JPH0451336A - File management processing system for computer connected to network communication network - Google Patents

Abstract

PURPOSE:To obtain high security by providing an attribute information confirmation function for a file and an access right judging function for a terminal station at each system of the file of each terminal station by clarifying the attribute of the file. CONSTITUTION:When the access of the system of individual level attached in the file 13 of its own terminal station 12 by its own terminal station 12 is confirmed by the attribute information confirmation function, the access right judging function judges the attribute level of its own station 12 as the individual level, and permits the access. When the reading access of the system of friend level attached in the file 13 of its own terminal station 12 is performed by another station 16 of friend level, both functions judge it as the same group, and the access is permitted to another station 16. Thence, when the access of the system of shared level attached in the file 13 of its own terminal station 12 are performed by another stations 14 of friend and non-friend levels (i.e. all levels), both functions permit the access of another stations 14.

Description

[Detailed Description of the Invention] [Summary] The present invention relates to a file management processing method in a computer connected to a network communication network, and the present invention provides authorization rights such as access rights to files of a computer connected to the network to the file creator. In addition to improving file security, files owned by many terminal stations can be centrally managed on a network communication network, thereby making it possible to time-share one job among many terminal stations. The purpose is to.

Attribute information intended for 1 individual level, friend level, or shared level is added to each of the various systems in the file in the own station, and the attribute information added to each of the various systems in the file is added to personal level 2 friend level or shared level. A file attribute information confirmation function that checks whether the file is at any level and whether another terminal station requesting access to the system in that file has the authority to access the system based on the attribute information. The terminal station is configured to have a function to determine the access right of the terminal station.

[Industrial application field]

The present invention relates to a file management processing method in a computer connected to a network communication network.

It has become common for computer files to be published on a network with specific conditions attached, and provided to other terminal stations even if one of the conditions is not met, across regions. This requires the development of a system that can distribute and process one job among many terminal stations while maintaining high security.

[Conventional technology]

- In large-scale computers, it is designed on the premise that it performs time-sharing processing (TSS) or operates in a stand-alone state.

For example, the TSS operating system (UNIX)
etc.), many terminal stations are operated by TSS, and access from other terminal stations is controlled by the central processing unit (CPU).
), that is, the CPU determines the password and authorizes access from the other terminal station if it has appropriate access rights.

Specifically speaking, the CPU that received the password
However, it is necessary to check whether the other terminal station that is the sender has access rights or not, and to judge the extent of access, and if it is determined that the access is appropriate, the user will It is designed to authorize the system to run.

On the other hand, standalone operating system (M
S-DO3, etc.) 2 When such computers are connected through a network communication network.

An operator of a certain computer A can delete, read and write files in another computer B connected through a network communication network.

[Problem to be solved by the invention]

Conventionally, in the case of TSS, if a password with access rights is leaked to the outside, it will allow access by an outsider, so it is difficult to deal with passwords.

Furthermore, even if a high-performance computer is used as a terminal in order to solve this problem, there will be little benefit to the system group as a whole, and this will not necessarily solve the problem.

In the case of a standalone system, the operating system is isolated and operates independently, so it is not suitable for distributed processing in which many computers are connected via a network communication network, and files of other terminal stations (computers) cannot be freely used. As a result, the systems of other terminal stations may be destroyed due to an unexpected accident or malicious intent.

The present invention was made in view of these problems,
By giving file creators authorization rights such as access rights to files on computers connected to the network, we aim to improve the security of files.
The purpose is to centrally manage files owned by many terminal stations on a network communication network, thereby making it possible to time-share one job among many terminal stations.

[Means to solve the problem]

FIG. 1 shows a basic configuration diagram of the present invention.

In the figure, 10 is a network communication network, and 2 is, for example, a public telephone line.

Reference numeral 12 denotes an own terminal station connected to the network communication network 10, which is equipped with a central processing unit (CPU) 5 (not shown), a display device, a keyboard device, and a file 13 in which various systems are recorded. There is. Each of the various systems in File 13 has individual levels as needed.

Attribute information intended for friend level or shared level is individually added.

Here, the personal level (private) refers to the own terminal station 1.
This is information that can be used (accessed by deletion, reading/writing, etc.) only in 2. Therefore, it is also information that is completely excluded from access from outside.

The friend level (friend) is information that is allowed to be used by the own terminal station 12 and other terminal stations that belong to the same group and are at the friend level. however.

Other terminal stations at the friend level can only read (read) access to this information.

The shared level (public) is information that is allowed to be used by all terminal stations connected to the work communication network. This is information that only allows reading access.

In addition, the CPU of the own terminal station 12 is equipped with a file attribute information confirmation function for confirming the attribute information of various systems in the file 13, and also determines the access rights of the terminal station requesting access. It also has a function to determine the access rights of terminal stations.

14 is a network management station, 1.6.18...
are other terminal stations connected to the network communication network, respectively. These include each configuration of the own terminal station 12 described above and the entire configuration (
It can be assumed that they are structured in the same way. That is, attribute information similar to the above is added to the various systems in the files 15, 1719, etc. that each of them owns, and the CPU of each of them has the same attribute information added.

It is equipped with a file attribute information confirmation function and a terminal station access right determination function.

However, the network management station 14 stores attribute information added to various systems in files 13, 15, 17, 19, etc. owned by many terminal stations 12, 16, 18, etc., including the own station 14. A public list is provided to collect the information and publish it on the network communication network 10. What is the content of that public list?

All terminal stations 12.14, 16.18, . . . can refer to it.

Note that each CP connected to the network communication network 10
The U (ie, the terminal station, which is a computer) is also designed to function as a distributed operating system connected to the network by logging into the network.

[For production]

For example, the various systems in the file 13 of the own terminal station 12 may be given attribute information intended for individual level, friend level or shared level as needed, and these may be provided on the public list of the network communication network 10. line a
, b, c) Published.

By doing so, the file attribute information confirmation function provided in the CPU of the own terminal station 12 and the access right determination function of the terminal station function as follows.

When the own station 12 accesses the system at the personal level in the file 13 of the own terminal station 12, the attribute information confirmation function first confirms this, and the access right judgment function
Determine the attribute level of 2.

Since the local station 12 is itself, it is at an individual level and determines that it is allowed to access the system at the individual level, such as deleting and writing, and therefore authorizes such access.

However, if another station 14.16.18 at the friend level or non-friend level accesses this, the two-way function will determine that the other station 14.16.18... does not have access rights and exclude the access. .

When another station 16 at the friend level accesses a system at the friend level in the file 13 of the own terminal station 12, 1. Both functions are the same, and the other station 16 is considered to be within the group.
It is determined that the user has read access rights, and the access is authorized.

However, other stations 1418 at the non-friend level...
When accessing 9, both functions are accessed by other stations i4, 18,
It is determined that ... does not have access rights and that access is excluded.

The system at the shared level in the file 13 of the own terminal station 12 can be shared by other stations 14 at the friend level or non-friend level (that is, all levels). When stations 1618, 1618, .

In addition, own terminal station 12 and other terminal stations 1416.18.
The attribute information given to various systems for files 13, 15, 17, 19, etc. in ... should be registered in the public list of the network management station 14, and should be registered in the public list of the network management station 14, and be at the friend and shared level. You can store or bank slash the contents of various systems.

By doing so, each shared file (system) can be centrally managed by the network management station 14. In other words, in this case, a certain terminal station refers to the public list and sends one job of a certain shared file to the network management station 1.
4 or it can be divided within its own station and distributed and executed among many terminal stations, and 2 a system group can be set up for this purpose.

In addition, each shared file is centrally managed by the network management station 14 via a public list, and some other terminal station that refers to it wishes to grant new execution rights to the system to its own terminal station. It will also be possible to submit a request to that effect.

〔Example〕

FIG. 2 shows an overall configuration diagram of this embodiment.

In the figure, numeral 10 is a network communication network, 12 is an own terminal station, 14 is a network management station, 1618.20.22.
24 is another terminal station, 1315.17.19, 21.23
．． 25 indicates a file.

The own terminal station 12 of this embodiment is equipped with a central processing unit having a function of checking attribute information of files (not shown) as well as a file 13 storing a system of various programs, and a function of determining access rights of the terminal station. There is. Furthermore, it is provided with a communication object for realizing data communication via the network communication network 10, and is also provided with a CRT display device and a keyboard device.

Each of the various systems stored in the file 13 of the own terminal station 12 has attribute information intended for individual level, friend level, or shared level as information representing the type thereof.

As already mentioned, the 2-personal level (private) is information that can be used (all accesses such as deletion, reading and writing) only by the own terminal station 12. Therefore, it is also information that is completely excluded from access from outside.

The friend level (friend) is information that is allowed to be used by the own terminal station and other terminal stations that belong to the same group and are at the friend level. However, this information only allows read access from other terminal stations at the friend level.

The shared level (public) is information that is allowed to be used by all terminal stations connected to the network communication network. This is information that only allows reading access.

The file attribute information confirmation function assigned to the CPU is as follows: 1. For example, when a certain password is input to the own terminal station 12 from another terminal station, the function is activated, and when the system in the file 13 designated by the password is first detected, You can search and check what level the system's attribute information is at.

On the other hand, as a terminal station access right determination function.

For example, it is activated following the file attribute information confirmation function, and determines the level of the terminal station on the password transfer side based on the clarified system attribute information. In other words, it is determined whether it is the own station 12, another station 16 within the same system group, or a general other station with no relation.

Further, in this embodiment, the network management station 14 and many other terminal stations 16 connected to the network communication network 10
, 18, 20, 22.24 will not be described in detail, but they can be considered to have at least the same mechanism 1 function as the terminal station 12 described above.

However, it goes without saying that the contents of the various systems stored in each file 17, 19.212325 are different.

Note that the network management station 14 has many terminal stations 12, 14, 16.18゜2022.24, although not shown in the figure.
Various information is provided from...

A public list is provided to publish them on the network communication network 10, and the data communication status on the network communication network 10 can be centrally managed.

In this embodiment, each terminal station 1214 1 is included in the public list.
File 13,15゜17... owned by 6,...
Among the attribute information added to each of the various systems in
Attribute information related to friend levels and shared bells is collected and provided (arrows a, b (, c').The contents of various systems to which such attribute information is added are also stored, for example, in separate files (not shown). It plays the role of a back-amplifier for files stored in each terminal station.

The network management station 14 equipped with this public list centrally manages the data communication status on the network communication network 10 refers to the public list (arrows d and e).
, f, g) It means centrally managing which system a certain terminal station wants to use, how it wants to use it, and, more specifically, how it uses it. By applying this, one system can divide one job into many terminal stations 12.14.1
It is possible to perform distributed processing (arrows, i, j, k) at 618, . . . . This point will be explained in detail later.

FIG. 3 is a diagram showing the contents of the public list.

The contents of the public list displayed on the screen will be explained sequentially starting from the left column. For example, at the beginning, file name 30 contains file names 14LE A, FILE B, FTL.
EC etc. are described. Next, attribute 31 has the above-mentioned pri
vate, public, friend, etc. are described. Next, execution 32 describes whether or not the file has been executed. Next, deletion 33 describes whether or not the file has been deleted. Next, in reading 34, it is written whether or not the file was executed and read.

Next, in write 35, it is written whether or not the file has been executed and new writing has been performed. Next, the update date 36 describes the date when the contents of the file were updated by a change command or the like. Next, the date on which the file was created is written in the creation port 37. Next, the identification number of the file creator is written in the creator TD38. In this way, the information is given to each file name and made public in the public list. Public lists can be viewed by anyone.

FIG. 4 is a diagram showing the operating situation when the network management station 14 centrally manages many files collected.

The network management station 14 owns the network communication network 1
A shared file published on 0 is first provided by the creator as the provider to the network (system) administrator.

Both have the same attribute information and one of them is used as a hack amplifier (arrow l). This makes it possible to prevent system destruction that may occur when an outsider accesses and uses the system, further enhancing and improving security.

If another terminal station 16 wants to change the contents of a shared file owned by its own end next month 12, for example, the other terminal station 16
is the arrow line that first submits a change request to the own end next month 12 m) 5
If there is no problem, the local end next month 12 has the other terminal station 16 transfer the result of the change (arrow n). At this time, the own end next month 12 also transfers the result to the network management station 14 (arrow line 0). In this way, a high level of security can be ensured since a change request will be responded to by the end of next month on December 12th.

FIG. 5 is a diagram showing the operating situation when one job in one system is processed in a distributed manner by many terminal stations 12, 14, 16, . . . connected on the network communication network 10.

A terminal station (computer) connected to the network 10 communication network functions as a distributed operating system connected to the network by logging into the network. The job execution status of each terminal station 12, 14, 16, . . . is managed by a supervisor (network management station).

If you want to execute multiple jobs at the same time in next month 12, follow the steps below.

First, check with the supervisor to see if there are any computers in the same group that are inactive (arrow p). At this time, the supervisor uses the other terminal station 16, for example.
If it is found that the computer TD is in an inactive state, the computer TD and its processing capacity will be notified to the next month 12 (arrow q). Here at the end of next month 12th,
The predetermined system is transferred to other terminal stations 16 (arrow r). Later, other terminal stations 16 start necessary operations and have the obtained processing results transferred to them (arrow S).

In this way both ends next month 12.16 network management station 1
By connecting it to 0, the throughput of the current end next month 12 is improved.

Figure 6 (A) is a diagram showing the operational status when a new file access right is obtained in a terminal station within the same system group, and Figure 6 (B) is a diagram showing the operation status when a new access right for a file is obtained in a terminal station within the same system group. FIG. 6 is a diagram illustrating an operational situation when granting execution rights.

For example, in the case of FIG. 6(A), when the own end next month 12 obtains a new access right at another terminal station 16, the own end next month 12 first accesses the network communication network 12.
A request is made to another terminal station 16 through the terminal station 16 to perform processing related to obtaining a new access right (arrow L). Here, if the other terminal station engineer 6 recognizes it as OK, the process will be executed.
, transfer the processing result to the own end next month 12 (arrow line V
). This makes it possible for the own end next month 12 to use systems owned by other stations on an individual level. High security can be obtained because other stations execute the processing themselves.

In the case of FIG. 6(B), which is the opposite position to FIG. 6(A), the right to execute the system at the individual level created by the self-end 12 is transferred to the other terminal station 16. When granting, the own end next month 12 first transfers the system to another terminal station 16 via the network communication network 10 and issues a request to execute the system (arrow X). Here, if the other terminal station 16 recognizes it as OK, it executes the process (number y) and transfers the processing result to its own end next month 12 (
Arrow 2). This makes it possible for the local station to newly grant system execution rights at the individual level to other stations. Since the own station is the one transmitting the system, its own judgment is involved, and high security can be ensured.

In this embodiment, attribute information intended for individual level, friend level, or shared level is added to various systems in files 13.15, etc. in each terminal station 12.14, etc., and passwords are transferred based on this. 14.16. Since the system determines whether or not the user has access rights such as It also makes it easier.

〔Effect of the invention〕

As explained above, according to the present invention, attribute information intended for small/large level, friend level, or shared level is added to various file systems at each terminal station, and file attributes are clarified. , the file attribute information confirmation function, and the access right determination function of the terminal station, it is possible to determine the access rights when accessing the various systems in at least three stages.

As a result, high security can be ensured, and malicious or accidental destruction of other people's files can be effectively avoided.

Furthermore, since the attribute information of such files is provided to the public list 1- of the network management station, it is possible to centrally manage various systems at the network management station.

This allows many terminal stations logged into the network to perform distributed processing on one job for one system, greatly improving the throughput of the entire system group.

In addition, by giving the file creator permission to grant new access rights to various systems between grouped terminal stations, computer independence can be increased, and in particular, system access by malicious actors can be completely excluded. .

[Brief explanation of drawings]

FIG. 1 is a diagram showing the principle configuration of the present invention. FIG. 2 is an overall configuration diagram of the embodiment. Figure 3 shows the contents of the public list. Figure 4 shows the operating status when the system is centrally managed by a network management station. Figure 5 shows the status when one job is distributed and processed by many terminal stations. FIG. 6 is a diagram showing the operating situation when changing the setting of attribute information in the system. 10...Network communication network 12...Self-end undeveloped 13.15, 17.19...File 14...Network management station 16.18...Other terminal stations

Claims (2)

[Claims] (1) The central processing unit that manages the access status of various systems in the file (13) is transferred from the network management station (14) or other terminal stations (16) (18) via the network communication network. A file on a computer connected to a network communication network that receives a password, determines whether or not the password has access rights, and if the password has access rights, allows the password to be accessed and runs the system. In the management processing method, the system is configured to add attribute information indicating the type of file intended for personal level, friend level, or shared level to each of the various systems in the file (13), and the central processing The device has a file attribute information confirmation function that checks whether the attribute information added to each of the various systems in the above file (13) is at an individual level, a friend level, or a shared level; Whether or not other terminal stations (16) and (18) to which certain passwords have been transferred in order to access the various systems to which the attribute information has been added have the right to access the various systems in view of the attribute information. connected to a network communication network, characterized in that the terminal station has an access right judgment function for determining whether or not a terminal station is allowed to execute a process accessed through the network communication network; A method for managing files on a computer. (2) The central processing unit equipped with the network management station (14) and many other terminal stations (16) (18) also includes
In addition to having the function of checking the attribute information of the above file and the function of determining the access rights of the terminal station, the terminal station (12) (16) includes the own station (14) in the public list held by the network management station (14). ) shall publish the attribute information added to the various systems in the above files (13) and (17) owned by the management station (14).
) stores the contents of various systems whose attribute information published in the public list is at a friend level or a shared level. File management processing method.