JP2020119023A - File access control method, computer program and computer - Google Patents

Abstract

To achieve both of work efficiency and prevention of information leakage of a file in which a document file or the like is updated.SOLUTION: A computer manages a plaintext file saved in a prescribed management region in which access restriction is performed, and an encrypted file obtained by encrypting the plaintext file, in association with each other. The computer confirms whether or not a user of an application program has access authority to the encrypted file, when an access request to the encrypted file is received from the application program. The computer permits access to the plaintext file, when determining that the user has the access authority to the encrypted file, and permits a change of the plaintext file to the user of the application program, when the user has change authority of the encrypted file. Further, the computer saves the changed plaintext file in the prescribed management region, and encrypts and saves the changed plaintext file.SELECTED DRAWING: Figure 1

Description

The present invention relates to a file access control method, a computer program and a computer.

Patent Document 1 discloses a file access restriction device that can perform decryption processing more safely and efficiently, can restrict access to files according to various settings, and can prevent content leakage and unauthorized use. Has been done. According to the document, the file access restriction device includes an application and a local server (access processing means). The local server (access processing unit) includes a decryption processing unit that decrypts the encrypted data stored in the secondary storage unit in response to an access from the application. Then, the application accesses the encrypted file in the secondary storage means via the local server (access processing means). Further, claim 7 of Patent Document 1 describes that the file access restriction device includes a primary storage means for temporarily storing the decrypted data when the decryption processing of the encrypted data is performed by the decryption processing means. There is.

JP, 2005-202709, A

The following analysis is given by the present invention. In order to prevent information leakage from a document file, a file encryption program is used to encrypt the file and perform daily business. However, when performing such an operation, it is necessary to perform decryption processing every time an encrypted file is browsed, and therefore, it takes time to operate the file as compared with the case of operating a plaintext file. There is. Further, as the file size increases, the time required for encryption/decryption also increases, which causes a problem in efficient work execution.

In this respect, in the file access restriction device of Patent Document 1, since the decrypted data is temporarily stored in the primary storage means after being decrypted once, the file operation time can be shortened. However, the file access restriction device of Patent Document 1 has a problem that the decrypted data disappears because the main purpose is to prevent leakage or illegal use of the content. Further, in Patent Document 1, since the main purpose is to distribute contents to users, it is not assumed that the users update the decrypted data or store the data.

It is an object of the present invention to provide a file access control method, a computer program, and a computer that can contribute to both the prevention of information leakage of files such as document files that are updated and the improvement of work efficiency.

According to the first aspect, a plaintext file stored in a predetermined management area in which access is restricted and an encrypted file obtained by encrypting the plaintext file are managed in association with each other, and the encrypted When an access request to the encrypted file is received, it is confirmed whether the user of the application program has the access right to the encrypted file, and it is determined that the user of the application program has the access right to the encrypted file. In this case, the access to the plaintext file is permitted, and when the user of the application program has the authority to change the encrypted file, the user of the application program is permitted to change the plaintext file, and after the change, There is provided a file access control method of storing a plaintext file in the predetermined management area and encrypting and storing the changed plaintext file. This method is tied to a specific machine called a computer that manages plaintext files and encrypted files in association with each other.

According to the second aspect, a file access control function for managing a plaintext file stored in a predetermined management area in which access is restricted and an encrypted file obtained by encrypting the plaintext file in association with each other is realized. A computer program, a process of confirming whether or not a user of the application program has an access right to the encrypted file when an access request to the encrypted file is received from the application program; If it is determined that the user has access authority to the encrypted file, a process of permitting access to the plaintext file, and if the user of the application program has change authority to the encrypted file, A computer program that permits a user to change the plaintext file, saves the changed plaintext file in the predetermined management area, and executes a process of encrypting and saving the changed plaintext file. Provided. It should be noted that this program can be recorded in a computer-readable (non-transitary) storage medium. That is, the present invention can be embodied as a computer program product. In addition, this program is input to a computer device from an input device or an external device through a communication interface, stored in a storage device, and drives a processor in accordance with predetermined steps or processes. Can be displayed step by step through a display device or can communicate with the outside through a communication interface. As an example, a computer device therefor includes a processor, a storage device, an input device, a communication interface, and optionally a display device, which are typically connectable to each other by a bus.

According to a third aspect, a file access control unit that manages a plaintext file stored in a predetermined management area where access is restricted and an encrypted file obtained by encrypting the plaintext file in association with each other, The file access control unit, when receiving an access request for the encrypted file from the application program, confirms whether the user of the application program has the access right to the encrypted file, When it is determined that the user has the access authority to the encrypted file, the access to the plaintext file is permitted, and when the user of the application program has the authority to change the encrypted file, the user of the application program, There is provided a computer that permits modification of the plaintext file, saves the modified plaintext file in the predetermined management area, and encrypts and stores the modified plaintext file.

According to the present invention, it is possible to prevent the information leakage of a file such as a document file that is updated and to improve the efficiency of business.

It is a figure which shows the structure of one Embodiment of this invention. It is a figure for demonstrating operation|movement of one Embodiment of this invention. It is a figure for demonstrating operation|movement of one Embodiment of this invention. It is a figure for demonstrating operation|movement of one Embodiment of this invention. It is a figure for demonstrating operation|movement of one Embodiment of this invention. It is a figure which shows the structure of the computer of the 1st Embodiment of this invention. 3 is a flowchart showing an operation (encrypted file creation processing) of the computer of the first exemplary embodiment of the present invention. 3 is a flowchart showing an operation (file browsing request response process) of the computer of the first exemplary embodiment of the present invention. 3 is a flowchart showing an operation (file edit request response process) of the computer of the first exemplary embodiment of the present invention. It is a figure which shows the structure of the computer of the 2nd Embodiment of this invention. It is a figure which shows the structure of the computer of this invention.

First, an outline of one embodiment of the present invention will be described with reference to the drawings. The reference numerals in the drawings attached to this outline are added to the respective elements for convenience as an example for facilitating understanding, and are not intended to limit the present invention to the illustrated modes. Further, the connecting lines between blocks in the drawings and the like referred to in the following description include both bidirectional and unidirectional. The unidirectional arrows schematically show the flow of main signals (data), and do not exclude bidirectionality. Also, although there are ports and interfaces at the input/output connection points of each block in the figure, they are not shown. Further, in the following description, “A and/or B” is used to mean at least one of A and B. Also, although there are ports and interfaces at the input/output connection points of each block in the figure, they are not shown. Further, the program is executed via a computer device, and the computer device includes, for example, a processor, a storage device, an input device, a communication interface, and a display device as necessary. In addition, the computer device is configured to be capable of communicating with a device (including a computer) inside or outside the device via a communication interface, whether wired or wireless.

In one embodiment thereof, the present invention can be realized by a computer 10 including a file access control unit 11, as shown in FIG. More specifically, the file access control unit 11 associates a plaintext file P stored in a predetermined management area 12 in which access is restricted with an encrypted file C that encrypts the plaintext file P. Manage.

As shown in FIG. 2, when the user of the application program 20 wants to browse and edit the encrypted file C, the user of the application program 20 makes an access request for the encrypted file C to the file access control unit 11 via the application program 20. ..

Upon receiving the request, the file access control unit 11 confirms whether the user of the application program 20 has the access right to the encrypted file C, as shown in FIG.

As a result of the confirmation, when it is determined that the user of the application program 20 has the access right to the encrypted file C, the file access control unit 11 determines that the plaintext file P is not the encrypted file C as shown in FIG. Allow access to.

Further, even when the user of the application program 20 has the authority to change the encrypted file C, the file access control unit 11 changes (updates) the plaintext file P to the user of the application program 20, as in FIG. To give permission. Further, when the plaintext file P is changed (updated), the file access control unit 11 stores the changed (updated) plaintext file P′ in the predetermined management area 12, as shown in FIG. Further, the file access control unit 11 encrypts the changed (updated) plaintext file to create an encrypted file C′ and stores it (see FIG. 5 ).

As described above, according to the present embodiment, it is possible to browse and update the encrypted file by omitting the decryption process. As a result, not only can the file handling work be made more efficient, but it is also possible to reduce the number of cases in which a file handling person such as an employee exchanges files by omitting encryption due to the inconvenience.

[First Embodiment]
Subsequently, a first embodiment of the present invention will be described in detail with reference to the drawings. FIG. 6 is a diagram showing a configuration of a computer according to the first embodiment of the present invention. Referring to FIG. 6, a computer 100 in which an application program 101 is installed is shown. The computer 100 also includes a file access control unit 102 and a file encryption unit 103. Further, the computer 100 can store the encrypted file 104 and the plaintext file 106 in the storage device. Of these, the plaintext file 106 is stored in the management area 105.

The encrypted file 104 is a file to be operated by the application program 101. The encrypted file 104 may be a file encrypted in various archive formats such as ZIP and RAR.

The plaintext file 106 is a plaintext file before the encrypted file 104 is encrypted.

The application program 101 is a program that operates on the computer 100, and has a function of accessing the encrypted file 104 and browsing/editing the content of the encrypted file.

When the application program 101 accesses the encrypted file 104, the file access control unit 102 intervenes in the access process and controls the file access. Specifically, when encrypting the plaintext file 106, the file access control unit 102 associates the plaintext file 106 with the encrypted file 104, and then passes the plaintext file 106 to the file encryption unit 103. At this time, the file access control unit 102 stores the plaintext file 106 associated with the encrypted file 104 in the management area 105.

Further, when the access to the encrypted file 104 is received from the application program 101, the file access control unit 102 confirms the access authority to the encrypted file 104 of the user who uses the application program 101. As a result of the confirmation, when the user has the access authority, the file access control unit 102 permits the application program 101 to access the encrypted file 104, and passes the plaintext file 106 to the application program 101.

Further, as a result of the confirmation, if the user has the editing right of the encrypted file 104, the file access control unit 102 permits the application program 101 to edit the plaintext file 106. When the application program 101 completes editing the plaintext file 106, the file access control unit 102 sends the plaintext file 106 to the file encryption unit 103 to request encryption. Finally, the file access control unit 102 replaces the conventional encrypted file 104 with an encrypted file obtained by encrypting the plaintext file 106 edited by the application program 101.

The file encryption unit 103 encrypts the plaintext file 106 passed from the file access control unit 102 and returns it to the file access control unit 102. At that time, the file encryption unit 103 adds file access authority information to the encrypted file.

The management area 105 is an area managed by the file access control unit 102. The management area 105 is controlled to be accessible when the user who uses the application program 101 has the authority to access the encrypted file 104. The management area 105 can be configured by, for example, a folder or directory to which access restrictions and hidden attributes are added. The management area 105 is preferably created by the operating system or the application program 101 before the management of the encrypted file is started.

Next, the operation of this embodiment will be described in detail with reference to the drawings. FIG. 7 is a flowchart showing the operation (encrypted file creation processing) of the computer according to the first embodiment of the present invention. This process is started when the file is passed from the application program 101 or the like to the file access control unit 102.

Referring to FIG. 7, first, the file access control unit 102 sets the unencrypted file to the plaintext file 106 and associates it with the unencrypted file (step S1).

Next, the file access control unit 102 sends the unencrypted file to the file encryption unit 103 to instruct the encryption. The file encryption unit 103 encrypts the file before encryption and returns the encrypted file 104. The file access control unit 102 stores the encrypted file 104 in a predetermined storage area in association with the plaintext file 106 (step S2).

In step S2, the access authority information of the user is given to the encrypted file 104 encrypted by the file encryption unit 103. Here, as a method for the file encryption unit 103 to give access authority information, a method of embedding predetermined access authority information such as “user A has viewing authority and user B has editing authority” in a file can be considered. Further, as a method different from the method of embedding the access right information in the file, a method of encrypting the file with a common key corresponding to the access right information can be considered. The access authority information may be managed by a user authority management server.

Next, the operation of the file access control unit 102 when receiving a file browsing request from the application program 101 will be described. FIG. 8 is a flowchart showing the operation (file browsing request response process) of the computer according to the first embodiment of the present invention. This process is started by an operation in which the application program 101 tries to access the file in order to browse the encrypted file 104.

Upon receiving the file access request from the application program 101, the file access control unit 102 confirms whether or not the user of the application program 101 has the authority to browse the encrypted file 104 (step S11). This determination can be performed by using the access authority information embedded in the encrypted file 104 and confirming with a predetermined user authority management server whether or not the corresponding user has the browsing authority. Further, when the encrypted file 104 is encrypted with the common key corresponding to the access authority information, it can be confirmed by whether or not the user of the application program 101 has the same key as that at the time of encryption.

As a result of the confirmation, when the user of the application program 101 has the authority to browse the encrypted file 104, the file access control unit 102 passes the plaintext file 106 linked to the encrypted file 104 to the application program 101. The application program 101 opens the passed plaintext file 106 and allows the user to browse it (step S12).

If it is determined in step S11 that the user of the application program 101 does not have the authority to browse the encrypted file 104, the file access control unit 102 rejects the browsing request. In this case, the user of the application program 101 cannot browse the encrypted file 104. At this time, the file access control unit 102 may instruct the application program 101 to display a message indicating the reason for refusing the browsing, if necessary.

Next, the operation of the file access control unit 102 when receiving a file edit request from the application program 101 will be described. FIG. 9 is a flowchart showing the operation (file edit request response process) of the computer according to the first embodiment of the present invention. This process is started by an operation in which the application program 101 tries to access the encrypted file 104 to edit the encrypted file 104. Further, this process may be started when a user who is browsing the encrypted file 104 performs an editing operation on the application program 101.

Upon receiving a file edit request for a file from the application program 101, the file access control unit 102 confirms whether the user of the application program 101 has edit authority to the encrypted file 104 (step S21). This determination can be performed by using the access authority information embedded in the encrypted file 104 and confirming with a predetermined user authority management server whether or not the corresponding user has the editing authority. Further, when the encrypted file 104 is encrypted with the common key corresponding to the access authority information indicating the editing authority, whether the user of the application program 101 has the same key (decryption key) as at the time of encryption. It can be confirmed by

As a result of the confirmation, when the user of the application program 101 has the editing right of the encrypted file 104, the file access control unit 102 passes the plaintext file 106 linked to the encrypted file 104 to the application program 101. The application program 101 opens the passed plaintext file 106 to allow the user to browse and edit (step S22). The edited plaintext file 106 is updated on the management area 105.

When the file is saved in the application program 101, the file access control unit 102 acquires the edited plaintext file 106 from the application program 101. Next, the file access control unit 102 creates a file having the same extension as the encrypted file 104 in the management area 105 with the content of the edited plaintext file 106 (referred to as a file 104').

Then, the file access control unit 102 transfers the created file 104 ′ to the file encryption unit 103 and instructs the file encryption unit 103 to perform encryption. The file encryption unit 103 encrypts the file 104 ′, creates a new encrypted file 104 ′, and returns it to the file access control unit 102. Finally, the file access control unit 102 replaces the encrypted file 104 with the new encrypted file 104', and associates the updated plaintext file 106 with the new encrypted file 104' (step S23). By undergoing such processing, the encrypted file 104 can be edited without being flattened. Further, since the plaintext file itself is managed in the management area where access is restricted, the risk of leakage etc. can be minimized.

As described above, according to the present embodiment, it is possible to operate the target file without performing the decryption process of the encrypted file. The reason is that the plaintext file associated with the encrypted file is placed in the management area and then used with a limitation.

Further, according to the present embodiment, it is possible to shorten the access time to the encrypted file while ensuring the security. The reason is that the configuration is adopted in which the authority is confirmed by confirming the access authority information embedded in the encrypted file and whether or not the common key is held.

Although the respective embodiments of the present invention have been described above, the present invention is not limited to the above-described embodiments, and further modifications, replacements, and adjustments can be made without departing from the basic technical idea of the present invention. Can be added. For example, the device configuration, the configuration of each element, and the expression form of the information element shown in each drawing are examples for helping understanding of the present invention, and are not limited to the configurations shown in these drawings.

For example, as shown in FIG. 10, the file encryption unit 103 of the computer 100 described above can be replaced with a file encryption/decryption unit 103a having a decryption function (second embodiment). According to this configuration, instead of associating the plaintext file 106 when encrypting the encrypted file 104, it is possible to associate the plaintext file 106 with the plaintext file 106 when decrypting the encrypted file 104. That is, according to the configuration of FIG. 10, when the encrypted encrypted file 104 is decrypted by the first browsing/editing, the plaintext file 106 is linked, and the subsequent browsing/editing is linked. The plaintext file 106 can be viewed and edited.

Further, for example, in the above-described embodiment, the computer 100, 100a has been described as replacing the encrypted file, but instead of replacing the encrypted file, the version of the encrypted file is changed and the fixed version is maintained for a certain period. It may be stored for several minutes.

Further, the procedure shown in the above embodiment can be realized by a program that causes a computer (9000 in FIG. 11) to realize the above function. Such a computer is exemplified by the configuration including the CPU (Central Processing Unit) 9010, the communication interface 9020, the memory 9030, and the auxiliary storage device 9040 of FIG. 11. That is, the CPU 9010 in FIG. 11 may execute the file access control program or the encryption processing program to update the calculation parameters held in the auxiliary storage device 9040 or the like.

That is, the respective units (processing means, functions) of the computers 10, 100, 100a shown in the above-described embodiments cause the processors installed in these computers to execute the respective processes using the hardware thereof. Can be realized by

Finally, the preferred forms of the invention are summarized.
[First form]
(See the file access control method according to the first aspect above)
[Second mode]
In the above file access control method, it is possible to adopt a configuration in which a plaintext file is created when an encrypted file is first decrypted.
[Third form]
In the above file access control method,
A configuration may be adopted in which a management area for storing the plaintext file is created before the management of the encrypted file is started.
[Fourth form]
In the above file access control method,
A configuration can be adopted in which whether or not the user of the application program has the access right to the encrypted file can be determined depending on whether or not the user of the application program has the decryption key of the encrypted file.
[Fifth form]
In the above file access control method,
By making an inquiry to a predetermined authority management server, it is possible to adopt a configuration for confirming whether or not the user of the application program has the access authority to the encrypted file.
[Sixth form]
(Refer to the computer program from the above second viewpoint)
[Seventh form]
(See the computer from the third viewpoint above)
Note that the sixth and seventh forms can be expanded to the second to fifth forms as in the first form.

The disclosures of the above patent documents are incorporated herein by reference. Modifications and adjustments of the exemplary embodiments and examples are possible within the scope of the overall disclosure (including claims) of the present invention and based on the basic technical concept of the invention. Further, within the framework of the disclosure of the present invention, various combinations or selections (parts) of various disclosed elements (including each element of each claim, each element of each embodiment or example, each element of each drawing, etc.) (Including targeted deletion) is possible. That is, it goes without saying that the present invention includes various variations and modifications that can be made by those skilled in the art according to the entire disclosure including the claims and the technical idea. In particular, with regard to the numerical range described in this specification, any numerical value or small range included in the range should be construed as specifically described even if not otherwise specified.

10, 100, 100a Computer 11, 102 File access control unit 12, 105 Management area 20, 101 Application program 103, 103a File encryption unit 9000 Computer 9010 CPU
9020 Communication interface 9030 Memory 9040 Auxiliary storage device C, C', 104 Encrypted file P, P', 106 Plaintext file

Claims (7)

A plaintext file saved in a specified management area where access is restricted,
The plaintext file and the encrypted file that is encrypted are managed in association with each other,
When an access request to the encrypted file is received from the application program, it is confirmed whether the user of the application program has the access right to the encrypted file,
When it is determined that the user of the application program has the access right to the encrypted file, the access to the plaintext file is permitted,
When the user of the application program has the right to change the encrypted file, the user of the application program is allowed to change the plaintext file,
A file access control method for storing the changed plaintext file in the predetermined management area, and encrypting and storing the changed plaintext file. The file access control method according to claim 1, wherein the plaintext file is created when an encrypted file is first decrypted. 3. The file access control method according to claim 1, wherein a management area for storing the plaintext file, in which access is restricted, is created before the management of the encrypted file is started. 4. The method according to claim 1, wherein it is confirmed whether the user of the application program has an access right to the encrypted file, depending on whether the user of the application program has a decryption key for the encrypted file. A file access control method. 4. The file access control method according to claim 1, wherein whether or not the user of the application program has the access right to the encrypted file is checked by inquiring to a predetermined right management server. A plaintext file saved in a specified management area where access is restricted,
A computer program that realizes a file access control function that manages the plaintext file encrypted by encrypting the encrypted file,
A process of confirming whether or not the user of the application program has an access right to the encrypted file when an access request to the encrypted file is received from the application program,
A process of permitting access to the plaintext file when it is determined that the user of the application program has access authority to the encrypted file,
When the user of the application program has the authority to change the encrypted file, the user of the application program is allowed to change the plaintext file, and the changed plaintext file is saved in the predetermined management area, A process of encrypting and storing the changed plaintext file,
A computer program that executes. A plaintext file saved in a specified management area where access is restricted,
A file access control unit that manages the plaintext file and the encrypted file that are encrypted in association with each other,
The file access control unit,
When an access request to the encrypted file is received from the application program, it is confirmed whether the user of the application program has the access right to the encrypted file,
When it is determined that the user of the application program has the access right to the encrypted file, the access to the plaintext file is permitted,
When the user of the application program has the authority to change the encrypted file, the user of the application program is allowed to change the plaintext file, and the changed plaintext file is saved in the predetermined management area, Encrypt and save the changed plaintext file,
A computer characterized by.

Images