JP4240929B2 - Access control method in file management system - Google Patents

Description

[0001]
BACKGROUND OF THE INVENTION
The present invention relates to an access control method in a file management system, and more particularly to an access control method at the time of internal / external login in a Web-based file management system.
[0002]
[Prior art]
Today, with the advancement of technology such as the Internet, a common workspace (corporate wear, etc.) is being provided, both inside and outside the company, and beyond the boundaries between companies, and its needs are expanding. As described above, while file management systems and the like are becoming more seamless, there is an increasing demand for security enhancement.
[0003]
Incidentally, as an access control method in the conventional file management system, the access right is made different depending on the terminal group (refer to Japanese Patent Laid-Open No. 02-282842), or the validity of the access is changed according to the time zone (Japanese Patent Laid-Open No. 02-2009). 285439) and various methods for suppressing the contents of a presentation by a user (see Japanese Patent Laid-Open No. 03-154969) have been known.
[0004]
[Problems to be solved by the invention]
However, in the conventional technology, whether the user accesses an object such as a cabinet, a folder, or a document (document) from inside the company or accesses the object from outside the company, the security level is the same. When accessing, there is a problem that it cannot be performed even if there is a request to enhance the security compared to accessing the object from within the company. The reason is that the file management server can set access rights used for rights authorization (Authorization) in units of objects such as cabinets, folders, and documents, but even if the same user accesses the same object from within the company This is because even when the same object is accessed from outside the company, the access right information set for the object is the same.
[0005]
It is an object of the present invention to set different access rights for access to the same object from the same user depending on whether access from the inside or outside the company in a Web-based file management system. An object is to provide an access control method in a file management system.
[0006]
Another object of the present invention is that in a Web-based file management system, even if the same user accesses the same object, the right depends on whether the access is from within the company or from outside the company. An object of the present invention is to provide an access control method in a file management system in which authentication is different.
[0007]
[Means for Solving the Problems]
The access control method in the file management system of the present invention is based on whether or not the user ID received from the client is registered in the user information list table when the client requests login to the file management server in the web-based file management system. If the user ID is registered, it is checked whether the password received from the client matches the password registered in the user information list table corresponding to the user ID. Obtains the user information of the user from the user information list table and returns it to the client, the instance ID indicating the target object, the user information obtained from the authentication server, and the login time Access A client that passes the IP address of the Web server that has been passed to the file management server, a database that registers objects and access rights information for each object, and an available Web server installation information table, and the client accesses the object When requested, the installation information corresponding to the IP address is acquired from the available Web server installation information table, and the access right information of the target object is searched using the user information and the installation information as a key, and the target object of the user A file management server that determines whether or not the user has an access right, accesses the object when the user has an access right to the target object, and transmits the access result to the client.
[0008]
Further, the access control method in the file management system of the present invention is characterized in that the access right information includes at least a request source indicating a user and a login time. Access It is characterized by including installation information indicating whether the Web server passed through is present inside or outside the firewall, and whether or not the user has an access right to the object.
[0009]
Furthermore, in the access control method in the file management system of the present invention, the usable Web server installation information table indicates the IP address of the Web server and the installation information indicating whether the Web server exists inside or outside the firewall. It is characterized by including.
[0010]
On the other hand, the access control method in the file management system of the present invention includes a step of acquiring user information as an authentication result from the authentication server when the client logs in to the file management server, and the user information and the client information when the client requests access to the object. Web server that was accessed and accessed during login A step of passing the IP address to the file management server, a step of determining whether or not the IP address is registered in an available Web server installation information table, and a file management when the IP address is registered The server acquires installation information corresponding to the IP address from the available Web server installation information table, and the file management server searches the access right information of the target object using the user information and installation information as a key to the user object. Determining whether there is an access right for the user, a step in which the file management server accesses the target object when the user has access right to the object, and transmits the access result to the client, and the client in the file management server From the object's Characterized in that it comprises the step of receiving the access result.
[0011]
On the other hand, the program of the present invention includes a step of acquiring user information as an authentication result from an authentication server when logging into a file management server, and the user information and Web server that was accessed and accessed during login The step of passing the IP address to the file management server and the step of receiving the access result of the object from the file management server are executed.
[0012]
Further, the program of the present invention refers to an available Web server installation information table on a computer when a client logs in. Access A step of determining whether or not the IP address of the Web server that has passed is registered, and a step of acquiring installation information corresponding to the IP address from the available Web server installation information table when the IP address is registered And searching for access right information using user information and installation information as a key to determine whether or not the user has access to the object, accessing the object when the user has access to the object, And a step of transmitting the access result to the client.
[0013]
The present invention is characterized in that in-house Web server or external Web server installation information (information inside / outside the firewall) that is passed through when logging in to the file management server is used in right authentication performed by the file management server. Is. When a user logs in to a file management server from a client via an in-house Web server, an object to be accessed (hereinafter referred to as a target object) can be accessed, while file management from the client via an external Web server is possible. When logging in to the server, the target object cannot be accessed. For this reason, the installation information of the Web server is used as part of the access right information from the user to the file management server.
[0014]
DETAILED DESCRIPTION OF THE INVENTION
Hereinafter, embodiments of the present invention will be described in detail with reference to the drawings.
[0015]
[First Embodiment]
FIG. 2 is a system configuration diagram of a file management system to which the access control method according to the first embodiment of the present invention is applied. This file management system is connected to an internal network 10 such as a local area network (LAN), an authentication server 20 connected to the internal network 10, a file management server 30 connected to the internal network 10, and an internal network 10. Web server (hereinafter referred to as an internal Web server) 40, a firewall 50 connected to the internal network 10, and a Web server (hereinafter referred to as an external Web server) 60 connected to an external line such as the firewall 50 and the Internet. And a plurality of clients 70 that log in to the file management server 30 via the internal Web server 40 or the external Web server 60.
[0016]
Referring to FIG. 1, the authentication server 20 includes an authentication unit 21 and a user information list table 22.
[0017]
FIG. 3 shows a data structure diagram of the user information list table 22 managed by the authentication server 20. In the user information list table 22, user information including a user ID (IDentification), a user name, a password, a department ID, a department name, and the like of a user permitted to log in to the file management server 30 is registered and collectively managed. Has been.
[0018]
Referring to FIG. 1, the file management server 30 includes a database 31 and an available web server installation information table 32.
[0019]
The database 31 hierarchically holds objects such as cabinets and documents in a tree shape, and each object has access right information (A *) (* represents a wild card) as an attribute. . Each object (instance) has a unique instance ID that is automatically generated at the time of registration on the database 31, and the instance ID is used to specify the object. The instance ID is passed from the client 70 to the file management server 30 together with the user information (P1) and the IP address (IP1) of the internal Web server 40 or the external Web server 60. In the example of FIG. 1, the database 31 includes “cabinet” and its subordinates “document D1”, “document D2”, and “document D3”. Further, access right information A1 is registered as an attribute in “document D1” (the same applies to other objects).
[0020]
Referring to FIG. 4, access right information (A *) is managed in one table for each object, and forms of combinations (AND conditions, OR conditions, etc.) of conditional expressions using user information (P *). It is possible to set with. The access right information (A *) includes a request source, a job title range, installation information, and presence / absence of an access right (reference right, update right, and deletion right). The request source is a character string representing a user, a department to which the request belongs. The job title range stores, for example, a name, department name, work location, job title, and the like. The installation information is a condition indicating whether the user has logged in to the file management server 30 via the internal Web server 40 or the external Web server 60 (0 is the internal Web server 40 and 1 is the external Web server 60). The presence / absence of the access right (reference right, update right and deletion right) is indicated as ◯ or X for easy understanding, but is managed as a numerical value on the database 31.
[0021]
In the file management server 30, reference rights, update rights, deletion rights, etc. are defined as types of access rights that can be set for each object such as a cabinet and a document. For example, when a reference to an object is requested from the client 70, the file management server 30 authenticates whether the requesting user has a reference right for the target object.
[0022]
The file management server 30 incorporates the installation information of the internal Web server 40 or the external Web server 60 as one category of the access right information, so that the right internal authentication is performed when the user accesses the target object. Only the access right information (A *) that matches the installation information of the Web server 40 or the external Web server 60 is subject to right authentication (separated and determined).
[0023]
FIG. 5 is a diagram showing a data structure of the available Web server installation information table 32. The available Web server installation information table 32 is a file management in which the IP address and installation information indicating whether the Web server is installed inside or outside the firewall 50 (0 inside the firewall 50 and 1 outside the firewall 50) are records. The number of registered internal Web servers 40 and external Web servers 60 that can be used for logging in to the server 30 is registered. The file management server 30 performs right authentication on the user object based on the user information and the IP address and the available Web server installation information table 32.
[0024]
Since the file management server 30 cannot determine whether the user has logged in via the Web server installed inside or outside the firewall 50 only with the IP address (IP1) of the via Web server passed from the client 70, the file management server The installation information is registered in advance in the 30 available web server installation information tables 32.
[0025]
Referring to FIG. 6, the user authentication (Authentication) process in the authentication server 20 includes a user ID registration determination step S101, a password correctness determination step S102, and a user information return step S103.
[0026]
Referring to FIG. 7, the right authentication process in the file management server 30 includes an IP address registration determination step S201, an installation information acquisition step S202, an object presence determination step S203, and a user access right presence / absence determination step S204. It consists of object return step S205.
[0027]
Next, the operation of the access control method in the file management system according to the first embodiment configured as described above will be described.
[0028]
(1) About user authentication (Authentication) by the authentication server 20
[0029]
The user needs to log in to the file management server 30 from the client 70 via the internal Web server 40 or the external Web server 60 before accessing the object of the file management server 30. The user normally logs in to the file management server 30 from the client 70 connected to the internal network 10 via the internal Web server 40 installed in the firewall 50. However, when logging in to the file management server 30 from a client 70 such as a business trip destination or home, the user can log in to the file management server 30 only through the external Web server 60 installed outside the firewall 50. It is. However, it is possible for a user to access an object from inside the company via the external Web server 60 unless the firewall 50 restricts the object.
[0030]
When the user logs in to the file management server 30 from the client 70 via the internal Web server 40 or the external Web server 60, user authentication is performed by the authentication server 20.
[0031]
Specifically, the user inputs a user ID and password from the login screen of the client 70 and requests login to the file management server 30. At this time, communication between the client 70 and the authentication server 20 is performed, and user authentication by the authentication server 20 is performed. Communication between the client 70 and the file management server 30 is performed by the client 70 such as acquisition of an attribute list, confirmation of update on the update screen, acquisition of subordinate lists such as cabinets and folders, and deletion of targets. This is the point when the button is pressed.
[0032]
The authentication server 20 first checks whether the user ID received from the client 70 is registered in the user information list table 22 (step S101). If the user ID is not registered, the authentication server 20 returns an error to the client 70.
[0033]
If the user ID is registered, the authentication server 20 checks whether or not the password received from the client 70 matches the password registered in the user information list table 22 corresponding to the user ID (step S102). ). If the passwords do not match, the authentication server 20 returns an error to the client 70.
[0034]
If the passwords match, the authentication server 20 acquires the user information (P1) of the corresponding user from the user information list table 22, returns it to the client 70 (step S103), and ends the process.
[0035]
A cabinet list table (not shown) is acquired simultaneously with login to the file management server 30, and a user-specific cabinet list table is usually displayed on the screen of the client 70. The objects displayed in the cabinet list table are only those for which the logged-in user has access rights, and only some attributes of each object are displayed in the cabinet list table.
[0036]
(2) Rights authentication in the file management server 30 (Authorization)
[0037]
After a user-specific cabinet list table (not shown) is displayed on the screen of the client 70, when the user requests access to the object from the client 70, the file management server 30 indicates that the requesting user is the access target. Rights authentication is performed as to whether or not an object (hereinafter referred to as a target object) has access rights.
[0038]
First, the client 70 passes the instance ID indicating the target object to the file management server 30 together with the user information obtained from the authentication server 20 and the IP address (IP1) of the internal Web server 40 or external Web server 60.
[0039]
The file management server 30 performs user right authentication for the target object based on the user information (P1) acquired by the user authentication and the IP address (IP1) of the internal Web server 40 or the external Web server 60 via the user authentication. .
[0040]
Here, consider a case where the user H (user information P1) requests reference to the “document D1” (see FIG. 5). It is assumed that access right information (A1) as shown in FIG. 5 is set as an attribute in “document D1” for user H who is the request source.
[0041]
When a list of objects under “cabinet” is displayed on the client 70 (only a part of attributes are displayed for “document D1”), the user H makes a reference request for “document D1” (presses the reference button). Then, the client 70 passes the user information (P1) and the IP address (IP1) of the via Web server (internal Web server 40 or external Web server 60) to the file management server 30.
[0042]
The file management server 30 first determines whether or not the IP address (IP1) of the via Web server passed from the client 70 is registered in the available Web server installation information table 32 (Step S201).
[0043]
If the IP address (IP1) is registered in the available Web server installation information table 32, the file management server 30 sets the installation information corresponding to the IP address of the via Web server (0 is inside the firewall 50 and 1 is outside the firewall 50). ) Is acquired (step S202).
[0044]
Next, the file management server 30 checks whether or not “document D1” exists in the database 31 based on the instance ID (step S203). The file management server 30 collectively manages the list table corresponding to the objects existing on the database 31, and performs a comparison process between the instance ID and the data of the list table.
[0045]
If “document D1” exists on the database 31, the file management server 30 performs right authentication to determine whether the requesting user H has the right to refer to “document D1” (step S204). Specifically, the file management server 30 first acquires the access right information (A1) of “document D1”. At this time, if the IP address of the via Web server is registered in the available Web server installation information table 32, and the installation information corresponding to the IP address is determined to be 0, the file management server 30 specifies “user H Only the condition that “can be referred to and updated” is subject to right authentication. Therefore, in this case, the file management server 30 determines that the user H has the right to refer to and update the “document D1”.
[0046]
Next, the file management server 30 acquires the document D1 and its attributes from the database 31, and returns them to the client 70 (step S205).
[0047]
When the client 70 receives the document D1 and its attributes from the file management server 30, the client 70 can refer to them.
[0048]
In the above description of the operation, the case where the access is a reference has been described as an example, but it goes without saying that the operation is almost the same even when the access is an update and deletion.
[0049]
Although the case where the object is a document has been described as an example, it goes without saying that the access control to the object can be performed not only in document units but also in folder units and cabinet units.
[0050]
As described above, according to the first embodiment, by providing a mechanism for performing right authentication in consideration of whether the Web server that has passed through when logging in to the file management server 30 exists in the company or outside the company. As for access to the same object from the same user, the right authentication can be made different depending on whether the access is made from within the company or from outside the company. For example, regarding access to the same object from the same user, reference can be made from inside or outside the company, while updating can be permitted only from inside the company.
[0051]
[Second Embodiment]
FIG. 8 is a block diagram showing the configuration of the access control method in the file management system according to the second embodiment of the present invention. The access control method in the file management system according to the present embodiment is provided with an authentication server program 200 in the authentication server 20 compared to the access control method in the file management system according to the first embodiment shown in FIG. The only difference is that the file management server 30 includes a file management server program 300.
[0052]
The authentication server program 200 is read into the authentication server 20 that is a computer, and controls the operation of the authentication server 20 as the authentication unit 21 and the user information list table 22. Since the operation of the authentication server 20 under the control of the authentication server program 200 is exactly the same as the operation of the authentication server 20 in the first embodiment, a detailed description thereof will be omitted.
[0053]
The file management server program 300 is read into the file management server 30 that is a computer, and controls the operation of the file management server 30 as a database 31 and an available Web server installation information table 32. Since the operation of the file management server 30 under the control of the file management server program 300 is exactly the same as the operation of the file management server 30 in the first embodiment, its detailed description is omitted.
[0054]
【The invention's effect】
The first effect is that it is possible to provide an access control function corresponding to a diversified use situation of users by widening the range of conditions that can be set as access rights. The reason is that a mechanism is provided for performing right authentication taking into account whether the Web server through which the file management server is logged in exists in the company or outside the company.
[0055]
The second effect is that security can be strengthened accordingly. This is because, for example, regarding access to the same object from the same user, reference can be made from inside or outside the company, but update can be permitted only from inside the company. .
[Brief description of the drawings]
FIG. 1 is a block diagram showing a configuration of an access control method in a file management system according to a first embodiment of the present invention.
FIG. 2 is a system configuration diagram of a file management system to which the access control method according to the first embodiment is applied.
FIG. 3 is a data structure diagram of a user information list table managed by the authentication server in FIG. 1;
4 is a data structure diagram of access right information managed by the database in FIG. 1. FIG.
FIG. 5 is a data structure diagram of an available Web server installation information table in FIG. 1;
6 is a flowchart showing user authentication processing in the authentication server in FIG. 1. FIG.
7 is a flowchart showing a right authentication process in the file management server in FIG. 1. FIG.
FIG. 8 is a block diagram showing a configuration of an access control method in a file management system according to a second embodiment of the present invention.
[Explanation of symbols]
10 Internal network
20 Authentication server
21 Authentication means
22 User information list table
30 File management server
31 database
32 Available Web Server Installation Information Table
40 In-house Web server
50 Firewall
60 External Web server
70 clients
200 Authentication server program
300 File management server program
S101 User ID registration determination step
S102 Password correct / incorrect determination step
S103 User information return step
S201 IP address registration determination step
S202 Installation information acquisition step
S203 Object existence determination step
S204 User access right presence / absence determination step
S205 Object return step

Claims (7)

In a web-based file management system,
When a login request from the client to the file management server is requested, it is checked whether or not the user ID received from the client is registered in the user information list table. If the user ID is registered, the password received from the client is the user Check whether it matches the password registered corresponding to the user ID in the information list table, and if the password matches, obtain the user information of the corresponding user from the user information list table and return it to the client An authentication server;
A client that passes to the file management server an instance ID indicating a target object, user information obtained from the authentication server, and an IP address of a Web server that is accessed through login;
A database for registering objects and access rights information for each object, and an available Web server installation information table; when there is a request for access to an object from a client, the available Web server installation information table Obtains installation information corresponding to the IP address, searches the access right information of the target object using the user information and installation information as keys, determines whether the user has access rights to the target object, and the user accesses the target object A file management system comprising: a file management server that accesses an object when having the right and transmits an access result to the client. The access right information is at least
A requester indicating the user,
Installation information indicating whether the web server that was accessed via login exists inside or outside the firewall;
The file management system according to claim 1, further comprising: presence or absence of an access right to a user's object. The available web server installation information table is:
The IP address of the web server,
The file management system according to claim 1, further comprising: installation information indicating whether the Web server exists inside or outside the firewall. A step of acquiring user information as an authentication result from the authentication server when the client logs in to the file management server;
When the client makes an access request to the object, the user information and the IP address of the Web server that was accessed via login are passed to the file management server, and the IP address is registered in the Web server installation information table available to the file management server. Determining whether or not
The file management server acquiring installation information corresponding to the IP address from the available Web server installation information table when the IP address is registered;
A step in which the file management server searches the access right information of the target object using the user information and the installation information as a key and determines whether or not the user has access right to the object;
A step in which the file management server accesses the target object and sends the access result to the client when the user has access to the object;
A client receiving an object access result from the file management server; and an access control method in the file management system. Determining whether or not the IP address of the Web server through which the client accessed and logged in is registered by referring to the available Web server installation information table;
Obtaining installation information corresponding to the IP address from the available Web server installation information table when the IP address is registered;
Searching for access right information using user information and installation information as a key, and determining whether or not the user has access to the object;
A file management server executes a process of accessing an object when the user has access rights to the object and transmitting an access result to a client. On the computer,
Determining whether or not the IP address of the Web server through which the client accessed and logged in is registered by referring to the available Web server installation information table;
Obtaining installation information corresponding to the IP address from the available Web server installation information table when the IP address is registered;
Searching for access right information using user information and installation information as a key, and determining whether or not the user has access to the object;
A program for accessing an object when the user has access to the object and sending the access result to the client. Determine whether the IP address of the Web server through which the client accessed and logged in is registered by referring to the available Web server installation information table,
Obtaining installation information corresponding to the IP address from the available web server installation information table when the IP address is registered;
Search the access right information using the user information and installation information as a key, determine whether the user has access to the object,
A file management server that accesses an object when the user has access rights to the object and sends the access result to the client.

Images