JPH04317146A - Data base security system - Google Patents

Abstract

PURPOSE:To improve maintenance, operability and security such as the unitary management and reconstitution of a data base. CONSTITUTION:A logical address bit pattern 5 corresponding to the logical address of a data part for respective users, a logical address bit pattern recognition means 7 recognizing the existence of the logical address bit pattern when the user instructs a request from a retrieval instruction device or an addition instruction device 13 to a logical file, a logical address bit pattern read means 8 reading the logical address bit pattern recognized in the logical address bit pattern recognition means, a logical address conversion means 9 fetching the logical address of the data part from the having read logical address bit pattern, a logical address acquirement means 17 which acquires the logical address of data which the addition instruction device adds, a logical address bit pattern registration means 18 where a bit corresponding to the logical address acquired in the logical address acquirement means is loaded on the logical address bit pattern are provided.

Description

[Detailed description of the invention]

0001

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to database security schemes.

0002

2. Description of the Related Art A conventional example will be explained with reference to the drawings.

FIG. 2 is a block diagram showing a conventional example at the level of program processing. Search instruction device 2 from user 213
When a search for data in the data section 203 in the logical file 202 is requested by 05, the physical address conversion means 2
06 into a physical address based on the address conversion table 204, the data search means 207 searches for data, and the search result display device 208 displays the searched contents.

When data addition is requested by the addition instruction device 209, the data writing means 210 writes the data into the data section 203, and the physical address acquisition means 2 acquires the physical address in the file of the written data.
In step 11, the physical address registration means 212 registers the physical address in the address conversion table 204 and makes it searchable.

[0005] With the method described above, the data in the logical file 202 can be searched by any user 213 and cannot be protected. Therefore, in order to ensure security, databases are created in units of security protection, even if the databases are in the same format.

[0006] FIG. 3 is a model of this, and user 3
01, even though users 302, 303, and 304 have the same database format, database information 305, 306, 307,
308 individually, and the data is also a physical file 321
Individual logical files 317, 318, 319, 3
20, address conversion tables 309, 310, 311, 312 and data section 3 in the logical file.
13, 314, 315, and 316, respectively. This method provides security, but the database is distributed.

Another method is to share database information, allocate an identifier to each user, and distinguish between logical files that store data.

FIG. 4 is a model of a database created using this method. In either case, multiple logical files are created, making maintenance complicated.

[0009]

[Problem to be Solved by the Invention] In the conventional database security protection method described above, in order for multiple users to operate a database of the same format while protecting security, it is necessary to divide the database into units of database security protection. ,
Since there are as many databases as there are divided databases, it becomes complicated to perform maintenance such as centralized management and database reconfiguration.

[0010] The purpose of the present invention is to provide a database security protection system that improves security and maintainability since there is only one database, although from the user's perspective, each database is treated as if it had its own individual database. It's about doing.

[0011]

[Means for Solving the Problems] In the method of the present invention, a plurality of logical files shared by a plurality of users are stored in one physical file, and the logical file is allocated to a data section and each data record. a search instruction device 6 for instructing a search of the data section; and when the search instruction device requests a search for the data section; Physical address conversion means 10 for obtaining a physical address in the logical file; data search means 11 for reading address data obtained by the physical address conversion means; and displaying the inside of the data read by the data search means. a search result display device 12; an addition instruction device 13 for instructing the addition of data to the data section; a data writing means 14 for writing the contents instructed by the addition instruction device into the data section; Physical address acquisition means 1 for capturing the physical address in the logical file of the data written in the data section
5, and physical address registration means 16 for registering the physical address fetched by the physical address acquisition means in the address conversion table, in the database security method in the database system, the physical address registration means 16 registers the physical address fetched by the physical address acquisition means in the address conversion table. a corresponding logical address bit pattern, and logical address bit pattern recognition means for confirming the existence of the logical address bit pattern when the user instructs a request to the logical file from the search instruction device or the addition instruction device; a logical address bit pattern reading means for reading the logical address bit pattern confirmed by the logical address bit pattern recognition means; and a logical address of the data section from the logical address bit pattern read by the logical address bit pattern reading means. a logical address conversion means for extracting the data, a logical address acquisition means for acquiring the logical address of the data added by the addition instruction device, and a bit corresponding to the logical address obtained by the logical address acquisition means in the logical address bit pattern. The present invention is characterized in that a logical address bit pattern registration means is provided.

0012

DESCRIPTION OF THE PREFERRED EMBODIMENTS Next, the present invention will be explained with reference to the drawings.

FIG. 1 is a block diagram of an embodiment of the present invention expressed at the level of program processing. In this embodiment, the physical file 1 has a logical file 2, and the logical file 2 has a data section 3, an address conversion table 4 that holds the logical address and physical address of the data section 3, and a logical address corresponding to the logical address for each user. Consists of 5 bit patterns.

Other components of this embodiment include a search instruction device 6 for instructing a search for data in the data section 3, a logical address bit pattern recognition means 7 for confirming the existence of the logical address bit pattern 5, and a logical address bit pattern. logical address bit pattern reading means 8 for reading 5;
Logical address conversion means 9 that obtains a logical address from the logical address bit pattern 5, physical address conversion means 10 that converts the obtained logical address into a physical address from the address conversion table 4, and data search means that searches the data section 3 from the physical address. 11. Search result display means 12 for displaying the content of searched data; search instruction device 13 for instructing data addition; data writing means 14 for writing the instructed data into the data section 3; obtaining the physical address of the written data. Physical address acquisition means 15, physical address registration means 16 for registering the obtained physical address in the address conversion table 4, logical address acquisition means 17 for obtaining a logical address corresponding to the registered physical address, converting the obtained logical address into a logical address. These are the logical address bit pattern registration means 18 and the database user 19, which are registered in the bit pattern 5.

FIG. 5 is a database model for explaining the present invention. In FIG. 5(1), the data section 501
constitutes one record from item 502, item 503, item 504, and item 505, and stores data from data record 506 to data record 510, each of which corresponds to a physical address 511.

The address conversion table 512 is shown in FIG.
), the logical address 513 and physical address 5
Consists of 14. Here, logical address 513 is made to correspond to data records 506 to 510.

Now, the registrants of data record 506 to data record 509 and data record 510 are as follows: data record 506 is user A, data record 507 and data record 509 is user B, data record 508 is
The data record 510 will be explained assuming that the user is C.

In this case, as shown in FIG. 5(3), the logical address bit pattern 5 of each user is a logical address bit pattern 517 for user A, a logical address bit pattern 518 for user B, and a logical address bit pattern 518 for user C. A logical address bit pattern 519 is created.

First, a case where user C searches the database will be described. The search instruction device 6 requests a database search, and the logical address bit pattern recognition means 7 recognizes that the logical address bit pattern 5 of user C exists.

Next, logical address bit pattern 519 is read by logical address bit pattern reading means 8. Read logical address bit pattern 5
19, the logical address conversion means 9 obtains 3 as the logical address corresponding to the bit being turned on.

Using the obtained logical address, the physical address translation means 10 uses the address translation table 512 to obtain addr3 as a physical address. The data at the obtained physical address is read by the data search means 11.

[0022] In the same process, addr is used as a physical address.
Obtain n and read data record 510. The process continues until there are no more ON bits in the logical address bit pattern 519, and the search result display means 12 displays the contents of the searched data record.

FIG. 6 shows the contents displayed by the search result display means 12, and FIG. 7 shows an image of the database as seen by user C.

Next, data addition will be explained with reference to FIG. Figure 5 is used as the model in the same way as in the search. Now, assume that user C adds one piece of data. The contents of the additional data are shown in FIG.

When the addition instruction device 13 instructs to add data, the logical address bit pattern recognizing means 7 confirms the existence of the logical address bit pattern 5 of the user C.

Additional data given by the addition instruction device 13 is written into the data section 901 by the data writing means 14. The physical address addrn+1 of the written data record 902 is obtained by the physical address obtaining means 15.

The obtained physical address "addrn+1" is registered in the address conversion table 904 by the physical address registration means 16, and at the same time, the corresponding logical address is obtained by the logical address acquisition means 17.

The corresponding bit of the logical address bit pattern 907 confirmed by the logical address bit pattern recognition means 7 from the obtained logical address "n+1" is turned on by the logical address bit pattern registration means 18.

FIG. 10 shows an image of the database created by the above process as seen by user C.

[0030]

[Effects of the Invention] As explained above, the present invention manages data that can be referenced by each user in a bit pattern corresponding to a logical record, so that from the administrator's perspective, one database can be managed. If possible, the maintainability and operability of the database will be improved, and from the perspective of individual users, it is equivalent to handling a completely independent database, and data can be completely protected and confidentiality can be expected to be improved.

[Brief explanation of drawings]

FIG. 1 is a configuration diagram of an embodiment of the present invention expressed at the level of program processing.

FIG. 2 is a configuration diagram of an embodiment showing a conventional example at the level of program processing.

FIG. 3 is a diagram showing a database model created using conventional technology.

FIG. 4 is a diagram showing a database model created using another conventional technique.

FIG. 5 is a diagram showing a database model for explaining the present invention.

6 is a diagram showing a display example of the results of searching for user C's data from the database model of FIG. 5; FIG.

FIG. 7 is a diagram showing the contents of a database visible to user C from the database model in the figure.

FIG. 8 is a diagram showing the contents of additional data for explaining the process of adding data to the database model shown in the figure.

FIG. 9 is a diagram showing the contents of the database after the data in FIG. 8 is added to the database model in FIG. 5;

FIG. 10 is a diagram showing the contents of the database visible to user C from the database model in FIG. 9;

[Explanation of symbols]

1 Physical file 2 Logical file 3 Data section 4 Address conversion table 5 Logical address bit pattern 6 Search instruction device 7 Logical address bit pattern recognition means 8
Logical address bit pattern reading means 9
Logical address conversion means 10 Physical address conversion means 11 Data search means 12 Search result display device 13 Addition instruction device 14 Data writing means 15 Physical address acquisition means 16 Physical address registration means 17 Logical address acquisition means 18 Logical address bit pattern registration means 19
user

Claims (1)

[Claims] [Claim 1] A plurality of logical files shared by a plurality of users are stored in one physical file, and the logical file corresponds to a data section and a logical record address assigned to each data record. and an address conversion table, and a search instruction device 6 for instructing a search of the data section, and a physical address conversion table for obtaining a physical address in the logical file when the search instruction device requests a search for the data section. an address conversion means 10, a data search means 11 for reading address data obtained by the physical address conversion means, a search result display device 12 for displaying the inside of the data read by the data search means, and the data section. an addition instruction device 13 for instructing addition of data to the data section; a data writing means 14 for writing the contents instructed by the addition instruction device into the data section;
physical address acquisition means 15 for taking in the physical address in the logical file of the data written in the data section by the data writing means; and a physical address for registering the physical address taken in by the physical address acquisition means in the address conversion table. In a database security system in a database system having a registration means 16, a logical address bit pattern corresponding to the logical address of the data section for each user, and a logical address bit pattern corresponding to the logical address of the data section by the user, logical address bit pattern recognition means for confirming the existence of the logical address bit pattern when instructing a request to a logical file; and logical address bit pattern reading for reading the logical address bit pattern confirmed by the logical address bit pattern recognition means. means and
logical address conversion means for extracting the logical address of the data section from the logical address bit pattern read by the logical address bit pattern reading means;
logical address acquisition means for acquiring a logical address of data added by the addition instruction device; and logical address bit pattern registration for turning on a bit corresponding to the logical address obtained by the logical address acquisition means in the logical address bit pattern. A database security protection method characterized by providing means.