a RAM (Random Access Memory), for example, and is used as a work area when the control unit 310 executes various programs. The nonvolatile storage unit 354 is, for example, an EPROM (Erasable Programmable Read Only
Various data and programs are stored in advance in the nonvolatile storage unit 354. As an example of data stored in the nonvolatile storage unit 354, there is data necessary for executing packet transfer control such as a so-called routing table (not shown in FIG. 2). Since the data necessary for executing these packet transfer controls is not particularly different from that of a general router, detailed description thereof is omitted.

  Examples of programs stored in advance in the nonvolatile storage unit 354 include a packet transfer control program and a file sharing service providing program. When detecting that the power (not shown) of the router 30 is turned on, the control unit 310 reads these two programs from the non-volatile storage unit 354 to the volatile storage unit 352 and starts executing them. The packet transfer control program is a control unit that controls the transfer of packets received via the first communication I / F unit 320 (or the second communication I / F unit 330) (transfer control based on the packet destination IP address). This program is executed by 310. The packet transfer process executed by the control unit 310 according to the packet transfer control program is not particularly different from that executed by a general router, and thus detailed description thereof is omitted.

  On the other hand, the file sharing service providing program is a program for causing the control unit 310 to realize the access authority setting process and the access control process of FIG. Details of these processes will be clarified in an operation example in order to avoid duplication, but the outline is as follows.

  The access authority setting process is a process of executing access authority setting for a file or the like stored in the external storage device 40 connected to the external device I / F unit 340 in accordance with an instruction from the communication terminal 22. More specifically, when the control unit 310 receives a communication message (hereinafter, a setting instruction message) for instructing setting of access authority for a file or the like from the communication terminal 22, the access authority corresponding to the content of the message is received. Generate a file and store it as a hidden file in the directory that stores the file for which access authority is to be set. Here, the hidden file is a file having a file name beginning with “.” In the case of a Windows (registered trademark) OS or a UNIX (registered trademark) OS, for example, and in the case of a file manager (Windows (registered trademark)). Unless there is a special setting for Explorer, an icon corresponding to the hidden file is not displayed. In this embodiment, a file having a file name beginning with “.” Is treated as a hidden file, as in the Windows (registered trademark) OS and the UNIX (registered trademark) OS. As described above, the reason why the access authority file is a hidden file will be clarified later.

  In the present embodiment, the setting instruction message transmitted from the communication terminal 22 includes information indicating the file or the like for which access authority is set, the user identifier of the owner of the file, and the group of the group to which the owner belongs. An identifier and access authority information indicating the contents of the access authority are written. Although details will be described later, the control unit 310 generates an access authority file based on the user identifier or the like written in the setting instruction message received from the communication terminal 22 and assigns a file name “.ACL”. And store it in the directory that stores the setting target file.

  FIG. 4A shows an example of the file format of the access authority file. As shown in FIG. 4A, the access authority file includes a name of a file or the like whose access authority is defined by the access authority file, a user identifier of the owner of the file, and a group of groups to which the owner belongs. This is a set of records including an identifier and access authority information indicating the access authority. As a specific implementation method of this access authority file, it may be implemented as a text file in which the above-mentioned various data are delimited by a predetermined character such as CSV (Comma-Separated Values) format, such as a relational database. It may be implemented as a table. The access authority information written in this access authority file indicates the access authority of the owner of the file, the access authority of other users belonging to the same group as the owner, and the access authority of other users. In the embodiment, these three types of access authority are represented by three-digit numbers such as “755”, “777”, and “640”. The meaning of these three digits is as follows.

  As shown in FIG. 4B, the most significant digit (eg, “6” in “640”) of the above three digits indicates the access authority of the owner of the file or the like, and the middle digit (eg, “640”). “4” in the table indicates the access authority of other users who belong to the same group as the owner, and the least significant digit indicates other users (not the owner, and other members who belong to the same group as the owner). (Not user). The numerical value of each digit is a value in the range of 0 to 7, and can be represented by a 3-bit binary number. For example, “6” is expressed as “110”, and “4” is expressed as “100”. The most significant bit of these 3-bit binary numbers indicates whether or not reading of a file or the like is permitted (“1” is “permitted”, “0” is “not permitted”). Similarly, the middle bit of the 3-bit binary number indicates whether or not writing to a file or the like is permitted, and the least significant bit indicates whether or not execution of a file or the like is permitted. That is, if the access authority information for a file or the like is “640”, the access authority information is “the owner is permitted to read and write to the file, etc., and the owner. The other users in the same group are permitted only to read the file, and the other users are not permitted to read, write, and execute. " When the file etc. is a directory, “read” means “refer to a list of names of files etc. stored in the directory”, and “write” means “stored in that directory”. "Deleting a file etc. or creating a new file" means "execution" means "accessing the directory (for example, positioning the directory in the current directory by a cd command, etc.)" Means. In the present embodiment, the access authority to the file or the like is expressed by a numerical value in the range of 0 to 7, but “r”, “w”, “x”, and “x” are the same as those in the UNIX (registered trademark) OS. The access authority may be expressed by a combination of “-”. Specifically, a character string “rwxr-xr-x” may be used instead of the numeric character string “755”.

  If the access authority file is already stored in the directory storing the access authority setting target file or the like, the control unit 310 displays a record corresponding to the content of the setting instruction message in the access authority file. (Or overwrite the existing record with the record). In addition, when it corresponds to overwriting of an existing record, in the access authority setting process of the present embodiment, the user identifier included in the existing record matches the user identifier included in the setting instruction message. Only when the user identifiers do not match, an error message is returned. That is, in this embodiment, only the owner of a file or the like can change the access authority of the file or the like. In the present embodiment, only the owner of a file or the like can change the access authority of the file or the like, but the user identifier included in the existing record and the user identifier included in the setting instruction message are Of course, overwriting may be performed regardless of whether or not they match. With such an aspect, it becomes possible to change the owner of a file or the like in addition to changing the access authority of the file or the like.

When the access control process receives an access request for a file or the like stored in the external storage device 40 connected to the external device I / F unit 340 from the communication terminal 22 under its control, the access control process displays the file or the like to be accessed. This is a process of determining whether to allow access according to an access authority file stored in a stored directory or an access authority file stored in a higher level directory. For example, in the situation where the access authority file is stored in the root directory “¥” and the directory “A” as shown in FIG. 2B, when an access request for the file fileC (or fileA1 or fileA2) is received, The control unit 310 determines whether or not to allow access according to an access authority file stored in the directory (that is, the root directory “¥” or the directory “A”) that stores the file to be accessed. On the other hand, when the access request for the file fileB in FIG. 2B is received, the control unit 310 does not store the access authority file in the directory storing the file to be accessed. The access permission file is determined according to the access authority file stored in the root directory “¥”, which is a directory one level higher. If an access request file is not stored in the root directory “¥” when an access request is made to the file fileB, the control unit 310 may permit the access unconditionally. Conversely, the access may be denied unconditionally.
The above is the configuration of the router 30.

(B: Operation)
(B-1: Operation in access authority setting process)
Hereinafter, as shown in FIG. 2A, from the state where the access authority is not set at all, each of the user A and the user B sequentially sets the access authority for each of the directory “A” and the directory “B”. The operation performed by the router 30 will be described by taking the case of doing as an example.

  First, the case where the user A sets the access authority for the directory “A” will be described. The user A operates an operation unit (not shown) of the communication terminal 22A, and gives an instruction to display an image indicating a hierarchical relationship of directories in the external storage device 40 (hereinafter referred to as directory tree). For example, if the OS of the communication terminal 22A is a Windows (registered trademark) system, the user A first clicks the “My Network” icon to display the “My Network” window on the communication terminal. For example, clicking a “router” icon (that is, an icon corresponding to the router 30) displayed in the “network” window. The control unit of the communication terminal 22A to which such an instruction is given generates a communication message for requesting transmission of directory information representing the directory tree in the external storage device 40 (hereinafter, a directory information transmission request message), It transmits to the router 30 as a default gateway. When receiving the directory information transmission request message via the second communication I / F unit 330, the control unit 310 of the router 30 reads the directory information from the external storage device 40 and returns this directory information to the communication terminal 22A. When receiving the directory information, the control unit of the communication terminal 22A displays an image (see FIG. 6A) showing the directory tree in the external storage device 40 on the display unit according to the directory information.

  The user A who has visually recognized the hierarchical relationship of the directory constructed in the external storage device 40 as described above selects a file or the like for which access authority is desired and sets the access authority for the file or the like. Perform the operation. Specifically, right-clicking (clicking with the right button provided on the mouse) an icon corresponding to a file or the like for which access authority is desired is set. When such an operation is performed, the control unit 310 of the communication terminal 22A transmits to the router 30 a communication message requesting transmission of access authority information such as a file designated as an access authority setting target. In this communication message, an identifier indicating a file or the like designated as an access authority setting target is written.

  When the control unit 310 of the router 30 receives this communication message, the access authority file storing access authority information such as the file indicated by the identifier written in the communication message (in the same hierarchy as the file indicated by the identifier). It is determined whether there is a stored access authority file. When there is a corresponding access authority file and the corresponding access authority information is written in the access authority file, the control unit 310 displays the access authority information, the user identifier, and the group identifier in the access authority file. And returns to the communication terminal 22A. Conversely, when there is no corresponding access authority file, or when there is a corresponding access authority file but the corresponding access authority information is not written, the control unit 310 responds that there is no corresponding access authority information. To the communication terminal 22A. In this operation example, since no access authority file is stored in any directory of the external storage device 40, a response message indicating that there is no corresponding access authority information is returned from the router 30 to the communication terminal 22A.

  When a response message indicating that there is no corresponding access authority information, access authority information, or the like is received, the control unit of the communication terminal 22A displays the property screen shown in FIG. 6B on the display unit. This property screen is a user interface for setting access authority information and the like. For example, as shown in FIG. 6B, a display area for displaying the name of a file or the like for which access authority is set, and the file An input area (FIG. 6B: input areas IN1 and IN2) for inputting a user identifier of the owner of the owner and a group identifier of the group to which the owner belongs, and a check box CB for inputting access authority Is provided. The property screen in FIG. 6B is an example of a user interface for setting access authority information and the like. Actually, a screen corresponding to the OS of the communication terminal 22A (for example, a Windows (registered trademark) OS Then, access authority information and the like are set via a screen displayed by clicking the security tab on the file property screen.

  For example, when the access authority information or the like is received, the control unit of the communication terminal 22A sets the user identifier and group identifier received together with the access authority information in each of the input areas IN1 and IN2, and the access authority A check mark according to the information is set in the check box CB to display the property screen (see FIG. 6B). On the other hand, when a response message indicating that there is no corresponding access authority information is received, the control unit of the communication terminal 22A uses the user identifier and group identifier stored in its own device in the input areas IN1 and IN2. Set to each to display the property screen. In this operation example, since a response message indicating that there is no corresponding access authority information is returned, the control unit of the communication terminal 22A displays the property screen in the latter mode. User A who has visually recognized this property screen performs an input operation on the check box CB and then clicks the update button B1, thereby giving the communication terminal 22A an instruction to set an access right that makes himself the owner of the directory “A”. Can be given. In this embodiment, one user (that is, user A) is defined in advance for the communication terminal 22A, and the user identifier and group identifier of the user are stored in advance in the communication terminal 22A. There may be a case where the communication device 22A is shared by a plurality of users, and the user identifier and group identifier of each of the plurality of users are stored in the communication terminal 22A. When the communication device 22A is shared by a plurality of users as described above, the user identifier and group identifier of the user (for example, the logged-in user) who is using the communication terminal 22A at the time when the response message is received. May be set in each of the input areas IN1 and IN2 to cause the communication terminal 22A to execute processing for displaying the property screen.

  When an access authority setting instruction is given as described above, the control unit of the communication terminal 22A generates a setting instruction message corresponding to the instruction content and transmits the setting instruction message to the router 30. For example, in the property screen for the directory “A”, the user identifier of the user A is input as the user identifier of the owner, the group identifier of the group 1 is input as the group identifier of the group to which the owner belongs, and the owner In the check box CB, an operation for permitting reading, writing, and execution of the directory “A” and permitting reading and execution for other users and other users of the group to which the owner belongs. When the update button B1 is pressed in the state performed for the communication terminal 22A, the control unit of the communication terminal 22A generates a setting instruction message and transmits it to the router 30 in the following manner. That is, the control unit of the communication terminal 22A uses the name of the directory “A” as an identifier indicating a file or the like for which access authority is set, the user identifier of the user A as an owner user identifier, and the group to which the owner belongs. A setting instruction message in which the group identifier of group 1 is written as the group identifier and “755” is written as the access authority information is generated and transmitted to the router 30.

  When receiving the setting instruction message transmitted from the communication terminal 22A via the second communication I / F unit 330, the control unit 310 of the router 30 records according to the content of the setting instruction message (FIG. 4A: record). (See Rec1). In this operation example, since the access authority file is not stored in the directory (that is, the root directory “¥”) in which the file or the like whose access authority is instructed by the setting instruction message is stored, the control unit 310 writes the access restriction file in which the record is written in the directory. Thereby, the setting of access authority for the directory “A” is completed.

  Next, the case where the user B sets the access authority for the directory “B” will be described. When the user B operates an operation unit (not shown) of the communication terminal 22B and gives an instruction to display an image indicating a directory tree in the external storage device 40, the communication terminal 22B and the router 30 operate in the same manner as the above-described operation example. The image representing the directory tree (FIG. 6A) is displayed on the display unit of the communication terminal 22B. Here, it should be noted that although the root directory “¥” in the external storage device 40 stores an access authority file representing the access authority set by the user A, the directory tree includes The icon corresponding to the access authority file is not included. This is because the access authority file is a hidden file and is excluded from the display target in the display of a directory tree or the like. As described above, in this embodiment, since the access authority file is excluded from the display target of the directory tree or the like as a hidden file, the contents are rewritten using an erroneous operation such as deleting the access authority file by mistake, or using an editor or the like (that is, Falsification) is prevented. In order to prevent such erroneous operations and tampering, the access authority file is hidden.

  As described above, the user B who has visually recognized the hierarchical relationship of the directory constructed in the external storage device 40 displays the property screen for the directory “B”. In the property screen, the owner and the owner The update button B1 is pressed by operating the check box CB for permitting reading, writing, and execution of the directory for all other users and other users of the group to which the user belongs. Thereafter, the communication terminal 22B performs the same operation as the above-described communication terminal 22A, and the name of the directory “B” is used as an identifier indicating a file or the like for which access authority is set, and the user identifier of the user B is used as the owner user identifier Then, a setting instruction message in which the group identifier of the group 2 is written as the group identifier of the group to which the owner belongs and “777” is written as the access authority information is generated and transmitted to the router 30.

  When the control unit 310 of the router 30 receives the setting instruction message transmitted from the communication terminal 22B via the second communication I / F unit 330, first, a record corresponding to the content of the setting instruction message (FIG. 4A). : Record Rec2). In this operation example, since the access authority file is already stored in the directory that stores the file or the like for which the access authority setting is instructed by the setting instruction message, the record is added to the access authority file. The above is the setting operation of the access authority for the directory “B”. In this embodiment, the case where the user B sets the access authority for the directory “B” has been described. However, the user B sets the access authority for the directory “A” for which the access authority has been set by the user A. If an attempt is made, an error message is returned and the setting (overwriting) is not performed as described above. The user identifier included in the record including the access authority information for the directory “A” (FIG. 4A: record Rec1) is that of the user A, and is included in the setting instruction message transmitted from the communication terminal 22B. This is because it does not match the user identifier (that is, the user identifier of user B).

(B-2: Operation in access control processing)
Next, in a situation where the access authority file storing the three records shown in FIG. 4A is stored in the root directory “¥” of the external storage device 40, the file stored in the external storage device 40, etc. An operation performed by the control unit 310 when an access request message for requesting access to the communication terminal 22 is received will be described.

  When an operation for instructing access to a file or the like stored in the external storage device 40 is performed, a control unit (not shown) of the communication terminal 22 generates an access request message corresponding to the operation content. To the router 30. The access request message includes a user identifier of the user of the communication terminal 22 that is the transmission source, a group identifier of the group to which the user belongs, an access destination identifier indicating a file to be accessed (for example, a file name or a file path), A command indicating the access contents (read, write, execution, etc.) is written.

  When the control unit 310 of the router 30 receives the access request message via the second communication I / F unit 330, the access target file or the like (that is, the file indicated by the access destination identifier written in the access request message) Etc.) is determined whether or not the access authority file is stored in the directory storing the file. Then, the control unit 310 converts the access authority file stored in the higher-level directory when there is no corresponding access authority file based on the access authority file when the access authority file is stored. Based on this, whether access is possible is determined. For example, if the file to be accessed is the file fileC, the control unit 310 determines whether or not access is possible based on the access authority file stored in the root directory “¥” of the external storage device 40. Similarly, if the file to be accessed is the file fileA1 (or fileA2), the control unit 310 determines whether or not the access is possible based on the access authority file stored in the directory “A” of the external storage device 40. decide. On the other hand, when the file to be accessed is the file fileB, since the access authority file is not stored in the directory B of the external storage device 40, the control unit 310 is a directory in the upper hierarchy. Based on the access authority file stored in a certain root directory “¥” (that is, based on the access authority for the directory B), whether or not the access is possible is determined.

  For example, the transmission terminal of the access request message is the communication terminal 22A operated by the user A (if each communication terminal is shared by a plurality of users, the user A logs in and the communication terminal 22A operated by the user A Hereafter, the same applies to the communication terminals 22B and 22C), and when the file to be accessed is the file fileC, whether the access content is the reading of the file to be accessed or the access to the file to be accessed Regardless of whether it is a write or an execution of a file to be accessed, the control unit 310 denies the access (replies a rejection response without executing the command written in the access request message). To do. The reason is as follows. In the access request message, the user identifier of user A and the group identifier of group 1 are written as information indicating the access request source. On the other hand, according to the access authority file stored in the root directory “¥” of the external storage device 40, the owner of the file fileC is the user C, and this user C belongs to the group 2 (FIG. 4 (A): Rec3). Since the user A is not the owner of fileC and belongs to a group different from the owner, the user A corresponds to “others” in relation to the file fileC. As shown in FIG. 4A, the file fileC is not permitted to be read, written, or executed by “others”. Therefore, a rejection response is returned to the access request message.

  On the other hand, when the transmission source of the access request message for requesting access to the file fileC is the communication terminal 22B operated by the user B, if the access content is the reading of the file to be accessed, The control unit 310 permits the access (that is, executes the command written in the access request message and sends back the execution result), but the access content is written to the file or the execution of the file. If so, deny that access. This is because the user B is another user who belongs to the same group as the user C, and such a user is only allowed to read the file (see FIG. 4A: record Rec3). When the access request message is transmitted from the communication terminal 22C operated by the user C, the access request is permitted if the access content is read or written. As shown in FIG. 4A, the owner of the file fileC is the user C, and reading and writing of the file fileC are permitted.

  When a communication message for instructing deletion of a file or the like is transmitted from the communication terminal 22 as shown in FIG. 7A, the control unit 310 deletes the file or the like. Then, a process for deleting a record for the file or the like from the access authority file stored in the directory in which the file or the like is stored is executed. As shown in FIG. 7B, when a communication message for instructing movement of a file or the like is transmitted from the communication terminal 22, the control unit 310 moves the file or the like. In addition, the record of the file etc. is deleted from the access authority file stored in the directory where the file etc. was stored before moving, and the file etc. is stored in the access authority file stored in the directory after movement. Execute the process of adding a record indicating the access authority for.

  As described above, according to the present embodiment, the access authority is set for a file or the like stored in the external storage device 40 connected to the router 30, and the access restriction based on the access authority is performed. The accompanying file sharing service can be provided. What should be noted here is that the file system (FAT32) built in the external storage device 40 originally does not support setting of access authority, but other file systems that support setting of access authority. (For example, NTFS, ext2 etc.) It is possible to set access authority and provide a file sharing service with access restriction based on the access authority, and for access restriction. This is that no dedicated device is used.

  That is, according to the present embodiment, access authority is set for a file or the like stored in the external storage device 40 connected to the router 30, and file sharing with access restriction based on the access authority is performed on the external device. This can be realized without converting the file system built in the storage device 40 and without providing a dedicated device for access restriction. In the above-described embodiment, FAT32 is adopted as the file system of the external storage device 40. However, other file systems that do not support setting of access authority such as FAT16 may be used, and setting of access authority such as NTFS may be used. Of course, even a file system that supports.

(C: deformation)
Although one embodiment of the present invention has been described above, it goes without saying that the following modifications may be added.
(1) In the above-described embodiment, the user of the communication terminal under the router 30 is allowed to share the file stored in the external storage device 40 connected to the router 30, but is connected to the general public network 10. Of course, it is possible to share the above-mentioned file with the user of the communication terminal.

(2) In the above-described embodiment, when an access authority file is stored in a directory storing a file requested to be accessed, the access permission file is determined according to the contents of the access authority file, When the access authority file is not stored in the same directory, the access authority file stored in the directory at a higher hierarchy is referred to determine whether the access is permitted. However, even when the access authority file is stored in the directory storing the file requested to be accessed, the access authority file indicating stricter access restrictions is stored in the higher-level directory. In such a case, the accessibility may be determined according to the latter access authority file. For example, when the access authority “755” is set for the directory “A” as shown in FIG. 4A, the access authority for the file fileA1 in the access authority file stored in the directory “A”. Even if “777” is set, it may be determined whether or not the file fileA1 can be accessed according to the former access authority (ie, “755”).

(3) In the above-described embodiment, the access authority is set by classifying each user into an owner of a file or the like, another user belonging to the same group as the owner, and other users. However, instead of using the concept of a group, the access authority may be set according to the classification of the owner of a file or the like and a person other than the owner.

(4) In the above-described embodiment, the access authority file is a hidden file to prevent the access authority file from being deleted or the access authority file is falsified due to an erroneous operation. All access requests that directly access the file may be rejected. Specifically, the control unit 310 may be made to execute processing for unconditionally discarding an access request message including “.ACL” in the access destination identifier. In addition, in order to prevent operations such as editing the access authority file by connecting to the router 30 via telnet, the access authority file is encrypted and written to the external storage device, and the access request message is received. The decryption may be performed in response to the above.

(5) In the above-described embodiment, the present invention is applied to a router, but the present invention may be applied to a switching hub. Note that a switching hub is a relay device that relays data in a data link layer, which is usually a protocol layer one level lower than the network layer. The switching hub has a plurality of ports to which other communication devices (routers, communication terminals, other switching hubs, etc.) are connected. For this reason, these multiple ports are grouped into a group of ports to which communication terminals permitting file sharing are connected and a group of ports to which communication terminals not allowing file sharing are connected. Only the user of the communication terminal that is the connection destination of the port belonging to may be allowed to set the access authority and share the file. Specifically, a management table storing port identifiers (for example, port numbers) for identifying each port connected to a communication terminal that permits file sharing is stored in advance in the switching hub, and a setting instruction message, Only when the port identifier of the port that received the frame (data transmission / reception unit in the data link layer) used to transmit the access request message is registered in the management table, the processing corresponding to the message is performed. What is necessary is just to make it make the control part of the switching hub perform.

(6) In the embodiment described above, only one external storage device 40 is connected to the router 30, but it is of course possible to connect a plurality of external storage devices. As described above, in a mode in which a plurality of external storage devices are connected, an external storage device that is a file sharing target may be determined for each VLAN by combination with the VLAN. For example, when two external storage devices 40A and 40B are connected to the router 30 and the communication terminal under the router 30 belongs to the first VLAN identified by the first VLAN tag, the first It belongs to the second VLAN identified by the second VLAN tag different from the VLAN tag, and belongs to the third VLAN identified by the third VLAN tag different from any of the first and second VLAN tags. In the case of being classified into three groups, it is conceivable to share files and the like stored in each external storage device in the following manner.

  That is, the user of the communication terminal belonging to the first VLAN is allowed to share only the file stored in the external storage device 40A, and the user of the communication terminal belonging to the second VLAN is allowed to share. Only the file stored in the external storage device 40B is allowed to be shared, and the user of the communication terminal belonging to the third VLAN can use the file stored in either the external storage device 40A or 40B. A mode of allowing the sharing is conceivable. This is because the router 30 stores in advance a management table that associates information for identifying each external storage device with VLAN tags of a group that is allowed to share files stored in the external storage device. A combination of a VLAN tag attached to a packet used for transmission of a setting instruction message or an access request message and an external storage device accessed by processing according to the message is registered in the management table. Only when it is a message, it can be realized by causing the control unit 310 to execute a process corresponding to the message. Also, in the case where the present invention is applied to a switching hub and a plurality of external storage devices are connected to the switching hub, which external storage device is allowed to share a file etc. stored for each port May be determined. Specifically, an identifier for uniquely identifying each of a plurality of external storage devices connected to the switching hub, and a port of a port for connecting a communication terminal that permits sharing of files stored in the external storage device The identifier is associated and written to the management table of the switching hub, and the port identifier of the port that received the frame used for transmission of the setting instruction message or access request message is registered in the management table. Any of the port identifiers registered in the management table in association with the identifier of the external storage device storing the file or the like whose access authority is instructed by the setting instruction message or the file to be accessed Only if the message matches the port identifier of the receiving port. The treatment may be to be executed by the control unit of the switching hub.

  In addition, when a plurality of external storage devices are connected to the external device I / F unit 340, mirroring may be performed so that at least two of the plurality of storage devices have the same storage contents. This is because such a mirroring mode can continue to provide the file sharing service even if a failure occurs in any of the external storage devices to be mirrored. In the case of performing mirroring, the external storage device connected to the external device I / F unit 340 is not mirrored between the external storage devices connected to the external device I / F unit 340, and other storage devices are connected. Of course, mirroring may be performed with an external storage device connected to the router.

(7) In the above-described embodiment, the control unit 310 starts execution of the packet transfer control program and the file sharing service providing program when the power of the router 30 is turned on. However, the execution start timing of the file sharing service providing program is not limited to when the power of the router 30 is turned on. For example, after the power of the router 30 is turned on, the control unit 310 starts execution of the file sharing service provision program when the connection of the external storage device 40 to the external device I / F unit 340 is detected. Also good. This is because the file sharing service cannot be provided if the external storage device 40 is not connected. Even when the execution of the file sharing service providing program is started when the connection of the external storage device 40 to the external device I / F unit 340 is detected, the external device is turned on when the router 30 is turned on. When connection of the external storage device 40 to the I / F unit 340 is detected (for example, when the power of the router 30 is turned on with the external storage device 40 connected to the external device I / F unit 340) It goes without saying that the execution of the file sharing service providing program should be started immediately.

(8) In the embodiment described above, the access authority setting process and the access control process are realized by a program. However, if the router 30 has a script execution function, these processes may of course be realized by a script. Specifically, in order to cause the control unit 310 to execute an access right setting process script that is a text file in which a command sequence for causing the control unit 310 to execute the access right setting process is described in a predetermined script language. Are stored in advance in the nonvolatile storage unit 354 and the router 30 is turned on (or externally connected to the external device I / F unit 340). The control unit 310 starts interpreting and executing each script with the detection of the connection of the storage device 40 as a trigger. Although various script description languages may be used, it is preferable to use Lua. This is because Lua requires less memory for interpreting and executing a script file than other script languages such as Perl, and is suitable for incorporation into an electronic device.

(9) In the above-described embodiment, the file sharing service providing program for causing the control unit 310 of the router 30 to execute the processing that clearly shows the characteristics of the present invention is stored in the storage unit 350 of the router 30 in advance. However, for example, the file sharing service providing program may be written and distributed on a computer-readable recording medium such as a CD-ROM (Compact Disk-Read Only Memory), or downloaded via an electric communication line such as the Internet. The above file sharing service providing program may be distributed. The file sharing service providing program distributed in this way is stored in a general relay device, and the control unit of the relay device is operated according to the program thereafter, so that the router 30 can be connected to the existing relay device. This is because the same function can be given.

  In the above-described embodiment, the packet transfer control program for causing the control unit 310 to execute packet transfer control and the file sharing service providing program for realizing the file sharing service on the control unit 310 are separately provided. These two processes may be realized. Specifically, firmware including a subroutine for realizing packet transfer control and a subroutine for realizing a file sharing service may be stored in the storage unit 350 in place of the above two programs. Further, such firmware may be distributed by writing in a computer-readable recording medium, or may be distributed by downloading via a telecommunication line.

  DESCRIPTION OF SYMBOLS 10 ... General public network, 20 ... Local LAN, 22, 22A, 22B, 22C ... Communication terminal, 30 ... Router, 310 ... Control part, 320 ... 1st communication I / F part, 330 ... 2nd communication I / F 340 ... external device I / F unit, 350 ... storage unit, 352 ... volatile storage unit, 354 ... nonvolatile storage unit, 360 ... bus, 40 ... external storage device.

Claims (5)

When a packet transmitted from a subordinate communication terminal is received, the packet is transferred to the destination. When a packet transmitted to a subordinate communication terminal is received, the packet is transmitted to the destination communication terminal. Packet transfer control means for transferring,
External device connection means for connecting an external storage device having a file system with a directory structure for hierarchically storing files;
When an instruction to set access authority to a file or directory stored in an external storage device connected to the external device connection means is received from a communication terminal, each of the owner of the file or directory and each other person An access authority file that defines the access authority for the file is stored in the directory storing the file or directory, and stored in the external storage device connected to the external device connection means When an access request for a file or directory is received from a communication terminal, refer to the access authority file stored in the directory that stores the file or directory or in a higher-level directory to determine whether the access is permitted. To decide And file sharing service providing means for executing the processes control process, and
A relay apparatus comprising:   The relay apparatus according to claim 1, wherein the file sharing service providing unit generates the access authority file as a hidden file in the access authority setting process.   In the access authority setting process, the file sharing service providing means encrypts the generated access authority file, stores it in the external storage device, and stores the encrypted file in the access control process. 3. The relay apparatus according to claim 1, wherein the access authority file is decrypted.   The communication terminals that communicate via the relay device are grouped into groups that are allowed to share files or directories stored in the external storage device, and groups that are not allowed to share, The file sharing service providing means executes the access authority setting process only when the setting instruction is received from a communication terminal belonging to the former group, and when the access request is received from a communication terminal belonging to the group. The relay apparatus according to claim 1, wherein only the access control process is executed.   A plurality of external storage devices are connected to the external device connection means, and a group of communication terminals that permit sharing of files or directories stored in the external storage device is defined for each external storage device. The relay device according to claim 4.

Images