JP5970886B2 - Information processing apparatus and information processing program - Google Patents

Description

  The present invention relates to an information processing apparatus and an information processing program.

  In Patent Document 1, it is an object to make it possible to reduce the cost required for search processing of access control data both at the time of determination of access right and at the time of setting of access right. In access management, when a specified object and an access request to the specified object are received, access right inheritance data given to the specified object is acquired, and a reference destination object is determined from the access right inheritance data. Then, it is disclosed that the access control data given to the reference destination object is acquired, and whether or not the access request can be executed is determined based on the acquired access control data.

  In Patent Document 2, it is an object to automate the setting change work of the authority of a database access qualified person while maintaining the safety of system operation. A database access authority management server and a moving object management server are provided, and a mobility management server is provided in the other management terminal. The server supplies authentication information to the server. The server is equipped with access authority information and operation command information, and the access authority is set to the database device via the management terminal while autonomously moving between the servers via the telecommunication line. A moving object to be generated and inserted into the telecommunication line, and based on the authentication information when communicating It is disclosed to perform authentication between servers.

  Japanese Patent Application Laid-Open No. 2004-151867 discloses that data access right management is appropriately and efficiently performed in a data management apparatus that determines whether or not each object stored can be accessed hierarchically based on access right information. An access right information setting unit that sets access right information only for an object (cabinet) stored in the highest hierarchy among stored objects, and an access right information non-setting object other than a cabinet ( When there is an access request to a folder, document, section), a reference part that references the access right information set in the cabinet, and an access right information non-set object based on the referenced access right information It is disclosed that an access determination unit that determines whether or not permission is provided.

JP 2006-106986 A JP 2004-287547 A JP 2007-193826 A

  The present invention is based on the positional relationship based on the hierarchical structure of electronic information when the access right corresponding to all electronic information is not stored and the access right corresponding to the target electronic information is not stored. Accordingly, an object of the present invention is to provide an information processing apparatus and an information processing program that evaluate an access right corresponding to electronic information in a higher hierarchy as an access right of the target electronic information.

The gist of the present invention for achieving the object lies in the inventions of the following items.
According to the first aspect of the present invention, electronic information identification information, which is information for identifying electronic information, and the target electronic from the first storage means that stores the access right assigned to the electronic information in association with each other. When evaluating the access right of information, a determination means for determining whether or not an access right corresponding to the electronic information identification information of the target electronic information is stored, and the corresponding access right is stored by the determination means If it is determined that the electronic information is not, the electronic information identification information of the electronic information in the higher hierarchy than the target electronic information is changed to the electronic information identification information and the electronic information of the electronic information in the higher hierarchy than the electronic information identification information. Of the electronic information identification information acquired by the acquisition means acquired from the second storage means correspondingly storing the electronic information identification information and the electronic information identification information acquired by the acquisition means, The access right corresponding to the electronic information identification information close to the target electronic information is obtained from the first storage means based on the positional relationship of the structure, and is evaluated as the access right of the target electronic information. And setting the access right for the electronic information by storing the access right in association with the electronic information identification information of the electronic information that is the target of the access right setting, in the first storage means. Setting means for acquiring, from the second storage means, electronic information identification information of electronic information at a higher hierarchy than the electronic information for which access rights are to be set. Of the electronic information identification information, the access right corresponding to the electronic information identification information close to the electronic information for which the access right is to be set is the action to be set. Same as the nest right, an information processing apparatus characterized by not set access rights for electronic information.

  According to a second aspect of the present invention, the first storage means stores route identification information, which is information for identifying a route of the hierarchy, as electronic information identification information, and has at least an access right corresponding to the route identification information. The information processing apparatus according to claim 1, wherein the acquisition unit acquires at least the route identification information as electronic information identification information of electronic information in a higher hierarchy to be acquired. .

A third aspect of the present invention, if it is detected that the electronic information is deleted, the first deletes the corresponding electronic information identification information and the access right of the electronic information from the storage means, said second storage means the information processing apparatus according to claim 1 or 2, characterized by further comprising a deleting means for deleting the electronic information identification information of the electronic information from it.

According to a fourth aspect of the present invention, the setting means acquires electronic information identification information of electronic information in a lower hierarchy than the electronic information for which access rights are set from the second storage means, and acquires the electronic information identification information. Of the electronic information identification information, if the access right corresponding to the electronic information identification information close to the electronic information for which the access right is to be set is different from the access right to be set, the electronic information of the acquired electronic information identification information The information processing apparatus according to claim 1 , wherein the information processing apparatus confirms with the operator whether or not to change the setting of the access right to the information.

In the fifth aspect of the present invention, when the access right is set by the setting means and the setting is withdrawn, the electronic information identification information and the access right that are set from the first storage means are stored. an information processing apparatus according to any one of claims 1 to 4, characterized in that deletes the corresponding.

In the invention of claim 6 , when the access right is set by the setting means, the access right is set by the access right setting out of the electronic information at a lower layer than the electronic information to be set for the access right. an information processing apparatus according to any one of claims 1 to 5, characterized in that further comprising presenting means for presenting a range of electronic information to be subject to change.

According to a seventh aspect of the present invention, the setting means stores the date and time when the access right was set in the first storage means, and based on the date and time stored in the first storage means, Configuring an information processing apparatus according to any one of claims 1 to 6, characterized by further comprising a second presenting means for presenting the history is performed.

The invention according to claim 8 is directed to the computer from the first storage means for storing the electronic information identification information, which is information for identifying the electronic information, and the access right assigned to the electronic information in association with each other. A determination means for determining whether or not an access right corresponding to the electronic information identification information of the target electronic information is stored, and an access corresponding by the determination means If it is determined that the right is not stored, the electronic information identification information of the electronic information at a higher level than the target electronic information is stored in the higher level than the electronic information identification information and the electronic information identification information. Acquisition means for acquiring from the second storage means for storing the electronic information identification information of the electronic information in association with the electronic information identification information acquired by the acquisition means; In other words, based on the positional relationship of the structure of the hierarchy, the access right corresponding to the electronic information identification information close to the target electronic information is obtained from the first storage means, so that the target electronic information is obtained. The electronic information identification information of the electronic information that is the target of the access right setting and the access right are stored in correspondence with each other in the evaluation means that evaluates as the access right for the electronic information. It functions as a setting means for setting an access right, and the setting means obtains electronic information identification information of electronic information in a higher hierarchy than the electronic information for which the access right is set from the second storage means. Of the acquired electronic information identification information, an access right corresponding to the electronic information identification information close to the electronic information that is the target of the access right setting is set. If same access are trying to right, an information processing program characterized by not set access rights for electronic information.

According to the information processing apparatus of claim 1, when the access right corresponding to all electronic information is not stored and the access right corresponding to the target electronic information is not stored, the hierarchy of the electronic information The access right corresponding to the electronic information in the upper hierarchy can be evaluated as the access right of the target electronic information based on the positional relationship by the structure. In addition, it is possible to avoid setting useless access rights.

  According to the information processing apparatus of the second aspect, it is possible to avoid a state in which the right to access electronic information cannot be evaluated.

According to the information processing apparatus of the third aspect , it is possible to manage the access right corresponding to the state where the electronic document is deleted.

According to the information processing apparatus of claim 4 , when the access right setting is different from the access right of the lower electronic information, the operator is asked whether to change the access right of the lower electronic information. Can do.

According to the information processing apparatus of the fifth aspect , the access right setting can be withdrawn by deleting the correspondence between the electronic information identification information set and the access right from the first storage means.

According to the information processing apparatus of the sixth aspect , it is possible to present a range of electronic information whose access right is to be changed by setting the access right.

According to the information processing apparatus of the seventh aspect , it is possible to present a history in which the access right is set.

According to the information processing program of claim 8 , when the access right corresponding to all the electronic information is not stored and the access right corresponding to the target electronic information is not stored, the hierarchy of the electronic information The access right corresponding to the electronic information in the upper hierarchy can be evaluated as the access right of the target electronic information based on the positional relationship by the structure. In addition, it is possible to avoid setting useless access rights.

It is a conceptual module block diagram about the structural example of 1st Embodiment. It is explanatory drawing which shows the system configuration example in implement | achieving 1st Embodiment. It is a flowchart which shows the process example by 1st Embodiment. It is a flowchart which shows the process example by 1st Embodiment. It is explanatory drawing which shows the process example by 1st Embodiment. It is explanatory drawing which shows the example of a data structure of an access right management table. It is explanatory drawing which shows the data structure example of a hierarchical structure management table. It is a conceptual module block diagram about the structural example of 2nd Embodiment. It is explanatory drawing which shows the example of a data structure of an access right management table (change history). It is a block diagram which shows the hardware structural example of the computer which implement | achieves this Embodiment.

Hereinafter, examples of various preferred embodiments for realizing the present invention will be described with reference to the drawings.
FIG. 1 is a conceptual module configuration diagram of a configuration example according to the first embodiment.
The module generally refers to components such as software (computer program) and hardware that can be logically separated. Therefore, the module in the present embodiment indicates not only a module in a computer program but also a module in a hardware configuration. Therefore, the present embodiment is a computer program for causing these modules to function (a program for causing a computer to execute each procedure, a program for causing a computer to function as each means, and a function for each computer. This also serves as an explanation of the program and system and method for realizing the above. However, for the sake of explanation, the words “store”, “store”, and equivalents thereof are used. However, when the embodiment is a computer program, these words are stored in a storage device or stored in memory. It is the control to be stored in the device. Modules may correspond to functions one-to-one, but in mounting, one module may be configured by one program, or a plurality of modules may be configured by one program, and conversely, one module May be composed of a plurality of programs. The plurality of modules may be executed by one computer, or one module may be executed by a plurality of computers in a distributed or parallel environment. Note that one module may include other modules. Hereinafter, “connection” is used not only for physical connection but also for logical connection (data exchange, instruction, reference relationship between data, etc.). “Predetermined” means that the process is determined before the target process, and not only before the process according to this embodiment starts but also after the process according to this embodiment starts. In addition, if it is before the target processing, it is used in accordance with the situation / state at that time or with the intention to be decided according to the situation / state up to that point. When there are a plurality of “predetermined values”, the values may be different from each other, or two or more values (of course, including all values) may be the same. In addition, the description having the meaning of “do B when it is A” is used in the meaning of “determine whether or not it is A and do B when it is judged as A”. However, the case where it is not necessary to determine whether or not A is excluded.
In addition, the system or device is configured by connecting a plurality of computers, hardware, devices, and the like by communication means such as a network (including one-to-one correspondence communication connection), etc., and one computer, hardware, device. The case where it implement | achieves by etc. is included. “Apparatus” and “system” are used as synonymous terms. Of course, the “system” does not include a social “mechanism” (social system) that is an artificial arrangement.
In addition, when performing a plurality of processes in each module or in each module, the target information is read from the storage device for each process, and the processing result is written to the storage device after performing the processing. is there. Therefore, description of reading from the storage device before processing and writing to the storage device after processing may be omitted. Here, the storage device may include a hard disk, a RAM (Random Access Memory), an external storage medium, a storage device via a communication line, a register in a CPU (Central Processing Unit), and the like.

The information processing apparatus 100 according to the first embodiment performs processing related to the access right of electronic information. As shown in the example of FIG. 1, the access right setting module 110, the upper layer acquisition module 120, the access It has a right evaluation module 130, a hierarchical structure management DB 140, and an access right management DB 150.
Here, the electronic information (hereinafter also referred to as an object) includes, for example, an electronic document, a folder for storing the electronic document, a drawer, a cabinet, and the like. An electronic document is text data, in some cases electronic data such as images, moving images, audio, etc., or a combination of these, and is subject to storage, editing, search, etc., and is an individual unit between systems or users. Things that can be exchanged, including similar ones.
The electronic information has a hierarchical structure. Generally, it is adopted in a structure called a file system. Specifically, it has a hierarchical structure as shown in the example of FIG.
The access right refers to information that defines the authority regarding operations such as reading, editing, and adding to information such as users and groups.

The access right setting module 110 has an access right setting processing module 112.
The access right setting processing module 112 is connected to the upper layer acquisition module 120 and the access right management DB 150. The access right setting processing module 112 stores in the access right management DB 150 the electronic information identification information of the electronic information that is the target of the access right setting and the access right in association with each other, thereby storing the access right for the electronic information. Set. Then, the access right setting processing module 112 stores electronic information identification information (hereinafter also referred to as object ID (IDentification)) of electronic information in a higher hierarchy than the electronic information that is the target of access right setting in the hierarchical structure management DB 140. If the access right corresponding to the electronic information identification information of the electronic information close to the electronic information that is the target of the access right setting is the same as the access right to be set, The access right for the electronic information is not set. Here, “close” is determined based on the positional relationship of the hierarchical structure. Specifically, when the target electronic information is traced upward (in the direction of the route), the first “electronic information for which the access right is set” becomes “close electronic information”.
For example, the access right setting processing module 112 accesses the upper layer acquisition module 120, acquires information on its parent object and access right information from the access right management DB 150, and determines whether the access right of the parent object exists. Check. If the access right exists and the content of the access right is the same as the set content, the access right is not set. If the contents are different, an object ID is assigned and access right information is set in the access right management DB 150.

Further, the access right setting processing module 112 acquires electronic information identification information of electronic information in a hierarchy lower than the electronic information for which access right is set from the hierarchical structure management DB 140, and the acquired electronic information identification information If the access right corresponding to the electronic information identification information close to the electronic information for which the access right is set differs from the access right to be set, the access right for the electronic information of the acquired electronic information identification information Whether or not to change the setting may be confirmed with the operator.
When changing the access right, if there is electronic information that has its own access right in the electronic information at a lower level than the electronic information to be changed, the access right of the electronic information at the lower level is overwritten. Or a function for selecting whether to maintain the current state without overwriting.
Furthermore, in this case, at the top of the change, the difference between the contents of the previous access right and the new access right is extracted, and the content of the access right that has been added is added to the content of the original access right in the lower hierarchy and deleted. The change of the access right may be reflected by deleting the content of the access right thus created from the unique access right in the lower hierarchy.

  In addition, when the access right setting processing module 112 withdraws the setting after the access right is set, the access right setting processing module 112 deletes the correspondence between the electronic information identification information and the access right that has been set from the access right management DB 150. You may make it do. Here, withdrawing is to invalidate the setting (return to the state before setting, so-called UNDO function) after the setting has been made. The withdrawal only deletes the correspondence set from the access right management DB 150, and no other processing is required.

  Further, when setting the access right, the access right setting processing module 112 changes the access right according to the access right setting among the electronic information in the lower hierarchy than the electronic information that is the target of the access right setting. A range of electronic information to be performed may be presented. That is, the influence range in which the change is reflected is presented in advance, and it is possible to know in advance what the result of the change will be. Even after the access right is set, if the operator determines that it should be restored after the influence range is presented, the above-described retraction function may be used by the operation of the operator. The “range of electronic information whose access right is to be changed by the access right setting” is electronic information in a lower hierarchy than the electronic information for which the access right is to be set. This corresponds to electronic information (not including electronic information A) up to electronic information A that has been set. The electronic information A in which the unique access right setting is performed means that the access right of the electronic information A is stored in the access right management table 600. In addition, when there is no electronic information A for which an original access right is set (that is, when there is no electronic information A before a leaf in the hierarchy), “the access right is changed by the access right setting. The “range of electronic information to be” is all the electronic information in the lower hierarchy than the electronic information for which the access right is set.

The access right evaluation module 130 includes an access right acquisition module 132 and an access right evaluation processing module 134.
The access right acquisition module 132 is connected to the upper layer acquisition module 120, the access right evaluation processing module 134, and the access right management DB 150. When the access right acquisition module 132 evaluates the access right of the target electronic information from the access right management DB 150, the access right corresponding to the electronic information identification information of the target electronic information is stored. Determine whether. Here, “evaluating the access right of electronic information” means extracting the access right given to the electronic information.
For example, the access right acquisition module 132 acquires the upper object ID from the upper hierarchy acquisition module 120 and acquires the access right of the closest parent. To obtain the access right of the target object, if the access right is granted to the target object, the access right is extracted. However, if the access right is not directly granted to the target object, the access of the parent object is extracted. You will get the right.

The access right evaluation processing module 134 is connected to the access right acquisition module 132. The access right evaluation processing module 134 acquires, from the access right management DB 150, the access right corresponding to the electronic information identification information close to the target electronic information among the electronic information identification information acquired by the upper layer acquisition module 120. As a result, it is evaluated as the right to access the electronic information.
For example, the access right evaluation processing module 134 evaluates the access right and gives an authorization to the user. In other words, it is determined whether or not the user corresponds to the access right granted to the object, and if it is the corresponding user, control is performed so that electronic information can be operated according to the access right. If not, control is performed so that the electronic information cannot be operated.

The upper hierarchy acquisition module 120 is connected to the access right setting processing module 112, the access right acquisition module 132, the hierarchical structure management DB 140, and the access right management DB 150. If the access right acquisition module 132 determines that the corresponding access right is not stored, the upper layer acquisition module 120 displays the electronic information identification information of the electronic information in a higher layer than the target electronic information as the hierarchy. Obtained from within the structure management DB 140. Further, the upper hierarchy acquisition module 120 may acquire at least route identification information as electronic information identification information of electronic information in the upper hierarchy to be acquired. Here, the root indicates a root in the hierarchical structure and refers to an element located at the highest level in the hierarchical structure. Therefore, the route identification information is information for identifying the hierarchical structure, and is used for controlling access rights as an access right control ID described later, for example.
For example, the upper layer acquisition module 120 acquires all object IDs of objects belonging to the upper layer of the target object from the hierarchical structure management DB 140.

The hierarchical structure management DB 140 is connected to the upper hierarchy acquisition module 120. The hierarchical structure management DB 140 stores electronic information identification information and electronic information identification information of electronic information in a higher hierarchy than the electronic information identification information in association with each other.
For example, the hierarchical structure management DB 140 holds the object ID of an object positioned higher in the hierarchy for each object ID. As a specific example, there is a hierarchical structure management table 700. FIG. 7 is an explanatory diagram showing an example of the data structure of the hierarchical structure management table 700. The hierarchical structure management table 700 includes an object ID column 710, a hierarchical depth column 720, a hierarchical level 1 column 731, a hierarchical level 2 column 732, a hierarchical level 3 column 733, a hierarchical level 4 column 734, and a hierarchical level 5 column 735. doing. The object ID column 710 stores an object ID. The hierarchy depth column 720 stores the hierarchy depth of the object. The “hierarchy depth” is the number of nodes counted from the root in the hierarchical structure. For example, the one at the root is “1” (hierarchy level 1), the child node of the root is “2” (hierarchy level 2), and the grandchild node of the root is “3” (hierarchy level 3). The hierarchy level 1 column 731 stores the object ID of the object at the hierarchy level 1. That is, the root object ID is stored. The hierarchy level 2 column 732 stores the object ID of the object at the hierarchy level 2. The hierarchy level 3 column 733 stores the object ID of the object at the hierarchy level 3. The hierarchy level 4 column 734 stores the object ID of the object at the hierarchy level 4. The hierarchy level 5 column 735 stores the object ID of the object at the hierarchy level 5.
For example, the object ID: 11116 (the 6th line of the hierarchical structure management table 700) has a hierarchy depth of 3, and as the parent of the object ID: 11116, 11116 ( This indicates that there are the hierarchy level 3 column 733), 11113 (hierarchy level 2 column 732), and 11111 (hierarchy level 1 column 731).

The access right management DB 150 is connected to the access right setting processing module 112, the upper layer acquisition module 120, and the access right acquisition module 132. The access right management DB 150 stores electronic information identification information, which is information for identifying electronic information, and an access right assigned to the electronic information in association with each other. Further, the access right management DB 150 stores route identification information, which is information for identifying the root of the hierarchy, as electronic information identification information, and may store at least an access right corresponding to the route identification information.
For example, the access right management DB 150 holds access right control ID, object ID, and access right information. As a specific example, there is an access right management table 600. FIG. 6 is an explanatory diagram showing an example of the data structure of the access right management table 600. The access right management table 600 has an access right control ID column 610, an object ID column 620, and an access right column 630. The access right control ID column 610 stores an access right control ID. Here, the access right control ID is information for identifying the root of the hierarchy, and is one piece of information for controlling the access right, and corresponds to the route identification information in this embodiment. . The object ID column 620 stores an object ID. The access right column 630 stores the contents of the access right.
For example, the object ID: 11113 under the access right control ID: 000 has, as the access right, “User belonging to the first sales department is Read only access right”, “C member is all access ok access right. ". In the present embodiment, the sales department is described as an example. However, for example, there is a hierarchical structure for managing electronic information of the development department of another organization, and if the management system is identified, the route identification information is set to 001, It can be used as an access right control ID.
Note that the access right management table 600 has the access right control ID column 610, but the access right control ID column 610 is not necessary if the process is related to the access right in one hierarchical structure.

FIG. 2 is an explanatory diagram illustrating an example of a system configuration for realizing the first embodiment.
The document management apparatus 200, PC 250A, PC 250B, and PC 250C are connected to each other via a communication line 299. The document management apparatus 200 includes a document management module 210, an access right management module 220, and a document DB 230. The access right management module 220 corresponds to the information processing apparatus 100 illustrated in FIG. The document management module 210 stores / manages electronic documents and the like in the document DB 230.
The PC 250 </ b> A and the like perform operations such as reading, editing, and addition via the document management module 210 with respect to the electronic document in the document DB 230 of the document management apparatus 200 by the operation by the user. At that time, the access right management module 220 evaluates the access right given to the electronic document or the like, and determines whether or not the user can perform the operation. If it is determined that the access right management module 220 can do this, the PC 250A or the like operated by the user performs processing corresponding to the operation via the document management module 210, and the result is displayed on the PC 250A or the like. When it is determined that the access right management module 220 cannot be used, the message indicating that the access right management module 220 cannot perform the operation is displayed on the PC 250A or the like that the user has operated.

FIG. 3 is a flowchart illustrating a processing example according to the first exemplary embodiment. This flowchart shows an example of processing for setting an access right.
In step S302, the access right setting processing module 112 acquires the object ID of the access right setting target object.
In step S304, the access right setting processing module 112 acquires access right information from the object ID and the access right control ID. For example, the access right set by the operation of the access right manager is acquired.

In step S306, the access right setting processing module 112 stores the new access right acquired in step S304 in the access right management DB 150 in order to set the access right corresponding to the access right control ID and the object ID. In the access right management table 600 of the access right management DB 150, the access right for the object is set by storing the object ID of the object for which the access right is set and the access right in association with each other.
However, the object ID of the object at a higher level than the object for which the access right is set is acquired from the hierarchical structure management table 700 (hierarchy level 1 column 731, hierarchy level 2 column 732, hierarchy level 3 column 733, etc.). To do. Among the acquired object IDs, an access right corresponding to an object close to the object for which the access right is set (of course, an object whose access right is stored in the access right management table 600) is to be set. If the access right is the same, the access right for the object is not set. “Close to the object whose access right is to be set” means from the right side of the hierarchy level 1 column 731, the hierarchy level 2 column 732, the hierarchy level 3 column 733, etc. (hierarchy level 5 column). (From 735 side) The acquired object IDs may be applied in order.
In this flowchart, the access right control ID is used. However, if the access right is set in one layer, the access right control ID is not necessary, and processing can be performed using only the object ID. Good.

FIG. 4 is a flowchart illustrating a processing example according to the first exemplary embodiment. This flowchart shows an example of processing for evaluating access rights. This flowchart is a process in the case where the access right corresponding to the object ID of the target object is not stored in the access right management table 600 when the access right of the target object is evaluated. Of course, when stored in the access right management table 600, the stored access right is the access right of the target object.
In addition, although it demonstrates using access right control ID, since access right control ID respond | corresponds to a hierarchy, when processing within one hierarchy, access right control ID is ID (fixed) which shows the hierarchy It is.

In step S402, the access right acquisition module 132 acquires the object ID and access right control ID of the access right evaluation target object. For example, when the user selects an object to be operated, the object ID and access right control ID assigned to the object are acquired.
In step S404, the upper layer acquisition module 120 acquires a list of upper object IDs. The object ID of the object in the upper hierarchy of the access right evaluation target object is acquired from the hierarchical structure management table 700. That is, the access right evaluation target object is searched from the object ID column 710, a numerical value is extracted from the depth column 720 of the hierarchy of the corresponding row, and the numerical value (in the example of the hierarchical structure management table 700 in FIG. 7, numerical value -1). A list of object IDs is generated. For example, when the object ID of the access right evaluation target object is “11116”, “11111” and “11113” are acquired from the hierarchy level 1 column 731 and the hierarchy level 2 column 732. Here, the list is generated in order from the closest to the access right evaluation object. That is, the order in the list is “11113” and “11111”.

In step S406, the access right acquisition module 132 acquires the object ID from the list.
In step S408, the upper layer acquisition module 120 acquires access right information from the object ID and the access right control ID. It is determined whether or not the access right corresponding to the object ID and the access right control ID is stored in the access right management table 600. Of course, if there is no corresponding object ID and access right control ID line in the access right management table 600, the access right cannot be acquired.
In step S410, the upper hierarchy acquisition module 120 determines whether or not the access right exists. If it exists, the process proceeds to step S414, and otherwise the process proceeds to step S412.
In step S412, the upper hierarchy acquisition module 120 repeats the processing from step S406 until no object ID exists from the list, and if it does not exist, the process proceeds to step S414.

In step S414, the access right is evaluated. That is, the access right when it is determined in step S410 that the access right exists is the access right of the access right evaluation object.
In this flowchart, the access right control ID is used. However, if the access right is evaluated in one hierarchy, the access right control ID is not necessary, and processing can be performed using only the object ID. Good.

When exiting the repeated processing from step S406 to step S412, the access right management DB 150 determines the access right control ID (route identification which is information for identifying the root of the hierarchy) in order to exit at step S410. Information) is stored as an object ID, and at least an access right corresponding to the access right control ID is stored. That is, the access right is set to the root of the hierarchy. Specifically, there is a root object ID in the access right management table 600, and the access right corresponding to it is stored. As a result, at least the root access right is set for the objects included in this hierarchy.
In other words, even if the access right is not set for an object (an object other than the root) that is higher than the target object (there is no corresponding object in the access right management table 600), the object is finally assigned to the root. The set access right is the access right of the target object.
Therefore, the upper hierarchy acquisition module 120 acquires at least the route identification information as electronic information identification information of electronic information in the upper hierarchy to be acquired.

FIG. 5 is an explanatory diagram illustrating a processing example according to the first exemplary embodiment. Here, a hierarchical example showing the relationship between objects is shown.
An access right control ID 512 is assigned to the sales department cabinet 510. Below the sales department cabinet 510 is a sales department drawer 520.
Below the sales department drawer 520 are a Tokyo district folder 532 and a Kanagawa district folder 536. An object ID 534 is assigned to the Tokyo district folder 532. Below the Tokyo district folder 532 are an AA Corporation folder 542 and a BB Corporation folder 544.
An object ID 546 is assigned to the BB Corporation folder 544. Below the BB Corporation folder 544 is a person in charge: sales department C folder 556.
Person in charge: Sales department C folder 556 is assigned an object ID 558. Person in charge: Sales department C folder 556 stores electronic document 578 and electronic document 580.
Below the AA Corporation folder 542 are a person in charge: sales department A folder 552 and a person in charge: sales department B folder 554. Person in charge: Sales document A folder 552 stores electronic document 572 and electronic document 574. Person in charge: Sales department B folder 554 stores an electronic document 576.
Below the Kanagawa district folder 536 is a CC Corporation folder 548. Below the CC Corporation folder 548 is a person in charge: sales department D folder 560 and a person in charge: sales department E folder 562. Person in charge: Sales document D folder 560 stores electronic document 582 and electronic document 584. Person in charge: Sales document E folder 562 stores electronic document 586 and electronic document 588.
In addition, as an example, the Tokyo district folder 532, the BB corporation folder 544, and the person in charge: the sales staff C folder 556 are given as objects having an object ID. However, other folders, electronic documents, and the like are also used as objects. An ID is given.

A specific example of access right evaluation will be described using the examples of FIGS.
(1) Sales department member A belongs to the first sales department. That is, the access right granted to the first sales department is also applied to the sales staff A.
(2) In this case, when accessing the Tokyo district folder 532 shown in the example of FIG. 5, the first sales department is allowed all access rights from the first line of the access right management table 600 shown in the example of FIG. ok), the sales staff member A can also access.
(3) When accessing the AA Corporation folder 542, it is found from the access right management table 600 shown in the example of FIG. 6 that no access right is set for the AA Corporation folder 542.

(4) In this case, the access right of the Tokyo district folder 532 is applied in order to acquire and evaluate the access right of the Tokyo district folder 532 which is the parent folder of the AA Corporation folder 542, and the sales staff A can access it. .
Specifically, those in the hierarchy higher than the AA Corporation folder 542 are extracted from the hierarchical structure management table 700. An access right is stored in the access right management table 600, and a thing close to the AA Corporation folder 542 (Tokyo district folder 532) is specified. Then, the access right corresponding to the Tokyo district folder 532 is acquired from the access right management table 600. The access right is set as the access right for the AA Corporation folder 542.

(5) When the person in charge: the sales department C folder 556 is accessed, the access right of the parent folder BB Corporation folder 544 is assigned to the first sales department: Read only (the third line of the access right management table 600). Since it is set, the access right other than reading is restricted for the member A.
Specifically, the person in charge: the sales department C folder 556 is extracted from the sixth line of the hierarchical structure management table 700 (the BB corporation folder 544 with object ID: 1113 and the object ID 534 with object ID: 1111). To do. Among these, the access right is stored in the access right management table 600, and the person in charge: the sales department C folder 556 (BB Corporation folder 544) is specified. Then, the access right corresponding to the BB corporation folder 544 is acquired from the third line of the access right management table 600. The access right is assumed to be the access right of the person in charge: sales department C folder 556.

FIG. 8 is a conceptual module configuration diagram of a configuration example according to the second embodiment.
In addition, the same code | symbol is attached | subjected to the site | part of the same kind as 1st Embodiment, and the overlapping description is abbreviate | omitted.
The information processing apparatus 100 includes an access right setting module 110, an upper layer acquisition module 120, an access right evaluation module 130, a hierarchical structure management DB 140, an access right management DB 150, and an access right organization module 860.
The access right setting processing module 112 may store the date and time when the access right is set in the access right management DB 150 in addition to the processing of the access right setting processing module 112 of the first embodiment. As a specific example, there is an access right management table (change history) 900 in the access right management DB 150. FIG. 9 is an explanatory diagram showing an example of the data structure of the access right management table (change history) 900. The access right management table (change history) 900 has an access right control ID column 910, an object ID column 920, an access right column 930, and a change date / time column 940. The access right control ID column 910, the object ID column 920, and the access right column 930 are respectively an access right control ID column 610, an object ID column 620, and an access right column 630 in the access right management table 600 shown in the example of FIG. Is equivalent to The change date / time column 940 stores the date / time (year, month, day, hour, minute, second, second or less, or a combination thereof) when the access right is set.
Then, the access right setting processing module 112 may present a history of access right setting based on the date and time stored in the access right management DB 150.

The upper layer acquisition module 120 is connected to the access right setting processing module 112, the access right acquisition module 132, the hierarchical structure management DB 140, the access right management DB 150, and the access right rearrangement module 860.
The access right management DB 150 is connected to the access right setting processing module 112, the upper layer acquisition module 120, the access right acquisition module 132, and the access right rearrangement module 860.
The access right organizing module 860 is connected to the upper layer acquisition module 120 and the access right management DB 150. When the access right arrangement module 860 detects that the electronic information has been deleted, the access right management module 860 deletes the correspondence between the electronic information identification information of the electronic information and the access right from the access right management DB 150, and the electronic information from the hierarchical structure management DB 140. The electronic information identification information of is deleted. For example, this processing may be performed every time electronic information is deleted, or even if electronic information is deleted, it is not immediately reflected in the access right management DB 150 and the hierarchical structure management DB 140. The access right management DB 150 and the hierarchical structure management DB 140 may be maintained at the time of starting the embodiment or every predetermined period.

  Note that the hardware configuration of the computer on which the program according to the present embodiment is executed is a general computer, specifically, a personal computer, a computer that can be a server, or the like, as illustrated in FIG. That is, as a specific example, the CPU 1001 is used as a processing unit (arithmetic unit), and the RAM 1002, the ROM 1003, and the HD 1004 are used as storage devices. For example, a hard disk may be used as the HD 1004. CPU 1001 that executes programs such as an access right setting module 110, an access right setting processing module 112, an upper layer acquisition module 120, an access right evaluation module 130, an access right acquisition module 132, an access right evaluation processing module 134, and an access right rearranging module 860. A RAM 1002 for storing the program and data, a ROM 1003 for storing a program for starting the computer, an HD 1004 as an auxiliary storage device, and a user operation on a keyboard, mouse, touch panel, and the like. A receiving device 1006 for receiving data, an output device 1005 such as a CRT or a liquid crystal display, and a communication line interface for connecting to a communication network such as a network interface card. Scan 1007, and, and a bus 1008 for exchanging data by connecting them. A plurality of these computers may be connected to each other via a network.

Among the above-described embodiments, the computer program is a computer program that reads the computer program, which is software, in the hardware configuration system, and the software and hardware resources cooperate with each other. Is realized.
Note that the hardware configuration illustrated in FIG. 10 illustrates one configuration example, and the present embodiment is not limited to the configuration illustrated in FIG. 10, and is a configuration capable of executing the modules described in the present embodiment. I just need it. For example, some modules may be configured by dedicated hardware (for example, ASIC), and some modules may be in an external system and connected via a communication line. A plurality of systems shown in FIG. 5 may be connected to each other via communication lines so as to cooperate with each other. In particular, in addition to personal computers, information appliances, copiers, fax machines, scanners, printers, and multifunction machines (image processing apparatuses having two or more functions of scanners, printers, copiers, fax machines, etc.) Etc. may be incorporated.

The program described above may be provided by being stored in a recording medium, or the program may be provided by communication means. In that case, for example, the above-described program may be regarded as an invention of a “computer-readable recording medium recording the program”.
The “computer-readable recording medium on which a program is recorded” refers to a computer-readable recording medium on which a program is recorded, which is used for program installation, execution, program distribution, and the like.
The recording medium is, for example, a digital versatile disc (DVD), which is a standard established by the DVD Forum, such as “DVD-R, DVD-RW, DVD-RAM,” and DVD + RW. Standard “DVD + R, DVD + RW, etc.”, compact disc (CD), read-only memory (CD-ROM), CD recordable (CD-R), CD rewritable (CD-RW), Blu-ray disc ( Blu-ray Disc (registered trademark), magneto-optical disk (MO), flexible disk (FD), magnetic tape, hard disk, read-only memory (ROM), electrically erasable and rewritable read-only memory (EEPROM (registered trademark)) )), Flash memory, Random access memory (RAM) SD (Secure Digital) memory card and the like.
The program or a part of the program may be recorded on the recording medium for storage or distribution. Also, by communication, for example, a local area network (LAN), a metropolitan area network (MAN), a wide area network (WAN), a wired network used for the Internet, an intranet, an extranet, etc., or wireless communication It may be transmitted using a transmission medium such as a network or a combination of these, or may be carried on a carrier wave.
Furthermore, the program may be a part of another program, or may be recorded on a recording medium together with a separate program. Moreover, it may be divided and recorded on a plurality of recording media. Further, it may be recorded in any manner as long as it can be restored, such as compression or encryption.

DESCRIPTION OF SYMBOLS 100 ... Information processing apparatus 110 ... Access right setting module 112 ... Access right setting processing module 120 ... Upper layer acquisition module 130 ... Access right evaluation module 132 ... Access right acquisition module 134 ... Access right evaluation processing module 140 ... Hierarchical structure management DB
150 ... Access right management DB
200 ... Document management apparatus 210 ... Document management module 220 ... Access right management module 230 ... Document DB
250 ... PC
860 ... Access right control module

Claims (8)

The access right of the target electronic information is evaluated from the first storage means that stores the electronic information identification information, which is information for identifying the electronic information, and the access right assigned to the electronic information. A determination means for determining whether or not an access right corresponding to the electronic information identification information of the target electronic information is stored;
If it is determined by the determining means that the corresponding access right is not stored, the electronic information identification information of the electronic information in a higher hierarchy than the electronic information of interest is obtained as the electronic information identification information and the electronic information identification Obtaining means for obtaining from the second storage means for storing the electronic information identification information of the electronic information in a higher hierarchy than the information in correspondence;
Of the electronic information identification information acquired by the acquisition means, an access right corresponding to the electronic information identification information close to the target electronic information based on the positional relationship of the hierarchical structure is stored in the first storage means. by obtained from an evaluation means for evaluating the access rights of the electronic information and the subject,
Setting means for setting an access right for the electronic information by storing the electronic information identification information of the electronic information to be set for the access right in association with the access right in the first storage means
Comprising
The setting means acquires electronic information identification information of electronic information in a higher hierarchy than electronic information that is a target of access right setting from within the second storage means, and among the acquired electronic information identification information, The access right for the electronic information is not set when the access right corresponding to the electronic information identification information close to the electronic information for which the access right is set is the same as the access right to be set. Information processing device. The first storage means stores, as electronic information identification information, route identification information that is information for identifying a route of the hierarchy, and stores at least an access right corresponding to the route identification information,
The information processing apparatus according to claim 1, wherein the acquisition unit acquires at least the route identification information as electronic information identification information of electronic information in a higher hierarchy to be acquired. When it is detected that the electronic information has been deleted, the correspondence between the electronic information identification information of the electronic information and the access right is deleted from the first storage means, and the electronic information of the electronic information is deleted from the second storage means the information processing apparatus according to claim 1 or 2, characterized by further comprising a deleting means for deleting the identification information. The setting means acquires electronic information identification information of electronic information in a lower hierarchy than electronic information that is a target of access right setting from within the second storage means, and among the acquired electronic information identification information, If the access right corresponding to the electronic information identification information close to the electronic information targeted for the access right setting is different from the access right to be set, the access right for the electronic information of the acquired electronic information identification information is set. The information processing apparatus according to any one of claims 1 to 3 , wherein an operator confirms whether or not to change. In the case where the setting is withdrawn after the setting of the access right is performed by the setting unit, the correspondence between the electronic information identification information for which the setting has been performed and the access right is deleted from the first storage unit. The information processing apparatus according to any one of claims 1 to 4 . When the access right is set by the setting means, the electronic information whose access right is changed by the access right setting among the electronic information in the lower hierarchy than the electronic information that is the target of the access right setting. The information processing apparatus according to any one of claims 1 to 5 , further comprising a presentation unit that presents a range of information. The setting means stores the date and time when the access right is set in the first storage means,
Based on the date and time stored in the first storage means, any one of claims 1 to 6, characterized in that the setting of access rights comprises a second presentation means further presents the history made The information processing apparatus according to one item. Computer
The access right of the target electronic information is evaluated from the first storage means that stores the electronic information identification information, which is information for identifying the electronic information, and the access right assigned to the electronic information. A determination means for determining whether or not an access right corresponding to the electronic information identification information of the target electronic information is stored;
If it is determined by the determining means that the corresponding access right is not stored, the electronic information identification information of the electronic information in a higher hierarchy than the electronic information of interest is obtained as the electronic information identification information and the electronic information identification Obtaining means for obtaining from the second storage means for storing the electronic information identification information of the electronic information in a higher hierarchy than the information in correspondence;
Of the electronic information identification information acquired by the acquisition means, an access right corresponding to the electronic information identification information close to the target electronic information based on the positional relationship of the hierarchical structure is stored in the first storage means. by obtained from an evaluation means for evaluating the access rights of the electronic information and the subject,
Setting means for setting an access right for the electronic information by storing the electronic information identification information of the electronic information to be set for the access right in association with the access right in the first storage means
Function as
The setting means acquires electronic information identification information of electronic information in a higher hierarchy than electronic information that is a target of access right setting from within the second storage means, and among the acquired electronic information identification information, If the access right corresponding to the electronic information identification information close to the electronic information for which the access right is set is the same as the access right to be set, the access right for the electronic information is not set.
An information processing program characterized by that .

Images