JP2502177B2 - File security management system and data processing device - Google Patents

Description

The present invention relates to a security management method for specific data in a file and a data processing device capable of such security management, and security of specific data in the file without dividing the file. For the purpose of providing a security management method and a data processing device capable of applying security, it is possible to identify each file in a data processing device capable of processing data for a database composed of multiple files. Identification data generating means for generating identification data containing information corresponding to each file and specific data requiring confidentiality in each file are exchanged with the identification data corresponding to each file. And a data exchange means for Composed.

[Industrial applications]

The present invention relates to a security management method for specific data in a file and a data processing device capable of such security management.

There are a great variety of compounds handled by researchers in the chemical and pharmaceutical industries, and various data such as the names, chemical structures, and physical properties of these compounds are organized using computers.

A database created on a computer can be sent and received via a network, and it is possible to easily obtain the cooperation of other researchers in remote areas. However, on the other hand, there is a problem that the contents of the database are easily leaked. In particular, a chemical structure contains a lot of important information about a chemical substance, and if the chemical structure is exposed to others, many secret matters will be leaked.

Therefore, there is an urgent need to promote computerization of data on chemicals and at the same time implement security measures for data.

[Conventional technology]

Conventionally, it has been extremely difficult to secure specific data in a plurality of files that make up a database.

In particular, when Unix (UNIX) is used as the operating system (OS), it is possible to secure the file unit at the time of communication, but it is not possible to secure only specific data in the file. It was possible.

For example, in a database of compounds, if chemical structure data and other general data are organized into one file for each compound, the chemical structure data that requires security because each file requires a secret. , Since it can be disclosed, it will be mixed with general data that does not require security, but it was impossible to secure only chemical structure data.

Therefore, in such a case, conventionally, there is no method other than dividing the confidential data and the openable data into separate files.

[Problems to be Solved by the Invention]

However, when the original file is divided into different files, it is necessary to perform matching between the files when using the database.

For example, it is necessary to print out a list of each of a large number of divided files and associate each list with each other, which requires a lot of time and labor.

In addition, in order to avoid such work, it is necessary to create a program for matching, which requires labor to create the program and requires an identifier that is a key for matching. As the amount increases, problems such as an increase in memory capacity, a decrease in processing speed, and a complicated operation are caused.

The present invention has been made in view of the above problems, and an object of the present invention is to provide a security management system and a data processing device that can secure specific data in a file without dividing the file.

[Means for solving the problem]

In order to solve the above-mentioned problems, the security management method according to the invention of claim 1 sets a plurality of files FL constituting a database DB in respective files FL as shown in FIG. 1 and FIG. The specific data DSS requiring confidentiality is replaced with an identification data ID including identification information capable of identifying each file FL.

In the security management system according to the second aspect of the present invention, the specific data DSS is chemical structure data DS indicating the chemical structure CC of the compound.

The data processing apparatus 1 according to the invention of claim 3 is a data processing apparatus 1 capable of performing data processing on a database DB including a plurality of files 21,
Identification data including identification information that can identify 21
Identification data generating means 31 for generating an ID corresponding to each file 21 and specific data DS requiring confidentiality in each file 21 are stored in each file 21.
And data exchange means 33 for exchanging with the identification data ID corresponding to.

The data processing device 1 according to the invention of claim 4 generates an identification data ID including identification information capable of identifying each file 21 in association with each file 21. 31 and access permission determination means for determining whether or not the user is permitted to access the specific data DS in the file 21.
32 and data exchanging means 33 for exchanging specific data DS in each file 21 which is not allowed to be accessed with the identification data ID corresponding to each file 21.
And

[Action]

1st for explaining the security management system of this invention
As shown in the figure, confidential data (specific data) DSS1,2,3
If there is a database DB consisting of a plurality of files FL1,2,3 ... Each containing openable data DGG1,2,3 ... and secret data DSS1,2,3 ... and identification data ID1,2,3 ... and are replaced, and thereby a newly organized database (display database) DB1 is obtained.

Therefore, a person who is allowed to access only the database DB1 cannot access the secret data DSS1,2,3 ..., By this, the security of the secret data DSS1,2,3 ... Is maintained.

The identification data ID1,2,3 ... are the respective files FL1,2,3
It is possible to identify ... That is, for example, even if the order of the files FL1, 2, 3, ... Is changed in the database DB1, or the contents of the publishable data DGG1, 2, 3, ... Are changed, the respective identification data IDs 1, 2, ,
It is identified which file FL1,2,3 ... in the original database DB 3 ...

〔Example〕

 Embodiments of the present invention will be described below with reference to the drawings.

FIG. 3 is a block diagram showing the system configuration of the data processing apparatus 1 according to the present invention.

The data processing device 1 includes a storage device 11 including a hard disk 16 or a magnetic tape reader 17, a processing device 12 including a microprocessor, a display device 13 having a screen 13a, a printer 14, a keyboard 18, a mouse 19 and the like. The device 15 and the like are connected to the host computer 5 and other terminal devices 6 via the communication line 7.

The storage device 11 includes programs necessary for processing or control by the processing device 12, and compound data DC and data item names.
Various data such as DH and database DB are stored.

On a screen 13a of the display device 13, a data table TD described below and other data and images are displayed.

The printer 14 makes a hard copy of the data table TD or the screen 13a.

From the input device 15, a command for displaying the data table TD on the screen 13a, a command for switching the mode of the data processing device 1, and other commands and data necessary for the processing operation and display operation of the processing device 12 are input. It

The data processing device 1 can be realized by, for example, a so-called workstation, personal computer, or the like.

Next, the processing operation or display operation by the data processing device 1 will be described with reference to FIG.

FIG. 2 is a block diagram functionally showing the data processing device 1 according to the present invention.

In the storage device 11, a database DB including a plurality of compound data files 21 and data item name files 22 is stored.

Each compound data file 21 is a file in which chemical structure data DS about a compound and compound data DC including a plurality of general data DG are stored for each compound.

The chemical structure data DS is data representing how the atoms constituting the compound are bonded to each other, and uniquely defines the compound. The chemical structure data DS is composed of a set of data including various information such as atomic information indicating the types of atoms constituting the chemical structure, bond information indicating the bonding state of each atom, and stereoscopic information that is information on the three-dimensional structure. .
The chemical structure data DS is displayed on the screen 13a as a chemical structure CC according to a plane structural formula, a three-dimensional structural formula, or the like.

General data DG is data showing various properties of the compound represented by the chemical structure data DS.

In this embodiment, the chemical structure data DS is a secret data DSS that needs security because it requires a secret.
Therefore, the general data DG is the public data DGG that does not require security because it is public.

The data item name file 22 is a file that stores the data item name DH corresponding to the compound data DC.

Data item name DH is chemical structure data DS and general data
It is a heading for each data of DG, for example, chemical structure, boiling point, molecular weight, volume, activity, genus name, trade name, manufacturer and the like.

Compound data file 21 and data item name file 22
Is created by inputting necessary data in the data input mode of the display device 1, or downloaded from the host computer 5 or the terminal device 6, or a magnetic tape storing a created file is stored in the storage device 11. Supplied by setting to.

In the processing device 12, the display processing means 37 includes the input device 15
In response to a command from, all or part of the database DB stored in the storage device 11 is read, necessary arithmetic processing is performed, and the data table TD and the like is expanded in the display memory 38 and displayed on the screen 13a. .

FIG. 4 is a diagram showing an example of the data table TD1 displayed on the screen 13a in the table display mode.

Note that some of the chemical structures and names shown in the figure are not chemically accurate.

In FIG. 4, the data number ND is displayed on the screen 13a in the horizontal direction at the upper end and in the vertical direction at the left end, respectively, and in the horizontal direction at the lower end and the vertical direction at the right end, in the horizontal or vertical direction. Scroll bar SBH, SB that indicates the scroll position in the direction
V is displayed respectively. The data table TD1 is displayed inside these.

In the data table TD1, the data item name DH is arranged in the horizontal direction at the top row, the chemical structure CC is arranged in the vertical direction at the left end, and the general data DG is displayed at the intersections thereof.

The data number ND arranged in the vertical direction, that is, the row number is the file identification number of each compound data file 21, and is changed by changing the display position of each compound data DC.

Further, in the processing device 12, security management is performed on the chemical structure data DS in the compound data file 21 of the database DB.

That is, in the security management mode, an identification data ID that can identify each compound data file 21 is generated corresponding to each compound data file 21, and each generated identification data ID
Is replaced with the chemical structure data DS of each compound data file 21, and the resulting organized database (display database) DB1 is stored in the display data memory 34.

In security management mode, the user
The DB cannot be directly accessed, and only the display database DB1 for which security management has been performed can be accessed.

Therefore, the contents of the compound data file 21 are displayed on the screen 13
When displayed on a or printed by the printer 14, the chemical structure CC based on the chemical structure data DS is not displayed or printed, and the part becomes blank or the information based on the identification data ID is displayed. Or the display operation itself becomes impossible.

For example, when the data table TD is displayed in the security management mode, the display processing means 37
Reads the display database DB1 stored in the display data memory 34, and the data table TD is created based on this, so the chemical structure CC as shown in FIG. 4 is not displayed on the screen 13a. Instead of, the identification data ID is displayed.

Further, when the compound data file 21 is transmitted to the host computer 5 or another terminal device 6 via the communication line 7, the compound data file 21 of the display database DB1 is transmitted. Therefore, the chemical structure data DS is not transmitted, but the identification data ID is transmitted instead.

Therefore, the operator of the terminal device 6 receiving the display database DB1 can change the content of the compound data file 21, but cannot display the chemical structure CC for viewing.

The identification data ID is identification information such as the file identification number of each compound data file 21 that enables the correspondence of each compound data file 21 between the display database DB1 and the original database DB. It is the data including. However, data suggesting the chemical structure CC, such as the name of a compound or the name of SEMA, is not preferable.

As the identification data ID, for example, a number or symbol similar to or similar to the file identification number of the compound data file 21 is used.

To switch to security management mode, use the input device 15
The identification code (user ID, etc.) of the user input from is identified, and when the user is not permitted to access the chemical structure data DS, it is automatically performed. In addition, a user who is allowed to access the chemical structure data DS, for example, the person who is the creator or administrator of the database DB can also switch to the security management mode by operating the input device 15.

In order to perform security control, in the embodiment shown in FIG. 2, the identification data generating means 31 for generating the identification data ID, the user is allowed to access the chemical structure data DS in each compound data file 21. Access availability determination means 32 for determining whether or not there is provided, and data exchange means 33 for exchanging the chemical structure data DS with the identification data ID corresponding to each compound data file 21 are provided.

Each of these means is realized by executing a processing program in the processing device 12.

Next, the security management operation in the data processing device 1 will be described with reference to the flowchart.

FIG. 5 is a flowchart showing an example of the display operation of the data processing device 1.

The user of the data processing device 1 inputs a user ID from the input device 15.
When the user inputs (for example, login name), the check is performed (step # 11).

As a result of the check, when it is determined that the user is permitted to access the chemical structure data DS (Yes in step # 12), the display processing based on the database DB is performed, and for example, as shown in FIG. Data table TD1 as shown
Is displayed (step # 13).

When it is determined that access to the chemical structure data DS is not permitted (No in step # 12), the identification data ID is automatically generated (step # 14), and the chemical structure data DS is identified as the identification data ID. Exchanged with display database
DB1 is organized (step # 15), and display processing is performed based on this display database DB1 (step # 1).
6).

That is, in this case, the chemical structure data DS is protected.

As a result, security management is performed according to the user.

According to the above-mentioned embodiment, since the chemical structure data DS which is the specific data in the compound data file 21 is protected and its security management is performed, it is not necessary to divide the compound data file 21 and therefore it is divided. There is no need to perform mashing between files, and problems such as increased memory capacity, reduced processing speed, and complicated operations do not occur.

Therefore, when the database DB created in the data processing device 1 of a research department requires cooperation from other research departments such as examination, advice, or additional editing, the chemical structure data DS that requires confidentiality is protected. By organizing the display database DB1 and transmitting this display database DB1 to the terminal device 6 of another research department, the chemical structure CC is not exposed to the eyes of others, and thus confidential information is not leaked. , The database DB security can be easily managed.

In the above-described embodiment, only the chemical structure data DS in the compound data file 21 is used as the secret data DSS, but with this, a part of the other general data DG is also used as the secret data DSS.
It may be. In that case, the user and confidential data DS
It is possible to define the accessible level according to the contents of S and perform security management according to the level.

In the above-described embodiment, the identification data ID is automatically generated. However, even if the user manually inputs a number or symbol unique to each file such as a development number or a development code, for example. Good.

In addition, the configuration of the compound data file 21, the database DB, the storage device 11, the processing device 12, or the data processing device 1
The configuration, the processing content, the processing order, and the like can be variously changed other than those described above.

〔The invention's effect〕

According to the present invention, when using a data processing device that handles a database, or when using a database for communication such as e-mail, security can be applied to specific data in a file without dividing the file. .

In particular, according to the invention of claim 2, the security control of the chemical structure containing a lot of important information about the compound can be easily performed, and the computerization of the compound data can be promoted with confidence.

[Brief description of drawings]

FIG. 1 is a diagram for explaining a security management system according to the present invention, FIG. 2 is a block diagram mechanically showing a data processing device according to the present invention, and FIG. 3 is a system of the data processing device according to the present invention. FIG. 4 is a block diagram showing the configuration, FIG. 4 is a diagram showing an example of a data table displayed on the screen in the table display mode, and FIG. 5 is a flowchart showing an example of a display operation of the data processing device. In the figure, 1 is a data processing device, 21 is a compound data file (file), 31 is an identification data generating means, 32 is an accessibility determination means, 33 is a data exchange means, DB is a database, FL is a file, DSS is secret data. (Specific data), DS is chemical structure data (specific data), ID is identification data, and CC is chemical structure.

Claims (4)

(57) [Claims] 1. With respect to a plurality of files (FL) that constitute a database (DB), specific data (DSS) that requires confidentiality in each file (FL) is identified for each file (FL). This is a file security management method characterized by replacing with identification data (ID) that contains possible identification information. 2. The file security management method according to claim 1, wherein the specific data (DSS) is chemical structure data (DS) indicating a chemical structure (CC) of a compound. 3. A data processing device (1) capable of data processing for a database (DB) comprising a plurality of files (21), including identification information capable of identifying each file (21). The identification data generating means (31) for generating the identification data (ID) corresponding to each file (21), and the specific data (DS) requiring confidentiality in each file (21), Data exchange means (3) for exchanging with the identification data (ID) corresponding to each file (21)
3) A data processing device comprising: 4. A data processing device (1) capable of data processing for a database (DB) comprising a plurality of files (21), including identification information capable of identifying each file (21). The identification data generating means (31) for generating the identification data (ID) corresponding to each file (21) and the specific data (DS) in each file (21) by the user.
Accessibility determination means (32) for determining whether or not access to the file is permitted, and specific data (DS) in each file (21) that is not permitted to access And a data exchanging means (33) for exchanging the identification data (ID) corresponding to.