JP5033658B2 - Electronic document security system - Google Patents

Description

  The present invention relates to an electronic document security system relating to a medium in which an electronic document can be browsed directly or indirectly, such as a personal computer, a projector, an electronic blackboard, and an image forming apparatus.

  With the progress of computerization of information, security functions for electronic data have become important. With the spread of PCs and the Internet and the ability to send information from individuals, the impact on organizations when electronic confidential information leaks has become immeasurable. is there. In such a background, when creating an electronic document in which confidential information is recorded, it is common to reduce the risk of information leakage by limiting the number of people who can access the information. It has become. This technique includes the following.

  (1) Encrypt the electronic document. Set a single password when creating an electronic document. Thus, when the created electronic document is opened, it cannot be opened unless the set password is set.

  (2) Create an electronic document after setting the access right of the electronic document for each user in the security policy server. When opening the created electronic document, an ID and a password for user authentication are input so that only the authenticated user can open the electronic document. However, these techniques have the following problems.

(Problem / Security function for the entire electronic document)
It was only possible to restrict access to the entire electronic document. That is, even if the confidential information is included only in a part of the electronic document, if the document is restricted, it is not possible to browse the part other than the confidential information. This also means that only a single access level could be set. Even if you want to set multiple access levels for confidential information to be electronically documented (if you want to change access restrictions for each piece of data in an electronic document), you can only set whether or not the entire document can be viewed. There wasn't.

  However, there are not a few cases where confidential information is described only in a part of an electronic document in actual use. In such a case, it is sufficient to restrict access only to the confidential information description part. In this case, the simple security described above could not cope. In addition, since information in an electronic document varies, there are cases where it is desired to give a level to access restriction.

  This example will be described with reference to FIG. It is assumed that there is an electronic document 4 composed of information 1, 2, and 3, and there are five users A, B, C, D, and E as persons related to the electronic document 4. As shown in Table 1, it is assumed that the information in the electronic document is restricted so that only Mr. D cannot access information 1 and only Mr. B cannot access information 2.

  At this time, Table 2 shows the viewing authority for each piece of information to be set for Mr. A, Mr. B, Mr. C, Mr. D, and Mr. E.

  Items with ○ indicate that the corresponding user has access right, and items with × indicate that the corresponding user does not have access right to the information. That is, users A, C, and E can access all information in the electronic document 4, but B cannot access information 2 and D cannot access information 1.

  Assuming such restrictions, it is necessary to set access rights for each piece of information in the electronic document, so setting a single access level for the entire electronic document is not sufficient. It is necessary to set an access level to.

  In order to solve this problem, Patent Document 1 discloses an invention in which access restriction can be applied to a document portion. In the present invention, a word for which access restriction is to be applied in a document is registered in advance as a public restriction word. It is characterized by being output after replacement. The masking character string is a character string that is different from the public restriction word so that the public restriction word can be distinguished, and is a random character string or a specific character string.

  In Patent Document 2, the access right for each area and each object of a document registered in the server in advance is described as print control information in a markup language and sent to a printing device. Thereafter, the printing device performs printing based on the transmitted print control information. At this time, the area / object without the access right is subjected to processing such as mosaic processing and is outputted, so that access control of the printed matter can be performed.

Patent Document 3 discloses an invention in which encryption is performed by changing an access level for each part of a document. As described above, the access control to the document can be finely set from the whole to the part as the technology advances.
JP 2005-215717 A JP 2005-190426 A JP-T-2004-502379

  By the way, the access right is set for a role in a person / group / organization. If it is a person, this “person” is restricted from accessing this electronic data, and if it is a group, the “person” in this group is restricted from accessing this part of the electronic document. It is set in such a meaning. The unit to be set is person, group, organization, etc., but the target of restriction is always “person”.

  Therefore, in the conventional technology, regarding the right to access electronic data, if attention is paid to the relationship between the “person” and the electronic document, it is considered as static. An entire and a part of an electronic document that a certain “person” can browse at a certain place can also be viewed at another place. However, there are cases where it is desirable to dynamically change the access rights to the “person” document. Hereinafter, the case will be described with an example. The numbers at the beginning of the lines indicate time series.

  First, Example 1 is given as a first example of a case where the access right is to be dynamically changed. In Example 1, there is an electronic document 4 composed of information 1, 2, and 3 shown in FIG. 9, and there are users A, B, C, D, and E as persons related to the electronic document 4. And Further, it is assumed that the access right of the electronic document 4 is to be restricted as shown in Tables 1 and 2.

(Example 1)
1. Mr. A is sitting in his seat.
2. An electronic document 4 with a predetermined access right is distributed to Mr. A.
As presupposed, Mr. A should be able to refer to all parts of the electronic document 4 because he / she has the authority to browse all information in the electronic document 4.
3. Assume that a meeting by Mr. A, Mr. B, and Mr. C is held. A model diagram is shown in FIG. In that meeting, proceedings are carried out using the electronic document 4. Because Mr. B is in the same place, it is not desirable for Mr. B to browse the information 2 of the electronic document 4. Further, since it is not desirable to give information related to information 2 to Mr. B, the topic related to information 2 should be avoided.
4. During the meeting as described above, Mr. D entered the meeting room. The situation is shown in FIG. Since Mr. D does not have the viewing authority regarding the information 1, it is necessary to hide the information 1 that has been displayed until then.

  Example 2 is given as a second example of a case where the access right is to be changed dynamically. As in Example 1, there is an electronic document 4 composed of information 1, 2, and 3, and there are users A, B, C, D, and E as persons related to the electronic document 4. To do. Assume that the access right of the electronic document 4 is restricted as shown in Tables 1 and 2.

(Example 2)
1. Mr. A is sitting in his seat.
2. Now, electronic document 4 as shown in FIG. 9 in which a predetermined access right is set is distributed to Mr. A. The electronic document 4 contains information 1, 2, and 3. As shown in Table 2, since Mr. A has the right to browse all information in the electronic document 4, it should be possible to refer to all parts of the electronic document 4.
3. A meeting by Mr. A, Mr. B and Mr. C was held. In that meeting, proceedings are carried out using the electronic document 4. Since Mr. B exists in the same place, as shown in FIG. 11, it is not desirable to show Mr. B about the information 2 of the electronic document 4. Further, in this case, the topic related to information 2 should be avoided because it may give information related to information 2 even if it is fragmented.
4. A meeting by Mr. A, Mr. D and Mr. E was held. In that meeting, proceedings are carried out using the electronic document 4. Since Mr. D is in the same place, as shown in FIG. 13, it is not desirable to show Mr. D about the information 1 of the electronic document 4. Also, topics related to information 1 should be avoided.

  In the above cases, when focusing on the electronic document 4 seen by Mr. A, it is preferable that the information that can be referred to on the same document differs depending on the access rights of people around the same place. That is, it is preferable that Mr. A cannot access some information temporarily even though he has access rights to all information. These are events that can occur within the same day, and are not long-span stories such as access rights revoked due to organizational movement.

  In the conventional invention, since the relationship between the “person” and the document access right is static, it cannot cope with the above case. For example, in the case of Example 1, when Mr. D participates while discussing information 1, in order to hide information 1 of the electronic document 4 that is the subject of discussion at the conference from Mr. D, The participant can only close the electronic document.

  In the description so far, the access right = viewing authority has been described. However, in addition to the viewing authority, there are printing authority / editing authority, and the same can be said for these. The access right in the present invention is not limited to browsing authority but is regarded as including printing authority and editing authority.

  In addition, in the explanation so far, it described about the technique aiming at hiding confidential information from a specific person. Furthermore, there are cases where a technique for preventing access to information unless a specific person is available is necessary for security. For example, this is the case given in Example 3.

(Example 3)
1. Assume that users A, B, C, D, and E start reviewing a meeting using an electronic document. This electronic document is a document described by Mr. A and is a document delivered to Mr. B. Furthermore, it is a document that needs to be approved by Mr. B when delivering. It is assumed that A has sent an electronic document to B before the review.

  2. Mr. B read the contents of the electronic document in advance and grasped it before attending the meeting. Since there is a possibility that the contents may be changed due to the review, Mr. B wants to grasp the editing contents.

  In such a case, it may be preferable not to edit the corresponding electronic document except in front of Mr. B. As described above, there are cases where it is desirable that an access right cannot be acquired unless a specific person gathers. However, in the past, there has not been considered a technology itself that prevents access to information unless a specific person is present.

  The present invention has been made in view of the above problem, and an object thereof is to provide an electronic document security system that dynamically changes a person's access right to the same document according to the situation. In the present invention, the access right to be applied as a security function restricts the electronic document and “opportunity”, not the electronic document and “person”. Here, an opportunity means a time when one or more people gather in one place.

In order to achieve the above object, the present invention provides a file server for storing an electronic document, user recognition means for reading the user identification information from a storage medium storing user identification information for identifying each user, and the read A security system comprising: an authentication server that authenticates a user based on user identification information; a computer that accesses the electronic document and displays the contents of the electronic document on a display; and a projector connected to the computer. The file server stores each user's access right to the electronic document, and the computer reads the user identification information by the user recognition means and obtains a list of users authenticated by the authentication server. User list acquisition means and the user for the electronic document Content of the electronic document displayed on the display and the projector based on the access right reading means for reading the access right of the user in the list acquired by the list acquisition means from the file server, and the access right for the read electronic document Electronic document content output selection means for selecting the electronic document content output selection means, which is allowed to be displayed by the user of the computer, but the user in the list acquired by the user list acquisition means. Control a part of the content that is not permitted to be displayed to at least one of them by highlighting the part of the content on the display and preventing the projector from displaying the part of the content. An electronic document security system is provided .

  According to the present invention, when opening an electronic document, the user identification code corresponding to the electronic document, the access right reading means for reading the corresponding access right, and the user identification of the user related to the electronic document at that time By deciding the access right from the user list consisting of codes, it is possible to open contents suitable for opening an electronic document.

    In order to describe an embodiment of the present invention, a case where a conference is held in a conference room will be described. FIG. 1 is a diagram schematically showing a state in the conference room. The IC card reader 100 is an IC card reader that is a part of user recognition means. PC 101, PC 102, and PC 103 are computers of participants A, B, and C, respectively. The projector 104 projects the screen of the PC 101.

    FIG. 2 is a diagram showing a network configuration of a computer in the present embodiment. The PC 101, PC 102, and PC 103 are connected via a LAN to a computer file server 105 that functions as a file server. It is assumed that the file server 105 also manages access right information of stored files. The authentication server 108 is an authentication server that is a part of the user recognition unit.

  FIG. 3 is a diagram showing an outline of the internal configuration of the file server 105. The file server 105 includes an HDD 106, an electronic document 107, and a CPU 109. The HDD 106 is an electronic medium provided in the file server 105. An electronic document 107 is an electronic document stored in the HDD 106.

  Assume that the electronic document 107 is the same as the electronic document 4 shown in FIG. 9, and the access rights to this document are set as shown in Tables 1 and 2. Examples of the access right include a read right, an edit (write) right, and a print right. The access right in the example described here is a read right. It is assumed that the user has an IC card for identifying the user, and when entering the conference room, the user cannot enter the conference room unless the IC card is passed through the IC card reader 100 for authentication.

  Hereinafter, the operation of the system in this embodiment will be described in time series. A user who enters the conference room passes his IC card through the IC card reader 100. The user identification code in the IC card read by the IC card reader 100 is subjected to user authentication by the authentication server 108 via the network. The authentication server 108 determines whether or not the user identification code can enter the conference room.

  If it is a user identification code that can enter the conference room, the door can be opened. Such a mechanism is the same as general user authentication means. If the user authentication is passed, which user is in the conference room is stored in the authentication server 108. Here, it is stored in the authentication server 108, but may be stored anywhere on the system. Suppose that Mr. A, Mr. B, and Mr. C entered this conference room through an IC card. Then, information that A, B, and C are in the conference room is accumulated in the authentication server 108.

  Assume that Mr. A projects the contents of the electronic document 107 on the projector 104 and proceeds with the proceedings. When Mr. A opens the electronic document 107 on the PC 101, the following processing is performed. First, user list creation means is executed on the PC 101. As a system, any computer may have user list creation means, but in this example, it is assumed that the PC 101 holds it. When the user list creation means is executed, information on users in the conference room stored in the authentication server 108 is acquired in the PC 101. Next, a user list is created from the acquired user information.

  Second, the PC 101 acquires the user list created earlier by the user list acquisition unit.

  Third, the PC 101 reads the access right to the electronic document 107 for each user in the user list acquired earlier by the access right reading means. The user list user's access rights to the electronic document 107 are stored in the file server 105. As a result, the access right to the electronic document 107 from the PC 101 is determined. Based on the determined access right, the contents of the electronic document 107 are displayed on the display of the PC 101.

  Fourth, Mr. A projects the display content of the PC 101 onto the projector 104. This projection result will be in the eyes of Mr. B and Mr. C in the conference room. Hereinafter, display contents of the PC 101 and the projector 104 will be described. First, the determined access right is that only information 1 and information 3 of the electronic document 107 can be read and information 2 cannot be read. This is because Mr. B does not have the authority to read information 2. There are several possible ways to reflect this access right to the appropriate display content.

  First, there is a method in which the information 2 is completely invisible and only the information 1 and the information 3 are displayed as shown in FIG. Since information 2 needs to be hidden from Mr. B, it is appropriate for the image projected on the projector 104. Even if the image displayed on the PC 101 does not display information related to the information 2, it is difficult for Mr. A to inadvertently leak the contents from the mouth.

  Next, regarding information 2 to be hidden from Mr. B, information 1 and information 3 that can be accessed, there is a method of identifying information 2 with a color. As shown in FIG. 5, the information 2 portion is colored, for example, the information 1 and 3 are black and the information 2 is yellow, so that they are distinguished from the other information 1 and information 3 portions. In the present embodiment, the colors are identified by colors, but other than the colors, attributes such as fonts, character sizes, and enclosing frames may be used. Since Mr. A has the right to view information 2 as well, information 2 may be displayed on the screen of the PC 101 that Mr. A sees.

  If Mr. A can identify the information 2 to be hidden from Mr. B and the information 1 and information 3 that can be viewed by anyone, he / she should be aware of hiding it from Mr. B while viewing the information 2. It becomes possible. However, the projection content on the projector 104 is inappropriate. This is because it is not desirable to show information 2 to B. In this system, when Mr. A projects the contents of the PC 101 on the projector 104, he / she presses a predetermined control means connected to the PC 101, for example, a specific button. The electronic document content output unit is selected by the content output selection unit in order to determine an image projected on the projector 104.

  As a result, the information 2 is highlighted and displayed on the PC 101, whereas the information 2 disappears from the video projected on the projector 104. That is, it is possible to use different electronic document content output means for the content output to the PC 101 and the content output to the projector 104. In this embodiment, the PC 101 has the electronic document content output selection means. However, the system may be the file server 105 or another computer.

The algorithm for selecting the electronic document content output means by the electronic document content output selection means is not particularly limited, but the following can be said. Such as projectors, electronic blackboards, in multiple people watch computer at the same place, that the be force out unconditionally not output for undesirable information is selected is deemed preferable for security manner. In a computer viewed by an individual such as a PC, one of them may be determined by default or may be fixed. It does not matter if the individual can be changed.

  Further, it is possible to apply a mosaic to the information 2 to be hidden from Mr. B as shown in FIG. By applying a mosaic, it is possible to know where information in the document should be hidden for security purposes. Although it is a mosaic here, it does not matter if it is not visible by blurring.

  Further, the information 2 to be hidden from Mr. B can be replaced with a character string as shown in FIG. By doing this, it is possible to know where in the document there is information to be hidden for security. In addition, it is possible to reduce the uncomfortable feeling of the document due to hiding the information, compared to the case where the information is hidden by mosaic or blurring.

  In this case, Mr. B and Mr. C can display the contents of the electronic document 4 on their own PCs using the PC 102 and the PC 103. For example, like Mr. A, the electronic document 4 stored in the HDD 106 can be opened by itself. In such a case, the display content displayed on the PC is determined by the access right of each person and the access right of all members. At this time, assuming that the electronic document content output means for each PC is the same as the PC 101, the same contents as the PC 101 are displayed on the PC 103. In PC 102, since Mr. B does not have access rights to information 2, information 2 is not displayed. As for other information, the content to be displayed is determined according to the electronic document content output means.

  Next, suppose that Mr. D enters the conference room. When Mr. D enters the conference room, he / she enters the conference room after receiving card authentication like other people. When Mr. D enters the conference room, the authentication server 108 accumulates information that Mr. A, Mr. B, Mr. C, and Mr. D are in the conference room. Since the PC 101 periodically accesses the file server 105 and the authentication server 108 at short intervals, when Mr. D enters the conference room, Mr. D is immediately added to the user list. Then, this is first reflected in the access right to the electronic document 107 of each computer, and this is reflected in the display on each computer.

  Since Mr. D does not have the right to view the information 1, it is reflected in the display according to the electronic document content output means of each computer. In other words, the information 1 is processed such that it is not displayed or a mosaic is applied. In this embodiment, the electronic document opened on the computer has been described as being projected onto the projector. However, the projector itself may have the function. In addition, the following variations can be considered.

  In the first embodiment, an example in which a color is added or deleted to identify information to be hidden has been described. Information about who is missing may be output to the screen. For example, as shown in FIG. 8, it can be shown in a tabular form at the corner of the screen. This is expected to increase security awareness.

  In the first embodiment, the user list uses a person who entered the conference room as a constituent factor of the list, but it is unlikely that there is an authentication function for entering all the conference rooms. If it is a company, it is considered that a notice of the event is often distributed to participants when a meeting is held. Therefore, as a third embodiment, the user list may be a list of user information distributed from the notice of opening, and then the user list may be created. An administrator who can change the access right may set manually.

  The first embodiment has been described as an example for hiding confidential information from a specific person. The present technology can also be used in the fourth embodiment to prevent access to information unless a specific person is present. That is, it is only necessary to display specific information only when specific people are in the user list. Needless to say, it is possible to hide information from a specific person in the embodiment.

  As a fifth embodiment, the present invention can be applied not only to an opportunity at a physical place such as a conference room, but also to an internet meeting.

  In the first embodiment, the access right information of the electronic document 107 is also given to the server file server 105. Here, as a sixth embodiment, it is possible to give access right information to the electronic document itself. Although there is a demerit that the file size increases as the information amount of the electronic document increases, a document that is considered to have few users has an advantage that the electronic document can be accessed without a server.

  In the first embodiment, the user list uses the person who entered the conference room as a constituent factor of the list. However, as mentioned in the explanation of the variation, the user list can be manually set by an administrator who can change the access right. Is possible. In such a case where the user list is manually set, it is necessary to share the user list. In order to share the user list, the PC 102 and the PC 103 acquire the user list created by the PC 101. The acquisition means may be performed by existing network technology. The display content of the PC 101 is synchronized with the PC 102 and the PC 103. No operation is required on the PC 102 and PC 103. The synchronization means is not an invention of this technology but an existing technology.

  When editing an electronic document, a user consisting of a user identification code corresponding to the electronic document, an access right reading means for reading the corresponding access right, and a user identification code of a user who is editing the electronic document By deciding the editing authority from the list, it is possible to give the editing authority suitable for opening the electronic document. Further, when opening an electronic document, the plurality of computers are provided with means for synchronizing the display contents with the first computer, whereby the display contents of the plurality of computers can be collectively managed.

  When printing an electronic document, the plurality of computers are provided with means for synchronizing the display contents with the first computer, whereby the print contents of the plurality of computers can be collectively managed. When editing an electronic document, a plurality of computers are provided with means for synchronizing display contents with the first computer, whereby the editing authority of the plurality of computers can be collectively managed.

  In addition, since a plurality of computers share an electronic file with a user list, it is possible to prevent unauthorized creation / error of the user list and to maintain security.

  For users with access rights by outputting users with no access rights by means of outputting users with no access rights for all or part of the electronic document Reveals users who need to keep information away and raises security awareness.

  By registering only the users recognized by the user recognition unit in the user list, it is not necessary to manually create the user list, so that concerns such as a user list setting error are eliminated. Furthermore, if the computer is used, the recognized information can be updated instantaneously, so that the dynamic changeability of the access right is enhanced.

  When a user identification code and access right information corresponding to the user identification code are stored in the electronic document itself, the electronic document itself can be opened offline while maintaining security by providing an authentication function. When printing an electronic document, the electronic document can be printed offline while maintaining security. When editing an electronic document, the electronic document can be edited offline while maintaining security.

  If the electronic document is physically separated from the electronic medium storing the user identification code and the corresponding access right information, the file size of the electronic document can be prevented from increasing due to the application of the present invention. In addition, it is possible to collectively manage access rights to electronic documents, and to easily change access rights.

  Since the computer is a projector, a projector to the projector does not need to be conscious of security regarding information to be projected onto the projector. In addition, a computer other than the projector is unnecessary. Further, by not outputting an area of information that is not desired to be output, there is no risk of leakage of confidential information. When the information output by the electronic document content output means is output with an attribute that can identify the difference in access rights, it is necessary to keep the information away from users who have access rights. It becomes clear that information needs to be kept away as soon as a certain content is viewed.

  In addition, when a mosaic is applied to an area of information that is not desired to be output, the information can be kept away from a user who should keep the information away without any discomfort.

  In addition, regarding the area of information that is not desired to be output, if it is replaced with a specific character string and image or random character string and image, the information should be kept to the user who should keep the information away without any sense of incongruity. You can keep away. Also, by having a plurality of electronic document content output means and making them selectable, the flexibility of the security function is enhanced.

It is the figure which showed typically the meeting using the system in embodiment of this invention. It is a block diagram of LAN in embodiment of this invention. It is an internal block diagram of the file server 106 in embodiment of this invention. It is a figure which shows the example of an output of the electronic document in the case of not outputting the information which output is not desirable in the embodiment of the present invention. It is a figure which shows the output example of an electronic document in the case of emphasizing the information which output is not desirable in embodiment of this invention by changing a color. It is a figure which shows the example of an output of the electronic document at the time of applying a mosaic to the information which the output in embodiment of this invention is not desirable. It is a figure which shows the output example of an electronic document at the time of replacing the information with the undesirable output in embodiment of this invention with the specific character string. It is a figure which shows the example of an output which displayed the information regarding an access right on the lower right of a screen, after emphasizing the information which output is not desirable in the embodiment of the present invention by changing the color. It is an electronic document containing information 1, 2, and 3 and the model figure of five users of Mr. A, Mr. B, Mr. C, Mr. D, and Mr. E who are engaged in it. It is a figure which shows the display content of the electronic document 4 when Mr. A accesses the electronic document 4 in embodiment of this invention. It is an example which shows the display content of the electronic document 4 when A, B, and C are in a meeting room. It is a figure which shows the display content of the electronic document 4 when A, B, C, and D are in a meeting room. It is a figure which shows the display content of the electronic document 4 when Mr. D and Mr. E are in a meeting room.

Explanation of symbols

1 Information 1
2 Information 2
3 Information 3
4, 5, 107 Electronic document 100 IC card reader 101, 102, 103 PC
104 projector 105 file (general purpose) server 106 HDD
108 Authentication server 109 CPU

Claims (2)

  A file server for storing electronic documents;
  User recognition means for reading the user identification information from a storage medium storing user identification information for identifying each user;
  An authentication server for authenticating a user based on the read user identification information;
  A computer for accessing the electronic document and displaying the content of the electronic document on a display;
  A projector connected to the computer;
  An electronic document security system comprising:
  The file server stores each user's access rights to the electronic document,
  The computer
    User list acquisition means for acquiring a list of users whose user identification information is read by the user recognition means and authenticated by the authentication server;
    Access right reading means for reading the access right of the user in the list acquired by the user list acquisition means for the electronic document from the file server;
    Electronic document content output selection means for selecting the content of the electronic document to be displayed on the display and the projector based on the read access right to the electronic document;
  With
  The electronic document content output selection means includes:
    Although the display is permitted for the user of the computer, with respect to some contents that are not permitted to be displayed to at least one of the users in the list acquired by the user list acquisition unit,
    Let the display highlight the part of the content,
    Control the projector not to display the contents of the part
  An electronic document security system characterized by that.   2. The electronic document security system according to claim 1, wherein the user list acquisition unit acquires the list periodically at short intervals.

Images