JP4780010B2 - Data management system, method and program - Google Patents

Description

  The present invention relates to a data management system, and more particularly to a data management system that manages access rights to data.

  In recent years, with the spread of computers and the improvement of network technology, it is common practice to manage electronic data (file data) with a server computer on a network so that it can be used by a plurality of users. On the other hand, among file data that can be shared by such a file sharing system, there is information that is not desired to be used by unspecified users, such as secret information and personal information. For this reason, in the file sharing system, an access right is set for each file data and user authentication is performed. For example, in Patent Document 1 below, a table storing user IDs and access contents accessible for each file data is held and managed.

JP 2003-36207 A

  In a system using NAS (Network Attached Storage), there may be multiple authentication servers that authenticate users. However, in the method of granting access rights as described above, access is performed by another authentication server. It is not possible to access the file to which rights have been granted. Then, for example, in situations such as moving users and groups between authentication servers or changing access rights that occur on a daily basis, such as changing user names and group names within the authentication server, the user himself has access rights. In spite of this, there is a problem that access is not possible.

  In order to cope with the above problem, the access right information included in the file data must be changed, but there is a problem that it takes a lot of time and labor to rewrite all the information. In addition, in order to solve the above problems, mapping between the authentication servers to associate the user before and after the change is necessary, but in many cases, this must take the form of mutual authentication of the authentication server and inclusion of authentication information. . However, such a process is not easy, and it still cannot be dealt with quickly, and there is a problem that it takes time and cost.

  For this reason, the present invention improves the inconveniences of the above-described conventional example, and in particular, can change the access right of file data through quick and simple processing, thereby improving the convenience of users and administrators. The objective is to provide a data management system that can be used.

Therefore, one aspect of the present invention is
A data management system for managing access rights of file data stored in a predetermined storage device,
Access right information setting means for storing and setting storage area designation information in the file data for designating a storage area in which accessible person information for identifying accessible persons of file data to be managed is stored;
Access right information managing means for storing access right information in a storage area designated by the storage area designation information;
It is characterized by having.

  According to the above invention, firstly, the file data stores the designation information of the storage area where the accessible person information is stored, and the designated storage area specifies the person who can access the file data. The accessible person information to be stored is stored. As a result, accessible person information can be acquired based on storage area designation information stored in the file data, so the access right of the file data can be determined, and the users of the file data are appropriately managed. can do. Even if the accessible person is changed later, there is no need to change the information in the file data that exists in large numbers, only the accessible person information in the storage area specified by the storage area specifying information. Therefore, the access right can be changed quickly and easily, and management can be facilitated.

  In addition, the storage area designation information included in the file data is storage position information for specifying a data storage position in a predetermined storage device. As a result, the specific storage location where the accessible person information is stored is specified, so that the accessible person information can be referred to quickly, and the file management can be speeded up.

  The storage location information is unique to each accessible person. Thereby, it is possible to set access rights for each accessible person, and convenience can be improved.

  The accessible person is a single accessible person or a group of a plurality of accessible persons. Thereby, the access right can be set for each accessible person or for each attribute such as a department to which the accessible person belongs.

  Further, in addition to the above-described configuration, it is characterized in that a position information generation unit that generates the storage position information from preset identification information unique to the accessible person is provided. As a result, storage location information is first generated from identification information unique to the accessing user. Then, by storing and setting the generated storage location information in the file data as described above and storing accessible person information in the storage location, access rights can be managed in the same manner as described above.

  Furthermore, the data management system can access the data storage location specified by the storage location information corresponding to the accessible person before the change when the accessible person to the file data is changed by specifying the accessible person after the change. It is characterized by comprising access right changing means for storing person information. Further, the access right changing means stores the storage position information of the data storage area in which the accessible person information after the change is stored in the data storage position where the changed accessible person information is stored before the change. It is characterized by that.

  As a result, even if the accessible person is changed later, it is not necessary to change the information in each file data, and only the access right information of the data storage location specified by the storage location information is changed. Thus, the access right can be referred to by referring to the storage location information in the file data. Therefore, the access right can be changed quickly and easily.

  Further, the storage location information stored in the file data is changed to storage location information indicating the data storage location where the accessible person information after the change by the access right changing means is stored, and the storage location information The access right organizing means for storing the accessible person information after the change by the access right changing means is provided at the data storage location designated by the above.

  Thereby, the storage position information in the file data is changed corresponding to the accessible person after the change, and in addition to this, the accessible person information of the accessible person is stored in the data storage position corresponding to the storage position information. Remembered. Therefore, the storage area in which accessible person information is stored can be organized, and the access right management can be made more efficient.

  The data management system of the present invention is stored in the storage area specified by the accessor information acquired in response to an access request from a predetermined accessor and the storage area specification information in the file data requested to be accessed. And access right determination means for determining the access right based on the accessible person information.

And the other form of this invention is:
A data management system for managing access rights of file data stored in a predetermined storage device,
When storage area designation information for designating a storage area in which access right information for specifying an accessible person of file data to be managed is stored is stored in the file data,
Based on accessor information acquired in response to an access request from a predetermined accessor and accessible person information stored in a storage area specified by storage area specification information in the requested file data Provided with an access right judging means for judging the access right
It is characterized by that.

Furthermore, another aspect of the present invention is:
A data management method for managing access rights of file data stored in a predetermined storage device in a computer,
Storage area designation information for designating a storage area in which access right information for identifying a person who can access file data to be managed is stored is set in the file data, and before and after this, Store accessible person information in the storage area specified by the storage area specification information.
It is characterized by that.

  Then, when the accessible person for the file data is changed, the accessible information for specifying the accessible person after the change in the data storage position specified by the storage position information corresponding to the accessible person before the change. It is characterized by memorizing.

Still another aspect of the present invention provides
A data management method for managing access rights of file data stored in a predetermined storage device in a computer,
When storage area designation information for designating a storage area in which accessible person information for identifying accessible persons of file data to be managed is stored is stored in the file data,
Accessor information acquired by a computer in response to an access request from a predetermined accessor, accessible person information stored in a storage area designated by storage area designation information in the requested file data, and To determine access rights based on
It is characterized by that.

Moreover, the program which is the other form of this invention is:
To a computer that manages the access right of file data stored in a predetermined storage device,
Access right information setting means for storing and setting storage area designation information in the file data for designating a storage area in which accessible person information for identifying accessible persons of file data to be managed is stored;
Access right information management means for storing accessible person information in a storage area designated by the storage area designation information;
It is characterized by realizing.

Furthermore, another form of the program according to the present invention is as follows:
To a computer that manages the access right of file data stored in a predetermined storage device,
Storage area designation information for designating a storage area in which accessible person information for identifying an accessible person of file data to be managed is stored is stored in the file data,
Accessor information acquired in response to an access request from a predetermined accessor, and the accessible person information stored in the storage area specified by the storage area specification information in the requested file data. Access right judging means for judging the access right based on;
It is characterized by realizing.

  Even if it is invention of the structure, method, and program mentioned above, since it acts similarly to the said data management system, the objective of this invention mentioned above can be achieved.

  Since the present invention is configured and functions as described above, according to this, it is possible to appropriately manage the users of the file data, and there are many even if the accessible person is changed later. It is not necessary to change the access right information in the file data, and only the accessible person information in the storage area specified by the storage area specification information needs to be changed, so it is possible to change the access right quickly and easily. Management can be facilitated. Therefore, the system for managing file data has an unprecedented excellent effect that the convenience of the user who uses the data and the administrator who manages the system can be improved.

  In the present invention, an identifier (a unique value in the network to which the NAS is connected) such as a user or a group having the access right is included in the access right information given to the data stored in the NAS (Network Attached Storage). Not recorded, identifiers are stored separately in a management table centrally managed on the NAS, and only the storage location on the management table is recorded in the access right information given for each data. . Hereinafter, a specific system configuration and operation will be described in an embodiment.

  A first embodiment of the present invention will be described with reference to FIGS. FIG. 1 is a schematic diagram showing the configuration of the entire system, and FIG. 2 is a functional block diagram showing the configuration of NAS. 3 to 8 are explanatory diagrams showing the state of data management. 9 to 10 are flowcharts showing the operation of the system.

[Constitution]
As shown in FIG. 1, the system in the present embodiment includes authentication servers A, B, and C connected via a network, a NAS device 1, and a user terminal 2 that accesses file data stored in the NAS. And is configured. The NAS device 1 (Network Attached Storage) stores file data groups to which access rights as described later are set, and a system is constructed so that the user terminal 2 can access these file data. Has been.

  In addition, login authentication of the user terminal 2 that desires access to file data is performed by the user of the NAS device 1 using an authentication function (local authentication function) provided in the NAS device 1, and other authentication servers. The users A, B, and C are executed using the authentication servers A, B, and C. Here, as shown in FIG. 1, each authentication server A, B, C, and NAS 1 is registered with a user name and a group name that can be logged in, respectively, and with unique identification information for the user name and group name. Login information including a certain user identifier and group identifier is registered. For example, in the authentication server A, the user identifier: A-U1 corresponding to the user name: USER1 is registered, and the group identifier: A-G1 corresponding to the group name: GROUP1 is registered in the group corresponding to the group name: GROUP2. Identifiers: A-G2 are registered respectively. Each identifier is unique on the network to which the NAS 1 is connected.

  Next, the NAS device 1 will be described in detail. The NAS device 1 is a storage device that is used by being directly connected to a network, and includes an arithmetic device 1A such as a CPU and a storage device 1B such as a hard disk drive, as shown in FIG. In the storage device 1B, a file data storage unit 16 that stores file data that can be used by the user terminal 2 described above is formed, and functions as a file server. Hereinafter, the configuration of the NAS device 1 will be described in detail.

  As shown in FIG. 2, an authentication processing unit 11, a file processing unit 12, an access right setting processing unit 13, and a table management process are installed in the arithmetic device 1A of the NAS device 1 by incorporating a data management program. Part 14 is constructed. In addition, the above-described file storage unit 16, management table storage unit 17, and login information storage unit 15 are formed in the storage device 1B.

  As shown in FIG. 1, the login information storage unit 15 stores user and group information (user name: user identifier and group name: group identifier) that can log in to the NAS device 1, that is, login information. It is remembered. And the authentication process part 11 mentioned above performs a user authentication process using this login information. Specifically, the authentication processing unit 11 accepts a user name and a group name to which the user belongs when accessing from the user terminal 2, performs authentication based on login information, and successfully authenticates the user terminal The user identifier and group identifier corresponding to the user name and group name of 2 are specified and passed to the file processing unit 12. Further, the authentication processing unit 11 succeeds in the authentication with the other authentication servers A, B, and C, and passes the user identifier and group identifier transmitted from each of the authentication servers A, B, and C to the file processing unit 12. It also has a function. The other authentication servers A, B, and C each store the login information as described above, authenticate the user terminal 2 that has logged in, and obtain the user identifier and group identifier of the user who has been successfully authenticated. It operates to transmit to the NAS device 1.

  The file processing unit 12 has a function of reading and writing file data to and from the file storage unit 16. At this time, as will be described later, a file data access request or data registration request from a user terminal 2 that has logged in (including user terminals that have logged in via other authentication servers A, B, and C) is accepted, Write or read data. Specifically, for example, when the login information of the user as shown in FIG. 3 is acquired, as shown in FIG. 4, the hash value of each identifier is obtained from the user identifier or group identifier (FIG. 4 (1)). Is calculated (FIG. 4 (2)), and the storage position information (FIG. 4 (3)) of these identifiers is obtained (position information generating means). Here, since the storage location information obtained by the hash calculation is unique information for each identifier, the storage location information is also unique for each user or each group. The calculated storage location information is divided into a file name (FIG. 4 (4)) and an offset (FIG. 4 (5)) in the management table in the management table storage unit 17, for example, as shown in FIG. This is used when accessing file data or when registering access rights. The process of registering the access right of the file data is executed by the access right setting processing unit 13 and the table management processing unit 14.

  The access right setting processing unit 13 (access right information setting means) stores the calculated storage location information in the access right information 41 of the file data 4. Here, the file data 4 stored in the file storage unit 16 includes access right information 41 and actual data 42 as shown in FIG. Here, in the conventional example, as shown in FIG. 7, the user / group identifier representing the accessible person of the file data 4 ′ is stored in the access right information 41 ′ as it is, but in this embodiment, it will be described later. As shown in FIG. 6, only the storage location information that specifies the data storage location of the management table in which the user / group identifier is stored is registered. At this time, the access right information 41 of the file data 4 also stores information indicating the access right (referenceable, updatable, etc.) in association with each of the storage position information described above.

  Then, the table management processing unit 14 (access right information management means) sets the data storage location specified by the storage location information, that is, the data storage location in the management table stored in the management table storage unit 17. The user / group identifier (accessible person information) is stored. For example, in the case of the storage location information “0x74af087e” calculated as shown in FIG. 4 (3), data storage of the file “74” and the offset “0xaf087e” in the management table 3 is performed using this information. The identifier “A-G1” is stored in the position. The registration of the identifier to the management table 3 is also executed when there is an access from a new user terminal 2.

  As described above, as shown in FIG. 6, the storage right information 41 indicating the data storage position of the management table 3 is stored in the access right information 41 of the file data 4, and the management table corresponding to this storage position information is stored. 3, an identifier of a user / group that can access the file data 4 is stored as shown in FIG. Therefore, as shown by the dotted line in FIG. 8, the predetermined data storage position in the management table 3 corresponds to the storage position information stored in the access right information 41 of each file data 4, and the data storage position An accessible user / group can be determined by referring to the identifier.

  The file access to the file data 4 in which the access right information is registered as described above is executed by the file processing unit 12 (access right determination processing unit). That is, the file processing unit 12 acquires login information (accessor information) of the accessing user and calculates storage location information from the identifier by hash calculation as described above. Based on the storage location information, the storage location information in the access right information 41 of the file data 4 requesting access is checked, and the identifier stored in the data storage location and the identifier of the logged-in user are obtained. Compare. If they match, the access authority is determined based on the access authority stored in the access authority information 41.

[Operation]
Next, operations for setting file data access rights and accessing file data in the NAS apparatus 1 having the above configuration will be described with reference to FIGS.

  First, when accessing from the user terminal 2, the user name and the group name to which the user belongs are accepted, authentication is performed based on the stored login information, and the user name and group of the user terminal 2 that has been successfully authenticated. A user identifier and a group identifier corresponding to the name are acquired (step S1). Similarly, an identifier is acquired for the user terminal 2 that has been successfully authenticated by other authentication servers A, B, and C. Here, it is assumed that the identifier “A-G1” of the group 1 of the authentication server A is acquired. Subsequently, a hash value is calculated from the acquired identifier “A-G1” as shown in FIG. 4, and storage location information of these identifiers is obtained (step S2).

  Thereafter, in the case of setting the access right for the file data 4 (Yes in step S3), as shown in FIG. 6, the identifier “A-G1” obtained as described above in the access right information 41 of the file data 4 Is stored together with the access authority information of the group user (step S4). At the same time, the identifier “A-G1” is stored in the data storage position in the management table 3 specified by the storage position information (step S5).

  On the other hand, the case where the accessing user terminal 2 accesses the file data (No in step S3, Yes in step S6) will be described with reference to the flowchart of FIG. First, as described above, an identifier that is login information of the accessing user is acquired (step S1), and storage location information is calculated from the identifier by hash calculation (step S2). Then, based on the storage location information, the storage location information in the access right information 41 of the file data 4 requesting access is checked (step S7), and the identifier stored in the data storage location of the storage location information. And the identifier of the logged-in user are compared (step S8). If they match (Yes in Step S8), the access authority is determined based on the access authority stored in the access authority information 41 (Step S9), and the access is permitted within the range of the access authority (Step S9). S10). On the other hand, if the identifiers do not match, access to the file data is disabled (step S11).

  Here, the determination of the access right at the time of file access from the user terminal 2 is not limited to the above-described processing. For example, by referring to the storage location information in the access right information of the file data requested to be accessed at the time of login, the identifier stored at the data storage location is compared with the identifier acquired at the time of login. May be. Alternatively, the access right may be determined only by checking that the storage location information obtained by hash calculation of the identifier obtained at the time of login exists in the access right information of the file data requested to be accessed.

  Here, in the above, the storage location information of the identifier stored in the access right information of the file data 4 is illustrated to indicate a more specific storage location, but the storage device in which the identifier is stored, Information (storage area designation information) for designating a storage area (drive name, file name, etc.) may be used.

  Next, a second embodiment of the present invention will be described with reference to FIGS. 11 to 13 are diagrams for explaining the case of changing the access right of the file data, and FIGS. 14 to 15 are diagrams for explaining the case of organizing the management table. FIGS. 16 to 17 are diagrams showing examples of changing various access rights.

  First, as shown in FIG. 11, the case where the user and group of the authentication server A are moved to the authentication server C will be described. That is, the case where the same user and group are changed so that the authentication process performed by the authentication server A is performed by the authentication server C is shown. Specifically, for example, a case where the GROUP1: identifier A-G1 of the authentication server A is changed to the GROUP1: identifier C-G1 of the authentication server C will be described. The change process is realized by the table management processing unit 14 (access right changing means) built in the NAS device 1 described above operating as follows.

  First, as described above, the access right information 41 of the file data 4 stores the storage location information of the identifier A-G1 of the group who is the accessible person before the change, and this storage location information designates it. As shown in FIG. 12A, the identifier A-G1 is stored in the data storage position (reference numeral 31) in the management table 3.

  When a change request is received, the storage location information is generated by hash-calculating the identifier A-G1 before the change and the identifier C-G1 after the change (step S21). Subsequently, storage position information for designating the data storage position (reference numeral 31) of the identifier A-G1 before the change is stored in the data storage position (reference numeral 32) of the identifier C-G1 after the change (step S22). That is, the link information to the identifier A-G1 (reference numeral 31) is stored in the data storage position (reference numeral 32) where the identifier C-G1 was stored.

  Subsequently, the identifier C-G1 after the change is stored in the data storage position of reference numeral 31 where the identifier A-G1 before the change is stored in the management table 3 (step S23). Thereby, when accessed with a new user name or group name, the storage location information of reference numeral 31 can be acquired via the data storage location of reference numeral 32 by referring to the storage location information calculated from the identifier. . Then, the access right can be determined by comparing the identifiers of the data storage positions based on the storage position information (storage position information of A-G1 before change) in the access right information 41 of the file data 4.

  Next, a case where the management table 3 is arranged after the change in the management table 3 as described above will be described with reference to FIGS. 14 to 15. The management table is organized by, for example, reconstruction of the file system, and the access right setting processing unit 13 and the table management processing unit 14 (access right organizing unit) constructed in the NAS device 1 described above are as follows. It is realized by operating like this.

  First, after the change of the access right described in FIG. 11 to FIG. 13 described above, the access right setting processing unit 13 stores an identifier for identifying an accessible person stored in the access right information 41 of the file data 4. The position information is corrected to the storage position information of the identifier of the correct accessible person. That is, in the example of FIG. 14, the storage location information (reference numeral 31) of A-G1 is stored as the access right information of the file data 4, but this is stored in the storage location information (reference sign of the identifier C-G1 after the change). 32) and stored (step S31). Thereafter, the table management processing unit 14 stores the changed identifier C-G1 in the original data storage position (reference numeral 32) where the changed identifier C-G1 was stored, and restores the original (step S1). S32). At the same time, the link from the area 32 to the area 31 is released. Finally, processing is performed so that the area (reference numeral 31) in which the identifier A-G1 before change is first stored can be reused (step S33).

  The change of the identifier can also be used in the following situations, for example. For example, as shown in FIG. 16, the group name may be changed in accordance with the change of the department name to which the user belongs. In this case, if the old department name “GROUP1” is changed to the new department name “GROUP2” on the authentication server A, the registration of identifiers in the management table can be changed as shown in the table, which saves time and effort. The efficiency of data management can be improved without spending time. Similarly, the user or group authenticated on the NAS may be changed to collective management with an external authentication server. In this case, for example, the identifiers of all users and groups of NAS (local authentication server) on the management table may be changed to the identifiers of users and groups added to the authentication server C as described above.

  As described above, according to the present invention, even if the accessible person is changed later, it is not necessary to change the information in each file data, and the storage location information stored in the file data is not changed. The identifier of the user or group stored at the data storage location specified in the above may be changed. Therefore, it is possible to cope with a change in access right quickly and easily, and management can be facilitated.

  INDUSTRIAL APPLICABILITY The present invention can be used for a file management system that manages access rights of file data such as NAS devices, and has industrial applicability.

1 is a schematic diagram illustrating the configuration of the entire system in Embodiment 1. FIG. It is a functional block diagram which shows the structure of a NAS apparatus. It is a figure which shows the login information by a user terminal. It is explanatory drawing which shows the process which produces | stores storage location information from a user / group identifier. It is a figure which shows the structure of a management table. It is a figure which shows an example of the access right information in the file data in a present Example. It is a figure which shows an example of the access right information in the file data in a prior art example. It is a figure which shows the relationship between the access right information in file data, and a management table. It is a flowchart which shows the operation | movement at the time of the access right setting by a NAS apparatus. It is a flowchart which shows the operation | movement at the time of the access right determination by a NAS apparatus. It is a figure which shows the user change example in Example 2. FIG. It is a figure which shows the mode of the user change process with respect to file data and a management table. It is a flowchart which shows the operation | movement at the time of the user change by a NAS apparatus. It is a figure which shows the mode of the management table rearrangement process by a NAS apparatus. It is a flowchart which shows the operation | movement at the time of the management table organization by a NAS apparatus. It is a figure which shows the other user change example. It is a figure which shows the other user change example.

Explanation of symbols

1 NAS device 2 User terminal 3 Management table 4 File data 11 Authentication processing unit 12 File processing unit 13 Access right setting processing unit 14 Table management processing unit 15 Login information storage unit 16 File storage unit 17 Management table storage unit 41 Access right information A , B, C Authentication server

Claims (12)

A data management system for managing access rights of file data stored in a predetermined storage device,
Access right information setting means for storing and setting storage area designation information in the file data for designating a storage area in which accessible person information for identifying accessible persons of file data to be managed is stored;
Access right information management means for storing the accessible person information in a storage area designated by the storage area designation information;
With
The storage area designation information included in the file data is storage location information for specifying a data storage location in a predetermined storage device,
The storage location information is unique for each accessible person,
The data management system further includes:
When the accessible person to the file data is changed, the accessible person after the change is specified in the first data storage position that is the data storage position specified by the storage position information corresponding to the accessible person before the change. And the second data storage position, which is the data storage position specified by the storage position information corresponding to the changed accessible person, is stored in the first data storage position. A data management system comprising access right changing means for storing storage location information .   The data management system according to claim 1,
  Accessor information acquired in response to an access request from a predetermined accessor, and accessible person information stored in a data storage location specified by storage location information included in the file data requested to be accessed; A data management system comprising access right determination means for determining an access right based on.   The data management system according to claim 2,
  If the storage location information is stored in the data storage location specified by the storage location information included in the file data, the access right determination means stores the data in the data storage location specified by the storage location information. A data management system configured to use the accessible person information stored as information stored in a data storage location specified by storage location information included in the file data. A data management system according to any one of claims 1 to 3,
The data management system, wherein the accessible person is a single accessible person or a group of a plurality of accessible persons. A data management system according to any one of claims 1 to 4,
From identification information specific to preset the accessible's data management system comprising a position information generating means for generating the storage location information. A data management system according to any one of claims 1 to 5,
The storage location information included in the file data is changed to storage location information representing the data storage location where the accessible person information after the change by the access right changing means was stored, and the storage location information It said access right change means the accessible user information storing access right arranging unit Bei obtain data management system after the change by the data storage location specified by the information. A data management method for managing access rights of file data stored in a predetermined storage device,
Storage area designation information for designating a storage area in which accessible person information for identifying an accessible person of file data to be managed is stored is set in the file data,
Storing the accessible person information in a storage area designated by the storage area designation information;
The storage area designation information included in the file data is storage location information for specifying a data storage location in a predetermined storage device,
The storage location information is unique for each accessible person,
The data management method further includes:
When the accessible person to the file data is changed, the accessible person after the change is specified in the first data storage position that is the data storage position specified by the storage position information corresponding to the accessible person before the change. And the second data storage position, which is the data storage position specified by the storage position information corresponding to the changed accessible person, is stored in the first data storage position. A data management method configured to store storage location information .   The data management method according to claim 7, comprising:
  Accessor information acquired in response to an access request from a predetermined accessor, and accessible person information stored in a data storage location specified by storage location information included in the file data requested to be accessed; A data management method for determining an access right based on.   The data management method according to claim 8, comprising:
  When the storage location information is stored in the data storage location specified by the storage location information included in the file data, the accessible person stored in the data storage location specified by the storage location information A data management method configured to use information as information stored in a data storage location specified by storage location information included in the file data. To a computer that manages the access right of file data stored in a predetermined storage device,
Storage area designation information for designating a storage area in which accessible person information for identifying an accessible person of file data to be managed is stored is set in the file data,
The storage area designated by the storage area specifying information, stores the accessible user information, to together when make executes the process,
The storage area designation information included in the file data is storage location information for specifying a data storage location in a predetermined storage device,
The storage location information is unique for each accessible person,
In addition to the computer,
When the accessible person to the file data is changed, the accessible person after the change is specified in the first data storage position that is the data storage position specified by the storage position information corresponding to the accessible person before the change. And the second data storage position, which is the data storage position specified by the storage position information corresponding to the changed accessible person, is stored in the first data storage position. A program configured to execute a process of storing storage position information .   The program according to claim 10,
  In addition to the computer,
  Accessor information acquired in response to an access request from a predetermined accessor, and accessible person information stored in a data storage location specified by storage location information included in the file data requested to be accessed; , A program configured to execute a process of determining an access right based on.   The program according to claim 11,
  In addition to the computer,
  When the storage location information is stored in the data storage location specified by the storage location information included in the file data, the accessible person stored in the data storage location specified by the storage location information A program configured to execute a process of using information as information stored in a data storage location specified by storage location information included in the file data.

Images