JP4468755B2 - Log management apparatus, log management method, and log management program - Google Patents

Description

  The present invention relates to a log management device, a log management method, and a log management program.

  In a system that performs management, for example, storage, reference, change, and deletion, etc. for information with high confidentiality and access right (operation authority), for example, a document management system, a user who does not have operation authority for reference or change ( In order to monitor unauthorized access to information from a user) or to grasp the situation when a failure occurs, log information including the operation contents by the user is recorded.

  The log information includes all the operation contents for the stored information held by the system, and also includes the operation contents for the highly confidential stored information that is permitted to be referenced only by a specific user. Accumulated information with high confidentiality often needs to be concealed, and reference to log information, which is an operation history such as reference or change, must be restricted in the same way as with highly confidential stored information.

  Therefore, in Patent Document 1, a user level (access right) is provided to the user, the user level is recorded together with the log information, and the log information is referred only to the user having the user level included in the log information. A method to allow is proposed.

JP 2000-29751 A

  However, in Patent Document 1, since the access right (user level) is recorded together with the log information when the log information is recorded, it is difficult to maintain consistency between the access right for the log information and the access right for the stored information. For example, even if the access right for the stored information is changed after the log information is recorded together with the access right, the access right recorded together with the log information is not changed. That is, even if the access right to the stored information with high confidentiality is raised, the access right to the log information including the operation content for the stored information is not changed, so that the log information cannot be protected in the same manner as the stored information. Further, in order to protect the log information as well as the stored information, means for changing the access right recorded together with the log information is required.

  An object of the present invention is to efficiently protect log information including operation contents for the stored information, as well as stored information with high confidentiality.

  According to the first aspect of the present invention, an identifier of a user who operates the stored information, an identifier of the stored information, and an operation authority that is an operation permission for the stored information are stored in association with each other as the operation authority information. In a log management device that associates an operation content for information with an identifier of the accumulated information and stores it as log information, means for acquiring the identifier of the user from the user and the identifier of the accumulated information from the log information; Means for acquiring the operation authority from the operation authority information based on the acquired identifier of the user and the identifier of the accumulated information, and determining whether the acquired operation authority includes an operation authority for a predetermined operation Means for permitting the predetermined operation on the log information when it is determined that the operation authority includes an operation authority for the predetermined operation; If the created authorization is determined not to include the operation authority of a predetermined operation, characterized in that it comprises a means for rejecting the predetermined operation to the log information.

  According to a second aspect of the present invention, in the log management device according to the first aspect, the predetermined operation is a reference operation.

  According to a third aspect of the present invention, in the log management device according to the first or second aspect, the means for deleting the stored information at a predetermined timing, and when the stored information is deleted, an identifier of the deleted stored information is set. Means for determining whether or not the log information is included, and holds the operation authority information including the deleted storage information identifier when it is determined that the log information including the deleted storage information identifier exists. And means for deleting the operation authority information including the deleted stored information identifier when it is determined that the log information including the deleted stored information identifier does not exist. .

  According to a fourth aspect of the present invention, in the log management device according to the first, second, or third aspect, the means for deleting the log information at a predetermined timing, and when the log information is deleted, the deleted log information Means for determining whether or not the stored information corresponding to the identifier of the stored information included, and the stored information corresponding to the identifier of the stored information included in the deleted log information are determined to exist Determining that there is no storage information corresponding to the identifier of the stored information included in the deleted log information, and means for holding the operation authority information including the identifier of the stored information included in the deleted log information And a means for deleting the operation authority information including the identifier of the stored information included in the deleted log information.

  According to a fifth aspect of the present invention, an identifier of a user who operates the stored information, an identifier of the stored information, and an operation authority that is an operation permission for the stored information are stored in association with each other as the operation authority information. In a log management method for associating an operation content for information with an identifier of the accumulated information and storing it as log information, obtaining the identifier of the user from the user and the identifier of the accumulated information from the log information; Acquiring the operation authority from the operation authority information based on the acquired identifier of the user and the identifier of the stored information, and determining whether the acquired operation authority includes a predetermined operation authority; And a step of permitting the predetermined operation on the log information when it is determined that the operation authority includes the predetermined operation authority. If, when the operation authority is determined not to include a predetermined operation authority, characterized by comprising the steps of: rejecting the predetermined operation to the log information.

  According to a sixth aspect of the present invention, in the log management method according to the fifth aspect, the predetermined operation is a reference operation.

  The invention according to claim 7 is the log management method according to claim 5 or 6, wherein the stored information is deleted at a predetermined timing, and when the stored information is deleted, an identifier of the deleted stored information is set. A step of determining whether or not the log information is included, and holding the operation authority information including the deleted storage information identifier when it is determined that the log information including the deleted storage information identifier is present And deleting the operation authority information including the deleted stored information identifier when it is determined that there is no log information including the deleted stored information identifier. .

  The invention according to claim 8 is the log management method according to claim 5, 6 or 7, wherein the log information is deleted at a predetermined timing, and when the log information is deleted, the deleted log information A step of determining whether or not the storage information corresponding to the identifier of the storage information included exists, and a case of determining that the storage information corresponding to the identifier of the storage information included in the deleted log information exists Holding the operation authority information including the identifier of the stored information included in the deleted log information, and determining that the stored information corresponding to the identifier of the stored information included in the deleted log information does not exist And deleting the operation authority information including the identifier of the stored information included in the deleted log information. To.

  According to a ninth aspect of the present invention, the log management program stores the identifier of the user who operates the stored information, the identifier of the stored information, and the operation authority that is the operation permission for the stored information as the operation authority information. The log information is interpreted by a computer provided in a log management device that stores the operation content for the stored information and the stored information identifier as log information in association with each other, and the user's identifier and the log information are transmitted from the user to the computer. A function for acquiring the identifier of the stored information from the function, a function of acquiring the operation authority from the operation authority information based on the acquired identifier of the user and the identifier of the stored information, and the acquired operation authority A function for determining whether or not a predetermined operation authority is included, and when determining that the operation authority includes a predetermined operation authority, A function for permitting the predetermined operation on the log information, and a function for rejecting the predetermined operation on the log information when it is determined that the operation authority does not include the predetermined operation authority. Features.

  According to a tenth aspect of the present invention, in the log management program according to the ninth aspect, the predetermined operation is a reference operation.

  The invention according to claim 11 is the log management program according to claim 9 or 10, wherein the computer has a function of deleting the stored information at a predetermined timing, and when the stored information is deleted, the deleted storage A function for determining whether or not the log information including an identifier of information exists, and the operation including the identifier of the deleted stored information when it is determined that the log information including the deleted stored information identifier exists. A function of holding authority information and a function of deleting the operation authority information including the deleted stored information identifier when it is determined that the log information including the deleted stored information identifier does not exist It is characterized by that.

  The invention according to claim 12 is the log management program according to claim 9, 10 or 11, and a function for deleting the log information at a predetermined timing, and when the log information is deleted, the deleted log information A function for determining whether or not the stored information corresponding to the identifier of the stored information included, and the stored information corresponding to the identifier of the stored information included in the deleted log information are determined to exist A function of holding the operation authority information including the identifier of the stored information included in the deleted log information, and determining that the stored information corresponding to the identifier of the stored information included in the deleted log information does not exist A function of deleting the operation authority information including the identifier of the accumulated information included in the deleted log information. To.

  According to the first, fifth, or ninth aspect of the invention, a user who does not have the authority to perform a predetermined operation on the stored information is not permitted to perform the predetermined operation on the log information including the operation content on the stored information. As with highly stored information, it is possible to efficiently protect log information including operation details for the stored information.

  According to the invention described in claim 2, 6 or 10, a user who does not have the authority to perform the reference operation on the stored information is not permitted to perform the reference operation on the log information including the operation content on the stored information. Log information can be protected.

  According to the third, seventh, or eleventh aspect of the invention, since the operation authority information including the identifier of the stored information is retained even if the stored information is deleted, the log information including the operation content for the deleted stored information is also included. It can be protected as efficiently as stored information with high confidentiality.

  According to the fourth, eighth, or twelfth aspect of the present invention, unnecessary operation authority information is deleted, so that the storage area occupied by the operation authority information can be used effectively.

  An embodiment of the present invention will be described with reference to the drawings.

  FIG. 1 is a block diagram showing a schematic configuration of a log information management system according to the present embodiment.

  As shown in FIG. 1, in the log information management system 1, a server device 2 that stores and manages data as a log management device and a plurality of client devices 3 used by each user (client) transmit data and the like. They are connected via a network 4 that is a communication network.

  FIG. 2 is a block diagram showing the hardware configuration of the server device 2 and the client device 3.

  As shown in FIG. 2, the server device 2 and the client device 3 are computers such as PCs, and include a CPU 11 that performs various operations and controls each unit intensively, and a memory 12 that includes various ROMs, RAMs, and the like. It is configured by connecting with the bus 13.

  The bus 13 reads data from a storage device 14 such as a hard disk, an input device 15 such as a keyboard and a mouse, a display device 16 such as a CRT and an LCD, and a storage medium 17 such as an optical disk via a predetermined interface. A storage medium reading device 18 is connected, and a communication control device 19 for communicating with the network 4 is further connected.

  As the storage medium 17, various media such as an optical disk such as a CD and a DVD, a magneto-optical disk, and a flexible disk are used. As the storage medium reader 18, an optical disk device, a magneto-optical disk device, a flexible disk device, or the like is used according to the type of the storage medium 17.

  The storage device 14 stores various programs including a log management program. These programs are installed in the storage device 14 by being read from the storage medium 17 by the storage medium reader 18 or downloaded from the Internet or the like via the network 4. By this installation, the server device 2 and the client device 3 become operable. Note that the program may be a part of the function of predetermined application software, or may operate on a predetermined OS.

  3 is a functional block diagram schematically showing functions of the log information management system 1, FIG. 4 is an explanatory diagram showing an example of an access right table, FIG. 5 is an explanatory diagram showing an example of the log information table, and FIG. 6 is an operation content. It is explanatory drawing which shows an example of a table.

  The server device 2 includes information storage means 21, user information management means 22, access right management means 23, log information management means 24, and log information reference means 25. These means are realized by log management processing executed by the CPU 11 based on a program such as a log management program recorded in the storage device 14. Thereby, various means, steps and functions are executed.

  The information storage unit 21 manages stored information including highly confidential information, for example, various document information. For example, a known relational database system (relational database system) or the like is used as a method for managing the stored information by the information storage unit 21.

  The user information management means 22 manages user identifiers (user identifiers) assigned for each user or for each set of users.

  The access right management means 23 uses, for example, a relational database system, as shown in FIG. 4, with a set of a user identifier and an identifier of stored information as a main key, and a numerical value (operation content The access right is managed by a relation (access right table 31) having an attribute of (identifier).

  As shown in FIG. 4, the access right table 31 includes a plurality of access right information that is operation authority information. These pieces of access right information are each composed of an operation content having a user identifier, an identifier of stored information, and an authority (operation authority). Such an access right table 31 is stored in the storage device 14.

  The log information management unit 24 manages log information using a relation (log information table 32) with log information as one record, as shown in FIG. 5, using a relational database system, for example.

  As shown in FIG. 5, the log information table 32 includes a plurality of log information. Each of the log information includes an identifier of log information, an identifier of accumulated information, an identifier of operation contents, operation contents, and log details. The log details are composed of the date and time and the operator (user identifier). As shown in FIG. 6, the operation content table 33 includes an operation content identifier and operation content (contents of a predetermined operation). Such log information table 32 and operation content table 33 are stored in the storage device 14.

  The identifier of the operation content is a numerical value indicated by a power of 2, for example. Therefore, the numerical value of the operation content with authority in FIG. 4 is a numerical value obtained by adding together identifiers (operation content identifiers) corresponding to each operation content for which the user has operation authority. That is, when the numerical value of the authorized operation content is expressed in binary, the position of the digit that is 1 represents the operation content for which the user has operation authority (user operation is permitted), The more digits that are 1, the more the user has the operation authority for the operation content.

  Further, the log information management unit 24 cannot directly refer to the log information recorded in the log information table 32 but can refer to it through the log information reference unit 25. At this time, the log information table 32 may be set so that it cannot be directly referred to by the access right management mechanism of the relational database system. Alternatively, the log information table 32 may be in a format in which log information encrypted by a decryptable encryption method is output as a text file. In this case, the log information reference unit 25 decrypts the text file (log information).

  The log information reference unit 25 manages the reference of log information in response to a reference operation request from the client device 3, for example, a reference operation request for log information.

  In such a configuration, the user (client) uses the input device 15 of the client device 3 to input the user identifier (user identifier) when starting the use of the log information management system 1, and thereafter Then, an operation request to the server device 2 (for example, an operation request for a predetermined operation such as reference, creation, change, and deletion) is designated. The user identifier and the operation request are notified to the server device 2 via the network 4.

  Here, a case where an operation request for stored information is notified to the server apparatus 2 by the user will be described with reference to FIG. FIG. 7 is a flowchart showing the processing procedure of the information storage means 21.

  As shown in FIG. 7, the information storage means 21 acquires the identifier of the user (client) notified from the client device 3 (step S1), and uses the user identifier to access the user from the access right table 31. Access right information (operation authority for each stored information) of each stored information corresponding to the identifier is acquired (step S2). Next, the following processing is repeated for each operation request from the client device 3 (step S3).

  It is determined whether or not the user has an operation authority for the stored information to be operated (step S4). When it is determined that the user has an operation authority for the operation target storage information (Y in step S4), an operation request for the operation target storage information is permitted, and an operation corresponding to the operation request is performed. Is executed, and the log information management means 24 is notified of information necessary for generating log information including the operation content (step S5). Here, as shown in FIG. 4, for example, when a user whose user identifier is Milei makes a list display (reference) operation request for stored information whose stored information identifier is 040014. The operation request is permitted as an operation request for which the user has operation authority.

  On the other hand, when it is determined that the user does not have the operation authority for the operation target storage information (N in step S4), the operation request for the operation target storage information is rejected, and the client device 3 is operated. The fact that the request has been rejected is notified (step S7). Here, as shown in FIG. 4, for example, when a user whose user identifier is Milei makes a deletion operation request for the stored information whose stored information identifier is 040014, the operation The request is rejected as an operation request for which the user does not have operation authority.

  Such processing is repeated until a disconnection request is transmitted from the client device 3 (N in step S6). In this way, information necessary for generating log information is notified to the log information management means 24.

  Next, a case where an operation request for log information is notified to the server apparatus 2 by the user will be described with reference to FIG. FIG. 8 is a flowchart showing the processing procedure of the log information reference means 25.

  As shown in FIG. 8, the log information reference unit 25 acquires the log information that is the operation target from the log information table 32 in response to an operation request for the log information from the client device 3, for example, a reference operation request (step S11), the user identifier is acquired from the client device 3 (step S12). Using the user identifier obtained from the client device 3 and the identifier of the stored information included in the log information, the user's operation authority (the operation details with authority) for the stored information is acquired from the access right table 31 ( Step S13). Next, it is determined whether or not the acquired operation authority of the user includes an operation authority for a predetermined operation, here, an operation authority for a reference operation (step S14).

  When it is determined that the user operation authority includes the operation authority for the reference operation (Y in step S14), the operation request for the reference operation for the log information is permitted, and the contents of the log information are notified to the client device 3. (Step S15). On the other hand, if it is determined that the user operation authority does not include the operation authority for the reference operation (N in step S14), the reference operation request for the log information is rejected, and the client apparatus 3 receives the reference operation request. The rejection is notified (step S16).

  As described above, according to the present embodiment, a user who does not have the authority to perform a predetermined operation on the stored information, for example, a reference operation, can also perform a predetermined operation on the log information including the operation content on the stored information, for example, a reference operation. Since it is not permitted, log information including the operation content for the stored information can be efficiently protected as with the highly confidential stored information. In particular, since the operation authority for the log information is determined by using the operation authority for the stored information, even if the operation authority for the stored information is changed, the operation authority for the log information is also changed. Log information can be protected efficiently.

  In this embodiment, as shown in FIG. 5, the log information is composed of an identifier of log information, an identifier of accumulated information, an identifier of operation details, operation details, and log details, but is not limited thereto. is not.

  Further, in the present embodiment, as shown in FIG. 4, the access right information is composed of the identifier of the user, the identifier of the stored information, and the authorized operation content, but is not limited to this. For example, a reference counter or the like may be added. A case will be described where the reference counter is added to the access right information, and the accumulated information and log information are deleted at a predetermined timing.

  The access right management means 23 adds a numerical attribute representing a reference counter to the access right information in the access right table 31. Note that the value of the reference counter when the access right information (record) is newly created in the access right table 31 is 1.

  The log information management unit 24 adds 1 to the numerical value of the reference counter of the access right table 31 corresponding to the identifier of the stored information included in the log information every time the log information indicating the operation content other than the deletion operation is recorded. The access right management unit 23 is instructed. The log information management unit 24 deletes a part or all of the log information table 32 when a predetermined condition is satisfied, that is, at a predetermined timing. For example, when the overall size of the log information table 32 exceeds a certain value, the old log information is deleted in order so that the size becomes half the size. At this time, the access right management unit 23 is instructed to subtract 1 from the value of the reference counter of the access right table 31 corresponding to the identifier of the stored information included in the deleted log information.

  The information storage unit 21 deletes the stored information when a predetermined condition is satisfied, that is, at a predetermined timing. For example, when the information amount of the accumulated information exceeds a certain value, the old accumulated information is deleted in order so that the information amount becomes half.

  At this time, the access right management unit 23 determines whether or not the value of the reference counter in the access right table 31 corresponding to the deleted stored information identifier is 0 (that is, log information including the deleted stored information identifier). Whether or not there exists). When it is determined that the value of the reference counter of the access right table 31 corresponding to the deleted stored information identifier is not 0 (that is, when log information including the deleted stored information identifier exists) When the access right information (record) is retained without being deleted, and it is determined that the value of the reference counter of the access right table 31 corresponding to the deleted stored information identifier is 0 (that is, the deleted stored information identifier is If it is determined that there is no log information to be included), the access right information (record) is deleted.

  As a result, even if the stored information is deleted, the access right information including the identifier of the stored information is retained. Therefore, the log information including the operation content for the deleted stored information is as efficient as the highly confidential stored information. Can be protected.

  Further, when the log information is deleted, the access right management unit 23 determines whether or not there is stored information corresponding to the identifier of the stored information included in the deleted log information. If it is determined that there is storage information corresponding to the identifier of the storage information included in the deleted log information, the access right information (record) including the storage information identifier included in the deleted log information is retained, If it is determined that there is no stored information corresponding to the identifier of the stored information included in the deleted log information, the access right information (record) including the identifier of the stored information included in the deleted log information is deleted. .

  As a result, unnecessary access right information is deleted, so that the storage area occupied by the access right information can be used effectively.

It is a block diagram which shows schematic structure of the log information management system of one Embodiment of this invention. It is a block diagram which shows the hardware constitutions of the server apparatus and client apparatus which comprise a log information management system. It is a functional block diagram which shows the function of a log information management system roughly. It is explanatory drawing which shows an example of an access right table. It is explanatory drawing which shows an example of a log information table. It is explanatory drawing which shows an example of the operation content table. It is a flowchart which shows the process sequence of an information storage means. It is a flowchart which shows the process sequence of a log information reference means.

Explanation of symbols

2 Log management device (server device)

Claims (12)

The identifier of the user who operates the stored information, the identifier of the stored information, and the operation authority that is the operation permission for the stored information are associated and stored as operation authority information, and the operation content for the stored information and the stored information In the log management device that stores the log information in association with the identifier of
Means for obtaining an identifier of the user from the user and an identifier of the stored information from the log information;
Means for acquiring the operation authority from the operation authority information based on the acquired identifier of the user and the identifier of the stored information;
Means for determining whether or not the acquired operation authority includes an operation authority for a predetermined operation;
Means for permitting the predetermined operation on the log information when it is determined that the operation authority includes the operation authority of the predetermined operation;
Means for rejecting the predetermined operation on the log information when it is determined that the operation authority does not include the operation authority of the predetermined operation;
A log management apparatus comprising: The predetermined operation is a reference operation;
The log management apparatus according to claim 1. Means for deleting the stored information at a predetermined timing;
Means for determining whether or not the log information including an identifier of the deleted stored information exists when the stored information is deleted;
Means for holding the operation authority information including the deleted identifier of the stored information when it is determined that the log information including the deleted identifier of the stored information exists;
Means for deleting the operation authority information including the deleted identifier of the stored information when it is determined that the log information including the deleted identifier of the stored information does not exist;
The log management apparatus according to claim 1, further comprising: Means for deleting the log information at a predetermined timing;
Means for determining whether or not the accumulated information corresponding to the identifier of the accumulated information included in the deleted log information exists when the log information is deleted;
Means for holding the operation authority information including the identifier of the stored information included in the deleted log information when it is determined that the stored information corresponding to the identifier of the stored information included in the deleted log information exists; ,
Means for deleting the operation authority information including the identifier of the stored information included in the deleted log information when it is determined that the stored information corresponding to the identifier of the stored information included in the deleted log information does not exist When,
The log management apparatus according to claim 1, 2 or 3. The identifier of the user who operates the stored information, the identifier of the stored information, and the operation authority that is the operation permission for the stored information are associated and stored as operation authority information, and the operation content for the stored information and the stored information In a log management method for storing log information in association with an identifier of
Obtaining the identifier of the user from the user and the identifier of the stored information from the log information;
Acquiring the operation authority from the operation authority information based on the acquired identifier of the user and the identifier of the stored information;
Determining whether the acquired operation authority includes a predetermined operation authority; and
If the operation authority is determined to include a predetermined operation authority, permitting the predetermined operation on the log information;
If it is determined that the operation authority does not include a predetermined operation authority, rejecting the predetermined operation on the log information;
A log management method comprising: The predetermined operation is a reference operation;
The log management method according to claim 5, wherein: Deleting the stored information at a predetermined timing;
When deleting the accumulated information, determining whether the log information including the identifier of the deleted accumulated information exists;
If it is determined that there is the log information including the deleted stored information identifier, the operation authority information including the deleted stored information identifier is retained;
If it is determined that the log information including the deleted identifier of the stored information does not exist, deleting the operation authority information including the deleted identifier of the stored information;
The log management method according to claim 5 or 6, further comprising: Deleting the log information at a predetermined timing;
When deleting the log information, determining whether or not the accumulated information corresponding to the identifier of the accumulated information included in the deleted log information exists;
Holding the operation authority information including the identifier of the stored information included in the deleted log information when it is determined that the stored information corresponding to the identifier of the stored information included in the deleted log information exists; ,
A step of deleting the operation authority information including the identifier of the stored information included in the deleted log information when it is determined that the stored information corresponding to the identifier of the stored information included in the deleted log information does not exist; When,
The log management method according to claim 5, 6 or 7. The identifier of the user who operates the stored information, the identifier of the stored information, and the operation authority that is the operation permission for the stored information are associated and stored as operation authority information, and the operation content for the stored information and the stored information Is interpreted by a computer included in a log management device that stores the log information in association with the identifier of
A function of obtaining the identifier of the user from the user and the identifier of the stored information from the log information;
A function of acquiring the operation authority from the operation authority information based on the acquired identifier of the user and the identifier of the stored information;
A function of determining whether or not the acquired operation authority includes a predetermined operation authority;
A function for permitting the predetermined operation on the log information when it is determined that the operation authority includes a predetermined operation authority;
A function of rejecting the predetermined operation on the log information when it is determined that the operation authority does not include the predetermined operation authority;
A log management program characterized by causing The predetermined operation is a reference operation;
The log management program according to claim 9. In the computer,
A function of deleting the stored information at a predetermined timing;
A function of determining whether or not the log information including an identifier of the deleted stored information exists when the stored information is deleted;
When it is determined that the log information including the deleted stored information identifier exists, a function of holding the operation authority information including the deleted stored information identifier;
A function of deleting the operation authority information including the deleted identifier of the stored information when it is determined that the log information including the deleted identifier of the stored information does not exist;
The log management program according to claim 9, wherein the log management program is executed. In the computer,
A function of deleting the log information at a predetermined timing;
A function of determining whether or not the accumulated information corresponding to the identifier of the accumulated information included in the deleted log information exists when the log information is deleted;
A function of holding the operation authority information including the identifier of the stored information included in the deleted log information when it is determined that the stored information corresponding to the identifier of the stored information included in the deleted log information exists; ,
A function of deleting the operation authority information including the identifier of the stored information included in the deleted log information when it is determined that the stored information corresponding to the identifier of the stored information included in the deleted log information does not exist When,
The log management program according to claim 9, 10 or 11, wherein:

Images