JP4371995B2 - Shared file access control method, system, server device, and program - Google Patents

Description

  The present invention relates to a shared file access control method, system, server apparatus, and program, and in particular, in a server client type computer system, an access log executed by a user having access authority to a shared file on a server. It relates to access control during acquisition.

  Conventionally, when a file in which confidential information is recorded is shared on a server, a file system access permission setting (ACL: Access Control List) used in the operating system and a technique for storing the ACL together with the file described in Patent Document 1 It was possible to limit the persons who can view the file by, for example.

However, since there are various methods for browsing the file, it is difficult to ensure that the record is recorded in the log when a user permitted to browse the file browses the file. For example, even if a file access record when a file is accessed using a certain program can be collected in a log, but there is a means to access the file using another program, the operation record can be recorded. Cannot be left in the log. Also, when trying to collect all file access records in a log, the log has low-level contents, making analysis and subsequent reuse difficult.
JP 2004-164604 A

  As described above, when a file in which confidential information is recorded is stored on the server, an unauthorized user obtains the file, such as a file system ACL or a technique for storing the ACL together with the file described in Patent Document 1. Conventionally, there has been a technique for preventing this. However, these techniques do not have a viewpoint of leaving a record when an authorized user acquires a file.

  Most of the information leak cases that have occurred recently are leaks from authorized users, and it is considered important as an information leak countermeasure to leave a record when an authorized user acquires a file. At that time, in order to leave a highly accurate log that can be traced after file acquisition, it is necessary to create a dedicated access means (dedicated program) for acquiring the file. However, the problem in this case is that if there is another access means for accessing the file in addition to the dedicated access means, the log becomes meaningless.

  The present invention has been made in consideration of such a conventional situation, and even when an authorized person acquires a shared file in which confidential information is recorded, it is possible to leave a more accurate log. With the goal.

In order to achieve the above object, an access control method according to the present invention is a file access control method that can be shared by a plurality of users , wherein the first storage means stores the file in the file storage area. Storing the first access permission information for restricting the access authority to only a dedicated user for which a user account for the dedicated user has been set in advance, and a second storing means includes the file in the file storage area. Storing the second access permission information for restricting the access authority of the file for each of the plurality of users in association with the file, and impersonating means for accessing the file Sometimes, the user authenticated user is disguised to become the dedicated user and the first access permission information is used to A step of reading the file access to Airu storage area, the access permission determination means, read access of the user authenticated the file by the user was based on the second access permission information associated with the file And a step of determining availability.

In the present invention, the log output means may further include a step of outputting a log relating to access to the file storage area. The step of storing the second access permission information is a step in which the second storage unit encrypts and stores the second access permission information and the file data individually, and the step of reading the file May be a step in which the disguise means individually decrypts and reads the second access permission information and the data of the file. In the step of storing the second access permission information, the second storage unit uses a file name of the file used by the user when the file is stored in the file storage area. There may be a step of storing differently from the name. Further, in the step of storing the second access permission information, the second storage unit displays the arrangement structure of the file stored in the file storage area in a virtual hierarchy on the display screen on the user side. You may have the step which creates and preserve | saves the definition file for virtualizing so that it can visually recognize as a structure.

  The shared file access control system according to the present invention is a file access control system that can be shared by a plurality of users, and the access authority in the file storage area for storing the file is assigned in advance to a user account for a dedicated user. First storage means for storing first access permission information for restricting only to a dedicated user for which the file is set, and when the file is stored in the file storage area, the access authority for the file is Second storage means for storing second access permission information for restricting each of a plurality of users in association with the file, and a user authenticated by the user when the file is accessed becomes the dedicated user. The file storage area is accessed based on the first access permission information by impersonating the file. Disguise means for reading a file, and access permission determination means for determining whether the user authenticated by the user authenticated based on the second access permission information associated with the read file. Features.

The present invention may further include log output means for outputting a log relating to access to the file storage area. The second storage means encrypts and stores the second access permission information and the file data individually, and the impersonation means stores the second access permission information and the file data. You may decode and read separately. The second storage means includes means for storing the file name different from the file name used by the user when the file is stored in the file storage area. Also good. Further, the second storage means creates a definition file for virtualizing the arrangement structure of the files stored in the file storage area so as to be visible as a virtual hierarchical structure on the display screen on the user side. You may have a means to create and save.

  Still further, the access control system includes a server device having a storage device for storing the shared file and operating under program control, and a client device connected to the server device so as to be communicable and operating under program control. The first and second storage units, the disguise unit, the access permission determination unit, and the log output unit may be configured to function by program control by the server device.

  A server device according to the present invention is a server device that is communicably connected to a client device and that stores a file that can be shared by a plurality of users of the client device, and stores the file. First storage means for storing first access permission information for restricting access authority in the file storage area only to a dedicated user for which a user account for the dedicated user has been set in advance; When the file is stored, second storage means for storing the second access permission information for limiting the access authority of the file for each of the plurality of users in association with the file, and the file is accessed. The first access permission by impersonating the user authenticated user as the dedicated user. Access to the file storage area based on information, and the disguise means for reading the file, and access of the file by the user authenticated based on the second access permission information associated with the read file Access permission determination means for determining permission / inhibition.

  The present invention may further include log output means for outputting a log relating to access to the file storage area.

  The shared file access control program according to the present invention is a file access control program that can be shared by a plurality of users, and the access authority in the file storage area for storing the file is given in advance as a user account for a dedicated user. Storing the first access permission information for limiting only to a dedicated user for which the file is set, and when the file is stored in the file storage area, the access authority of the file is set for each of the plurality of users. Storing the second access permission information for restricting to the file in association with the file, and when the file is accessed, impersonating the user who has been authenticated as the dedicated user. Based on the access permission information, the file storage area is accessed and the file is read. And a step of determining whether or not the user authenticated by the user authenticated can access the file based on the second access permission information associated with the read file. .

  In the present invention, the computer may further execute a step of outputting a log relating to access to the file storage area.

  According to the present invention, it is possible to eliminate a means for accessing a file other than a dedicated access means for obtaining a file, so that even when an authorized person obtains a shared file in which confidential information is recorded, more It becomes possible to leave a highly accurate log more reliably.

  Next, a best mode for carrying out a shared file access control method, system, server device, and program according to the present invention will be described in detail with reference to the drawings.

  The shared file access control system according to the present embodiment includes the following means 1) to 6), and limits the number of programs that can access a file in which confidential information is recorded (hereinafter referred to as “ This is called a "file access program"), and cannot be accessed from other programs.

  1) Create a dedicated user account on the server operating system. This user account is created as a user who cannot log on interactively to the operating system, and only the file access program knows the password for this user.

  2) The ACL on the file system of the target file is made accessible only by the dedicated user.

  3) In the file, an ACL different from the ACL on the file system is added and stored in the file.

  4) After performing user authentication, the file access program impersonates the process (thread) as the dedicated user account of 1) above, reads the file, and compares the ACL added in the file with the authenticated user information. And determine whether access is possible.

  Thus, the target file cannot be accessed from a general user program. However, since the operating system has a privilege to ignore the ACL on the file system, the following measures are taken.

  5) The file and the ACL added to the file are encrypted and stored, and only the file access program can decrypt them.

  6) The file arrangement structure is virtualized, and the actual file name is saved under a name different from the file name visible to the user.

  According to the present embodiment, when sharing a file in which confidential information is recorded on the server, the number of persons who can view the file is limited, and when a person who is permitted to view the file views the file, Records can be reliably logged.

  Hereinafter, embodiments of the present invention will be described with reference to FIGS.

  The shared file access control system according to the present embodiment shown in FIG. 1 applies a server client type computer system, and communicates with the server 10 via a communication network such as a LAN (Local Area Network). And a client 20 that is connected in a possible manner. In the example of FIG. 1, the case where one server 10 and one client 20 are arranged for convenience of explanation is illustrated, but a configuration in which a plurality of servers 10 and clients 20 are arranged is also applicable.

  The client 20 is configured by a computer machine capable of various operations by a user such as a PC (Personal Computer). This computer machine includes a CPU (Central Processing Unit) 201, a memory (ROM / RAM) 202 connected to the CPU 201 via a bus, and a CPU 201 and a storage device (hard disk drive, optical disk drive) in terms of hardware configuration. Etc.), various IO controllers 203 for connecting various input / output (IO) devices 204 such as display devices (CRT, liquid crystal display, etc.), input devices (keyboard / mouse, etc.), communication interfaces (LAN cards, etc.), etc. ing.

  The software executed as a process by the CPU 201 includes an operating system (OS) 22 including a file system, driver programs for various IO devices (not shown) operating on the OS 22, communication programs, and other application programs (word processor, A spreadsheet program 23) is installed. For example, a Windows (registered trademark) OS is used as the OS 22, but the present invention is not limited to this, and other OSs such as a UNIX (registered trademark) OS such as Linux can also be applied.

  In the present embodiment, a client program 21 operating on the OS 22 is included as software used on the client 20 side. The client program 21 functions as a browsing program (viewer) when accessing a shared file in which information such as confidential information on the server 10 is recorded and performing the file operation. On the screen displayed on the display unit by the client program 21, the arrangement of folders / files shared on the server 10 can be easily visually confirmed. File operations such as file selection and access can be performed (for example, see FIGS. 9 to 11 described later).

  The server 10 is composed of one or a plurality of computer machines such as a PC server and a dedicated server. In this computer machine, in addition to a CPU (Central Processing Unit) 101, a storage device such as a memory (ROM / RAM) 102 connected to the CPU 101 via a bus, an HDD (hard disk drive), etc. Various input / output (IO) devices, such as a communication interface such as a LAN card, are mounted.

  The software executed as a process by the CPU 101 includes an operating system (OS) 17 including a file system responsible for file management of the storage device 12, driver programs for various IO devices (not shown) operating on the OS 17, communication programs, A database management system (DBMS) and other application programs are installed. For example, a Windows (registered trademark) OS is used as the OS 17, but the present invention is not necessarily limited to this, and other OSs such as a UNIX (registered trademark) OS such as Linux can also be applied.

  In this embodiment, as the software used on the server 10 side, the file access program 11 that operates on the OS 17 and uses the shared file access control method of the present invention can be operated in cooperation with the file access program 11. The database (DB) includes an account database (A) 14, an account database (B) 15, a log database 13, and a registry database 16.

  In the account database (A) 14, user accounts 141 such as user names and passwords necessary for user authentication and the like are registered in advance for users who access the server 10 from the client 20. An example of this user account 141 is shown in FIG. In the example of FIG. 2, a plurality of users (“user name”: “User 1”, “User 2”,..., “User 5”, “password”: “xxxxxxx1”, “xxxxxxx2”,..., “Xxxxxxx5”) The user account 141 is illustrated.

  In the account database (B) 15, a user name of a dedicated user used by the file access program 11 when accessing a folder / file (hereinafter collectively referred to as “file” as necessary) 125 shared on the server 10. A user account 151 such as a password is registered in advance. An example of this user account 151 is shown in FIG. In the example of FIG. 3, a user account 151 of a dedicated user (“user name”: “User X”, “password”: “xxxxxxxx”) is illustrated. This user account 151 is created as a user who cannot log on to the OS interactively (no authority to log on locally), and only the file access program 11 can recognize the password of this dedicated user. ing. This user account 151 is created when the file access program 11 is installed, for example.

  A log 131 output from the file access program 11 is recorded in the log database 13. In this log 131, for example, information on when / who / from / what / what operation was performed on a folder / file shared on the storage device 12, the client 20 side that was the target of the operation Information such as a file name and a folder name on the server 10 side (see FIG. 13 described later) is stored.

  A file storage area 121 including a folder (directory) for storing the file 125 shared on the server 10 is created on the storage device 12. The file storage area 121 is created when the file access program 11 is installed, for example. ACL (hereinafter referred to as first access permission information of the present invention) which is access permission information used in the file system of the OS 17 for restricting access to the folder forming the file storage area 121 and the file 125 under the folder (hereinafter referred to as the first access permission information of the present invention). , Which is called “file system ACL”) 122 is set to be accessible only by a dedicated user having the user account 151.

  The file system ACL 122 is created in association with the file storage area 121 composed of folders created on the storage device 12 when the file access program 11 is installed, for example. An example of this ACL 122 is shown in FIG.

  In the example of FIG. 4, “type”: “permitted” (access permission), “authority”: “as the ACL 122 on the file system that is access permission information for restricting access to the folder that forms the file storage area 121. "Full control" (all rights such as file reference, writing, uploading, downloading, etc. are given), "target user (or target group)": "User X" (dedicated user) are set. In other words, only the dedicated user is given permission for access to the folder that forms the file storage area 121, and access permission is not set for other users.

  Apart from the file system ACL 122 associated with the file storage area 121, the real file 125 in the file storage area 121 has access permission information for restricting access to the real file 125 in addition to the file data 124 (the present invention). The second access permission information) is added. An example of the ACL 123 added to the actual file 125 is shown in FIG.

  In the example of FIG. 5, the ACL 123 of the actual file 125 includes “type” (“permitted” or “denied”) and “authority” (“permission”) for each of a plurality of users (“target user”: “User 1” to “User 5”). “Browse”, “Write”, “Download File”, “Full Control”, etc.) are set. For example, “User 1” has permission to reference the file 125, “User 2” has permission to write to the real file 125, “User 3” has denied access to the real file 125, and “User 4” has In the case of “User 5”, the permission for downloading the real file 125 is set to allow the reference to the real file 125.

  FIG. 6 shows the detailed configuration of the real file 125. In the example of FIG. 6, the actual file 125 includes file data 124 and the ACL 123 described above. For ensuring security, the file data 124 is encrypted with, for example, a random key by an encryption function 115 described later, and the key is stored in the ACL 123, for example. On the other hand, the ACL 123 encrypts with an encryption key that can be recognized only by the server 10 by the encryption function 115 as a file in XML (eXtensible Markup Language) format, which is a highly extensible markup description language that can specify a unique tag. It has become.

  In the example of FIG. 6, as XML data tags constituting the ACL 123 of the actual file 125, <file> (the highest element indicating that the data is file data), <enc> (key information used for file encryption) , <Security> (represents information about the access rights of the item (file / folder)), <owner> (owner of the item (file / folder)), <Acl> (represents ACL), and <Ace> (ACL For example).

  In the example in the figure, the attribute / child element of <file> includes data (file creation date and time), <enc> (key information used to encrypt the file), <security> (information on folder permission) ) Etc., <enc> attribute / child element has key (Key value used for file encryption), etc. <security> attribute / child element has <owner>, <Acl>, etc. However, the attribute / child element of <owner> has name (owner's user name), etc., and the attribute / child element of <Acl> has inherit (whether to inherit ACL from the higher-level item (folder)) The attribute / child element of <Ace> has a type (ACL type (permitted or denied)), access (a bit mask value representing the type of target authority (for example, a 32-bit bit mask) )), Role (target user or group) and the like can be set. Here, type, access, and role of <Ace> correspond to “type”, “authority”, and “target user” of ACL 123 shown in FIG.

  As shown in FIG. 1, the file access program 11 is functionally provided with a user authentication function 111, a file arrangement virtualization function 112, a log output function 113, a user impersonation function 114, and an encryption function 115. Each of these functions 111 to 115 includes an impersonation unit, an access permission determination unit, and a log output unit of the present invention, and is realized by the CPU 101 executing the instructions of the file access program 11 on the server 10.

  When the user authentication function 111 receives a request for file operation (reference, write, download, upload, delete, etc.) from the client program 21, user information (user name, password, etc.) of the user who issued the request, A user authentication process is executed by comparing the user account 141 (user name, password, etc.) in the account database (A) 14. In addition, based on the ACL 123 of the real file 125 to be requested, a user authority confirmation process is executed.

  As shown in FIG. 7, the file placement virtualization function 112 displays, by the client program 21, real files 125 that are placed in the same hierarchy without taking a hierarchical structure in the file storage area 121 of the storage device 12. The display screen on the client 20 has a function of virtually appearing as a file that can be arranged in different hierarchies under a folder.

  At this time, the folder that can be seen from the client program 21 is virtual, and is actually stored as an XML format file in the file storage area 121 as shown in FIG. An XML file corresponding to this virtual folder (hereinafter referred to as “virtual folder definition file”) is encrypted and stored by the encryption function 115. In this embodiment, the virtual folder definition file 161 is stored in the file storage area 121. The route information of the virtual folder definition file 161 is stored in the registry database 16.

  In the virtual folder definition file 161, a list of files and folders (sub virtual folders) included under the virtual folder and an ACL of the virtual folder are described. In the list, the “file name” of the virtual file or the “folder name” of the folder that can be seen from the client program 21 and the “real file name” of the real file 125 in the corresponding file storage area 121 are associated with each other. Are described in pairs.

  The file seen from the client program 21 is virtual, and is actually stored in the file storage area 121 with the ACL 123 added to the file data 124 of the actual file 125. The file data 124 and the ACL 123 of the actual file 125 are encrypted by the encryption function 115 and stored.

  FIG. 9 shows a detailed configuration of the virtual folder definition file 161.

  In the example of FIG. 9, as the virtual folder definition file 161, <folder> (the highest element indicating that it is a folder definition file), <items> (representing a list of items (files / folders) in the folder), < item> (represents a list of sub-items (files / folders) in a folder), <security> (represents information about file / folder access rights), <Acl> (represents ACL), <Ace> (ACL Represents an entry).

  In the example in the figure, <items> and <security> (information on folder access permissions) are included in the <folder> attribute / child element, and <item> is included in the <items> attribute / child element. However, the attribute / child element of <item> includes type (item type), name (item display name) id (actual item name), data (item creation date and time), size (file size) However, the <security> attribute / child element has <owner> and <Acl>, etc. The <owner> attribute / child element has name (owner's user name) etc., and the <Acl> attribute / Child element has inherit (indicates whether ACL is inherited from higher level item (folder)), <Ace> attribute / Child element has type (ACL type (allowed or denied)), access (target Bit mask value indicating the type of authority to be (eg, pre-defined as a 32-bit bit mask), role (target user or Loop) and the like have made can be set, respectively. Here, type, access, and role of <Ace> correspond to “type”, “authority”, and “target user” of ACL 123 shown in FIG.

  In the example of FIG. 8 described above, the access rights of the subitems and folders in the folder are included in the XML file that forms the virtual folder definition file 161 corresponding to the virtual folder (Folder A) that can be seen from the client program 21 on the client 20 side. Information is written. In this case, Folder B and document 1.doc are included as sub-items in the folder, Folder B is the actual file with the actual file name “18ACB256-486 -...”, and document 1.doc is the actual file name “24987A45”. -FF14 -... "is set to correspond to each real file. In addition, three groups (full path name: “\ Domain \ group1,” “\ Domain \ group2,” and “\ Domain \ group3”) are included as “target users” for folder access rights. "Type" (permitted or denied) and "Authority" (reading, full control, etc.) are set.

  The log output function 113 includes information on when / who / from / what / what operation was performed in response to a file access request from the client program 21, the client 20 side and the server 10 that are the target of the operation. The information such as the file name and folder name on the side is output to the log database 13 as a log 131 (see FIG. 13 described later).

  The user impersonation function 114 has a function of changing the user account 141 of the executing user in the process (thread) being executed and impersonating the user account 151 of the dedicated user when accessing the file in the file storage area 121.

  Next, the overall operation of this embodiment will be described.

  Here, the operation when the file 125 on the server 10 is acquired from the client 20 will be described with reference to FIGS.

  FIG. 10 is a flowchart showing the respective operation sequences on the server 10 side and the client 20 side, and FIG. 11 is a schematic diagram schematically showing the flow of the operation. Of the processes shown in the flowchart of FIG. 10, the process on the server 10 side is performed by the CPU 201 executing the file access program 11 under the operating environment of the OS 17. The processing on the client 20 side is performed by the CPU 201 executing the client program 21 under the operating environment of the OS 22.

  Here, it is assumed that the actual file 125 is stored in the file storage area 121, and the ACL 123 is added to the file data 124 and encrypted by the encryption function 115 at the time of the storage. At this time, the file placement virtualization function 112 stores the file name of the actual file 125 so that it is different from the file name on the client program 21 side. The virtual folder definition file 161 created by the file placement virtualization function 112 can associate the path name of the real file 125 on the client program 21 side with the real file name of the real file in the file storage area 121. It is created as an XML file, encrypted by the encryption function 115, and stored in the file storage area 121.

  In such a state, first, on the client 20 side, when the file access to the file 125 on the server 10 is performed, the client program 21 is activated (step A1), and its screen (refer to the client program side display screen in FIG. 7). ) Is displayed (step A2). The user selects a file to be acquired while viewing this screen, and a file acquisition request for the selected file is transferred to the server 10 side together with user information (user name, password, etc.) necessary for user authentication (step A1). ).

  In response to this, on the server 10 side, when a file acquisition request is received from the client program 21 on the client 20 side, the file access program 11 is started (step B1), and the user authentication function 111 uses the user account database ( A) User authentication is performed with reference to the user account 141 of 14 (step B2). Thereby, when authenticated (step B3: YES), the process proceeds to the next process, and when authentication cannot be performed (step B3: NO), the process is stopped at this point.

  Next, the log output function 113 outputs the request content from the client 20 side to the log database 13 (step B4). At this time, if the log cannot be output, the processing is stopped.

  Next, the user impersonation function 114 refers to the user account 151 of the dedicated user in the account database (B) 15 and impersonates the dedicated user 151 based on the file system ACL 122 (step B5). Then, the file placement virtualization function 112 analyzes the path name of the requested virtual file with reference to the virtual folder definition file 161 in the file storage area 121, and the actual file 125 corresponding to the path name. Is obtained (step B6). An example of this processing is shown in FIG.

  In the example of FIG. 12, on the display screen on the client program 21 side, a subfolder (Folder A) formed in a lower hierarchy in a subfolder (Folder A) formed in a lower hierarchy of the root folder (\) that is the highest folder. B) Access to document 2.doc (path name: \ FolderA \ FolderB \ document 2.doc) stored in B).

  In this case, the file placement virtualization function 112 first references the root information in the registry database 16 and the virtual folder definition file 161 in the file storage area 121, first, the root information (Root = ...) in the registry database 16. ), The folder name “7481AD43-02DF...” Of the virtual folder definition file 161 (XML file) corresponding to the root folder (¥) which is the highest folder of the path name is obtained. Next, the folder name “936DA01F-9ABD...” Of the virtual folder definition file 161 (XML file) corresponding to “FolderA” in the path name is obtained from the virtual folder definition file 161 having the corresponding folder name in the file storage area 121. obtain. Next, the folder name “18ACB256-4876...” Of the virtual folder definition file 161 (XML file) corresponding to “FolderB” in the path name is obtained from the virtual folder definition file 161 having the corresponding folder name in the file storage area 121. obtain. Next, the real file name “24987A45-FF14...” Of the real file 125 corresponding to “document 2.doc” in the path name is obtained from the virtual folder definition file 161 with the corresponding folder name in the file storage area 121.

  Next, the ACL 123 and the file data 124 of the real file 125 are read from the file storage area 121 (step B7), and the ACL 123 in the real file 125 is decrypted by the encryption function 115, and the decrypted ACL 123 has been authenticated. The user information (user name, etc.) is compared (step B8), and it is determined whether or not the user has authority to acquire a file (step B9).

  Next, when file acquisition is possible (YES) in the process of step B9, the file data 124 in the actual file 125 is decrypted and transferred to the client program 21 (step B10). Thereby, on the client 20 side, the file data 124 is acquired from the server side 10 (step A4), and various file operations are performed on the file data 124 (step A5). On the other hand, if the file acquisition is added (NO) in step B9, the process in step B10 is not performed.

  On the other hand, on the server 10 side, the log output function 113 outputs the file acquisition availability information by the process of step B9 to the log database 13 (step B11). Here, the contents output to the log database 13 can output information received from the client 10 side in addition to the “user name”, “machine name”, etc. of the client 20. 131 can be output. An output example of the log 131 is shown in FIG.

  In the example of FIG. 13, as the information of the log 131, “date and time” (date and time when the file storage area 121 was operated), “user name” (user name who performed the operation on the file storage area 121), “ Type of operation "(type of operation executed on the file storage area 121: folder creation, folder deletion, folder renaming, file uploading, file downloading, file deletion, file renaming, access permission Information (ACL) setting, ownership setting, etc., “server side operation target 1” (full path name of the operation target folder / file in the file storage area 121), “server side operation target 2” (in the file storage area 121) Operation target file name: Displayed as the new name only when the file is renamed), "Client side operation target" (operation File name on the client 10 side), “operation result” (operation result on the file storage area 121: reception, permission, non-permission, abnormality, etc.), “machine name” (client 10 side where the operation was performed) Machine name), “IP address” (IP address of the machine on the client 10 side where the operation is performed), and the like are output.

  Therefore, according to the present embodiment, since a dedicated program for obtaining a file is provided and the file cannot be accessed from other programs, it is ensured that an authorized user obtains the file with a certain degree of accuracy. It is possible to leave a high log, and it is possible to effectively suppress information leakage by an authorized user.

  As another embodiment of the present invention, there are the following methods for limiting the programs that can access a file. This can also be used in combination with the previous embodiment. In this example, an event to the target file is monitored by the file system filter driver, and access from a process other than the file access program 11 is denied. The user authentication function 111 of the file access program 11 may be configured to acquire only authenticated user information by using an external function, for example, an operating system function such as integrated Windows (registered trademark) authentication. .

  In this embodiment, file operations such as copying executed after file acquisition on the client side is not particularly mentioned, but as an application example, for example, Japanese Patent Application No. 2004 filed earlier by the present applicant. By combining the document file copy movement monitoring system disclosed in H.275383, in addition to the log output from the file access program 11, where it was finally copied or moved by file operation on the client side after file acquisition, etc. Can be recorded in the log. According to this, the said effect can be improved further.

  In the present embodiment, the ACL 123 constituting the second access permission information is illustrated as being added to the file data 124 of the actual file 125, but the present invention is not necessarily limited to this. Instead, the second access permission information only needs to have a configuration that can be stored in association with the file data 124. For example, the file data 124 of the actual file 125 and the ACL 123 thereof are associated with each other in the file storage area 121. It may be stored as a file.

  INDUSTRIAL APPLICABILITY According to the present invention, it can be applied to uses such as management of files that require higher security and countermeasures against information leakage of companies.

1 is a diagram showing an overall configuration of a server client type computer system using a shared file access control method according to an embodiment of the present invention; FIG. It is a figure which shows the structural example of an account database (A). It is a figure which shows the structural example of an account database (B). It is a figure which shows the structural example of file system ACL. It is a figure which shows the structural example of ACL added to a file or a folder. It is a figure which shows the detailed structural example of a file. It is a figure explaining the relationship between the file arrangement | positioning of the actual data in a file storage area, and the file arrangement | positioning on a client side display screen. It is a figure explaining the relationship between the virtual folder definition file which comprises the real data in a file storage area, and the file on a client program side display screen. It is a figure which shows the detailed structural example of a virtual folder definition file. It is a schematic flowchart explaining operation | movement in the case of acquiring a file between the client side and the server side. It is the schematic explaining the operation | movement shown in FIG. 10 typically. It is a figure explaining the operation example of a file arrangement virtualization function. It is a figure which shows the example of a log output.

Explanation of symbols

10 Server 11 File Access Program 12 Storage Device 13 Log Database 14 Account Database (A)
15 Account database (B)
16 Registry Database 17 Operating System 20 Client 21 Client Program 22 Operating System 23 Application Program 101 CPU (Server)
102 memory (server)
111 User Authentication Function 112 File Placement Virtualization Function 113 Log Output Function 114 User Impersonation Function 115 Encryption Function 121 File Storage Area 122 File System ACL
123 ACL
124 File data (file)
125 files (actual files)
161 Virtual folder definition file 201 CPU (client)
202 memory (client)
203 IO controller 204 IO device

Claims (21)

A file access control method that can be shared by multiple users,
A first storage unit stores first access permission information for limiting access authority in a file storage area for storing the file to only a dedicated user for which a dedicated user account has been set in advance. Steps,
When the second storage unit stores the file in the file storage area , the second storage unit associates second access permission information for restricting access authority of the file for each of the plurality of users with the file. Saving step;
When the file is accessed , a camouflage means camouflages the user authenticated user to be the dedicated user and accesses the file storage area based on the first access permission information. A step to read,
An access permission / non-permission determining unit determining whether or not the user authenticated by the user authenticated based on the second access permission information associated with the read file;
A method for controlling access to a shared file, comprising: The shared file access control method according to claim 1, further comprising: a log output unit that outputs a log relating to access to the file storage area. The step of storing the second access permission information is a step in which the second storage unit individually encrypts and stores the second access permission information and the file data.
3. The shared file according to claim 1, wherein the step of reading the file is a step in which the impersonation unit decrypts and reads the second access permission information and the data of the file individually. Access control method. In the step of storing the second access permission information, the second storage means uses the file name of the file as a file name used by the user when the file is stored in the file storage area. 4. The shared file access control method according to claim 1, further comprising a step of storing differently. 5. In the step of storing the second access permission information, the second storage means sets the arrangement structure of the file stored in the file storage area as a virtual hierarchical structure on the display screen on the user side. 5. The shared file access control method according to claim 1, further comprising a step of creating and storing a definition file for virtualizing so as to be visible. A file access control system that can be shared by multiple users,
First storage means for storing first access permission information for limiting access authority in a file storage area for storing the file to only a dedicated user for which a user account for the dedicated user is set in advance;
Second storage means for storing, in association with the file, second access permission information for limiting access authority of the file for each of the plurality of users when the file is stored in the file storage area When,
Impersonation means for impersonating a user authenticated user to be the dedicated user when accessing the file, accessing the file storage area based on the first access permission information, and reading the file ,
Access permission determination means for determining whether the user authenticated by the user authenticated based on the second access permission information associated with the read file;
A shared file access control system comprising:   7. The shared file access control system according to claim 6, further comprising log output means for outputting a log relating to access to the file storage area. The second storage means is configured to individually encrypt and store the second access permission information and the file data,
8. The shared file access control system according to claim 6 or 7, wherein the camouflage means individually decrypts and reads the second access permission information and the file data.   The second storage means includes means for storing the file name different from the file name used by the user when the file is stored in the file storage area. The shared file access control system according to any one of claims 6 to 8.   The second storage means creates a definition file for virtualizing the arrangement structure of the files stored in the file storage area so as to be visible as a virtual hierarchical structure on the display screen on the user side. 10. The shared file access control system according to claim 6, further comprising means for storing the file. The access control system includes a server device that has a storage device that stores the shared file and operates under program control, and a client device that is communicably connected to the server device and operates under program control.
The first and second storage means, the impersonation means, the access permission determination means, and the log output means are configured to function by program control by the server device. The shared file access control system according to claim 10. A server device that is communicably connected to a client device and that stores a file that can be shared by a plurality of users of the client device in an accessible manner,
First storage means for storing first access permission information for limiting access authority in a file storage area for storing the file to only a dedicated user for which a user account for the dedicated user is set in advance;
Second storage means for storing, in association with the file, second access permission information for limiting access authority of the file for each of the plurality of users when the file is stored in the file storage area When,
Impersonation means for impersonating a user authenticated user to be the dedicated user when accessing the file, accessing the file storage area based on the first access permission information, and reading the file ,
Access permission determination means for determining whether the user authenticated by the user authenticated based on the second access permission information associated with the read file;
The server apparatus characterized by having.   The server apparatus according to claim 12, further comprising log output means for outputting a log relating to access to the file storage area. The second storage means is configured to individually encrypt and store the second access permission information and the file data,
The server device according to claim 12 or 13, wherein the camouflaging unit is configured to individually decode and read the second access permission information and the file data.   The second storage means includes means for storing the file name different from the file name used by the user when the file is stored in the file storage area. The server device according to any one of claims 12 to 14.   The second storage means creates a definition file for virtualizing the arrangement structure of the files stored in the file storage area so as to be visible as a virtual hierarchical structure on the display screen on the user side. The server apparatus according to claim 12, further comprising a storage unit. A file access control program that can be shared by multiple users,
Storing first access permission information for limiting access authority in a file storage area for storing the file to only a dedicated user for which a user account for the dedicated user is set in advance;
Storing the second access permission information for restricting the access authority of the file for each of the plurality of users in association with the file when the file is stored in the file storage area;
When the file is accessed, the user authenticated user is impersonated to become the dedicated user, accessing the file storage area based on the first access permission information, and reading the file;
Determining whether to allow access to the file by the user authenticated by the user based on the second access permission information associated with the read file;
A shared file access control program for causing a computer to execute   18. The shared file access control program according to claim 17, further causing the computer to execute a step of outputting a log relating to access to the file storage area. The step of storing the second access permission information is a step of individually encrypting and storing the second access permission information and the file data,
19. The shared file access control program according to claim 17, wherein the step of reading the file is a step of individually decoding and reading the second access permission information and the data of the file.   The step of storing the second access permission information includes the step of storing the file name different from the file name used by the user when the file is stored in the file storage area. 20. The shared file access control program according to claim 17, further comprising:   The step of storing the second access permission information is for virtualizing the arrangement structure of the file stored in the file storage area so as to be visually recognized as a virtual hierarchical structure on the display screen on the user side. 21. The shared file access control program according to claim 17, further comprising a step of creating and storing a definition file.

Images