JPH06175842A - Integrated document processor - Google Patents

Abstract

PURPOSE:To easily prevent document data from being unexpectedly edited and erased. CONSTITUTION:This integrated document processor to be shared document processing such as the preservation, editing, reading and transmission/reception of document data among plural users by providing function parts such as a preservation part 5 for preserving the document data, an editing part 8 for editing the data, a printing part 9 for printing out the data, a reading part 10 for reading and inputting the data and a communication part 11 for exchanging the data with the outside and a central processing unit (CPU) 3 for controlling these function parts is provided with a document attribute managing part 17 for adding a document protection attribute showing whether document processing is permitted or not when preserving the document data in the preservation part 5 and a document managing part 18 for regulating the document processing of the document data according to the added document protection attribute. Thus, the condition of erroneously erasing the data can be prevented only by adding the document protection attribute showing whether the document processing is permitted or not corresponding to the importance of the document or the like on the stage of preserving the document data.

Description

Detailed Description of the Invention

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention has a document processing function of storing, editing, reading, transmitting and receiving data such as images and texts (generally, image data, code data or composite data thereof), The present invention relates to an integrated document processing device shared by a plurality of users. So the database,
Not only groupware but also a stand-alone device such as a filing device or DTP (desktop publishing) can be applied as long as the device can be used by a plurality of users.

[0002]

2. Description of the Related Art When an unspecified number of people use the document data stored in a document data storage / editing device such as a conventional filing device or DTP, the stored document is locked by inputting a personal identification number. Unless it is applied, the document data can be freely subjected to document processing such as editing, copying, and deleting. However, some documents require confidentiality and importance, and cannot be shared uniformly. Therefore, it is necessary to take protection management measures such as locking the document data with a personal identification number.

[0003]

However, if the document data is locked, a user who does not know the personal identification number cannot use it at all, and it becomes impossible to share the document. Further, even if the document is locked, it is possible that the original document data is mistakenly deleted or a mistake is made such as editing and storing. Therefore, it is difficult to protect the original document and prevent the document from being changed due to a mistake with the simple lock method.

In the case of a lock method using a personal identification number,
It is necessary to store or record the personal identification number for each document, and to provide the access right to another user, it is necessary to give the personal identification number. Further, when documents are shared via a LAN (Local Area Network) or the like, such document management cannot be performed for many documents. Therefore, it is desired to make it easy to identify the users who can access a certain document, simplify the document management, and achieve strong document protection.

Furthermore, when a document is generated by a filing device or DTP, the document is accumulated in the storage device unless the documents are regularly organized, and as a result, the disk becomes full. However, the storage device cannot be effectively used. However, the amount of work involved in regular document organization is enormous.

[0006]

A storage unit for storing document data, an editing unit for editing data, a printing unit for printing and outputting data, a reading unit for reading and inputting data, and transmitting and receiving data to and from the outside. In an integrated document processing device comprising functional units such as a communication unit and a central processing unit for controlling these functional units, document processing such as storing, editing, reading, and transmitting / receiving document data is shared by a plurality of users, Claim 1
In the invention described above, a document attribute management unit for adding a document protection attribute indicating permission / prohibition regarding document processing such as reference, editing, and copying when the document data is stored in the storage unit is provided, and the document data is added according to the added document protection attribute. A document management unit that regulates the document processing of

According to the second aspect of the present invention, a user access right level management unit for setting a level of document access right for each user and storing it in the storage unit, and a user access right level management unit for storing document data in the storage unit. A document access right level management unit that sets the level of the document access right for each document data and stores it in this storage unit is provided, and the level of the document access right of the user and the document access of the stored document data A document access right collation unit that collates with the level of authority is provided, and a document access right collation unit that determines whether or not to permit access of the document data to the user according to the collation result.

According to a third aspect of the invention, in the second aspect of the invention, there is provided a group access right management section for setting document access rights for each group of a plurality of specific users and storing them in the storage section. When the document data is stored in the storage unit, the level of the document access right is set for each document data, the group access right is set, and the document access right level management unit is stored in the storage unit. The document management unit is configured to allow only the users who belong to the group having the access right to access the document data.

According to a fourth aspect of the present invention, in the first aspect of the invention, the document attribute management unit is provided with a document protection attribute whose expiration date can be freely set, and the set expiration date is managed to reach the expiration date. A document protection monitoring unit that deletes the corresponding document data itself or the document protection attribute is provided.

According to the invention of claim 5, claim 2 or 3
In the invention described above, an expiration date and a level changeable access right level management unit are set for the set document access right level, and the set expiration date is managed to manage the document access right when the expiration date is reached. A document protection monitoring unit that changes the level is provided.

[0011]

According to the first aspect of the present invention, at the stage of storing the document data in the storage unit, the document protection attribute indicating the permission / prohibition regarding the document processing such as reference, editing and copying is stored according to the importance of the document. A situation in which a confidential document is protected by being added by the management unit and by restricting the document processing of the document data according to the added document protection attribute by the document management unit, and it is accidentally deleted or transformed by editing. Can be prevented.

According to the second aspect of the present invention, the level of the document access right is set for each user and each document, and the access right level of the user at the time of use and the target document. Since the permission or denial of access is determined by comparing it with the access right level of the data, it is possible to store it by giving the access right only to specific users when creating the document data, and hiding the document data from third parties. It is possible to easily and surely have a security effect such as the following.

According to the third aspect of the present invention, a group access right is set as a document access right for each group of a plurality of specific users, and the group access right to which the user belongs at the time of use is targeted. It is possible to protect and distribute the document data in group units, as it is permitted if the group access right set in the document data matches and it matches and it is permitted. Document management will be possible.

In the invention described in claim 4, claim 1
Regarding the described invention, a document attribute management unit in which the expiration date can be freely set for the document protection attribute is set, and the expiration date set by the document protection monitoring unit is managed to correspond to the document data itself or the document protection attribute when the expiration date is reached. Since it was deleted, it is possible to automatically delete the document and release the security at the expiration date by the setting process when creating the document data, which can reduce the document management work and enable the storage unit. It can be utilized.

Similarly, in the invention described in claim 5,
In the invention according to claim 2 or 3, an expiration date and a level changeable access right level management unit are set for the set document access right level, and the expiration date set by the document protection monitoring unit is managed. By changing the level of the document access right corresponding to the expiration of the deadline, it is possible to take flexible measures such as automatically increasing the openness of the document data later by the setting process when creating the document data. The characteristics of the integrated document processing device shared by an unspecified large number can be fully exhibited.

[0016]

DESCRIPTION OF THE PREFERRED EMBODIMENTS An embodiment of the present invention will be described with reference to the drawings. First, the overall configuration will be described with reference to FIG. The integrated document processing device 1 is connected to, for example, a LAN 2 and shared by an unspecified number of users, and is controlled by a CPU (central processing unit) 3 as a central part. Each functional unit is connected to the CPU 3 via a bus line 4. Here, as a basic configuration, a storage unit 5 that stores document data, a word processor that edits data, an editing unit 8 that includes an input unit 6 and a display unit 7 with a DTP configuration, a printing unit 9 that prints out data, and data. Reading unit 1 for reading and inputting
0, a communication unit 11 for transmitting and receiving data to and from the outside is connected to the CPU 3 by the bus line 4. A LAN transmission unit 12 is interposed between the LAN 2 and the LAN 2. Thereby, as a basic operation, it has a document processing function of storing, editing, reading, transmitting and receiving document data, and these data can be shared by a plurality of users.

In this embodiment, however, the storage unit 5 is additionally configured as follows. First, in the storage unit 5, three files 13 to 15 are prepared. The file 13 is for storing document attributes and document access right level information in addition to original document data. File 14 is for user access right management file,
The file 15 is for a group access right management file. A document access right level management unit 16, a document attribute management unit 17, and a document management unit 18 are connected to the file 12 and the CPU 3 (bus line 4).

The document management unit 18 manages document data based on image data, code data, or composite data thereof input from the editing unit 8 and the reading unit 10 so that the entire system can handle the document data. Document attribute management unit 17
Is a process for adding a document protection attribute set by the user to the document data as described later.
The document access right level management unit 16 is for the user who owns the document data to additionally set the level of the document access right set for the document data.

Further, a user access right level management unit 19 is connected between the file 14 and the CPU 3, and a group access right management unit 20 is connected between the file 15 and the CPU 3. The user access right level management unit 19 is for managing the level of the document access right set by the system administrator for each individual user. This is for managing the group access right set as the document access right for each configured group. Also, these files 13 to 15 and the CPU 3
A document access right collating unit 21 is connected between and, and a document protection monitoring unit 22 is connected between the file 13 and the CPU 3. The document access right collation unit 21 collates the access right level or group access right set for the target document data with the access right level of the user who intends to use or the group access right to which the user belongs. This is used for the final decision as to whether or not the right to access the relevant document data is permitted. The document protection monitoring unit 22 manages the document protection attribute added to the document data and the expiration date set for the document access right, and uses the document data for processing such as document data deletion.

In such a structure, first, the first aspect
A process corresponding to the described invention will be described. Document management unit 18
Then, management information such as a storage destination directory and the owning user is added to the document data created by an application device such as an image editor or a word processor. Then, in the document attribute management unit 17, the user additionally sets an arbitrary document protection attribute as shown in FIG. Here, "reference" is set as the document protection attribute.
Four document processes of "edit", "copy", and "delete" are assumed, and if the bit 1 is set for each item, "permission" is set, and if the bit 0 is set, "prohibition" is set. For example, when it is desired to prohibit "deletion" and "copying", the document protection attribute setting state as shown in Table 1 is set.

[0021]

[Table 1]

On the other hand, the case of accessing the document data for which such a document protection attribute is set will be described. When a user edits document data, a document editing program (image editor, word processor, etc.) is started. The document editing program side acquires document data and document information from the document management unit 18 through the file 13. Further, the information on the document protection attribute added to the document data is acquired from the document attribute management unit 17 through the file 13. If the settings are as shown in Table 1, attribute information such as "reference possible", "editable", "copy not possible", and "delete not possible" will be obtained. Based on these attribute information, the editing program determines that the user is disallowed (in the above example,
If "copy" or "delete" occurs, the document data is protected by prohibiting such unauthorized act. In this way, by adding a protection attribute when generating document data, and prohibiting editing or copying of the document data, the original document data is accidentally deleted or transformed by editing. Can be prevented.

Next, a process corresponding to the invention of claim 2 will be described. First, the system administrator uses the user access right level management unit 19 to set the level of the document access right of each user and stores it in the file 14.
This level is set like level 1, level 2, ..., Level n, and is weighted by the size of the numbers. That is, level 1 <level 2 <-<level n. Similarly, the level of the document access right is set also for the document data. When this level setting is performed, after the document data is created, the document protection attribute is set and added through the document attribute management unit 17 as described above, and then the document is added. The access right level of the document data is set through the access right level management unit 16 and stored in the file 13 (see FIG. 3). The level of the document access right for these users and the level of the document access right for the document data have the same meaning.

Now, a method of determining the effective access right according to the level setting of these document access rights will be described. Here, for each user and each document data, FIG.
It is assumed that the level of document access right is set as shown in. Under such a situation, processing is performed according to the flowchart shown in FIG. The document access right collation unit 21 collates the user access right level of the user who intends to use with the document access right level of the target document data, and this user owns the user access right level equal to or higher than the document access right level. If so, the user is given the access right to the document data, and the other users are not given the access right. That is, a specific third party below the level cannot access the document data, and the information is hidden. Under the level setting as shown in FIG. 4, the effective access right is determined as shown in Table 2. In the table, the "○" mark is accessible,
The "x" mark indicates that access is not possible.

[0025]

[Table 2]

In this way, if the level of access right is set in advance for each user, when document data is created,
Since it is possible to set such that access right is given only to an arbitrarily specified user, it is possible to easily give a security effect to document data.

Further, a process corresponding to the invention of claim 3 will be described. In addition to the invention described in claim 2, this is to enable a document access right to only a specific user group by forming a user group. To the document data side, the document access right level management unit 16 adds a function of setting a user group ID as information corresponding to the group access right for each document data.

First, the system administrator uses the group access right management unit 20 to set a user group ID as shown in FIG. Store in. On the other hand, when you want to give the document access right only to a specific user group when creating certain document data,
As shown in FIG. 6B, the user group ID is used for the document data using the document access right level management unit 16.
Is set and stored in the file 13. At this time, needless to say, a single user group may be used, but a plurality of user groups may be set at the same time, and access rights may be simultaneously given to the plurality of user groups.

The determination of the effective access right of the document data under the situation where the group access right is set in this way will be described with reference to the flowchart shown in FIG. First, the document access right collating unit 21 collates the user group ID additionally set to the document data through the document access right level managing unit 16 with the user group ID to which the user who intends to use belongs. Only when they match, access is allowed for the time being, and access to users who belong to non-matching user groups is prohibited. In the case of a match, as described above, the level of the document access right and the level of the user's access right are further compared and collated to finally decide whether or not the user can access the document data. With the level and the user group ID set as shown in FIG. 6, the effective access right is determined as shown in Table 3. In this case as well, in the table, “◯” indicates that access is possible, and “x” indicates that access is not possible.

[0030]

[Table 3]

Therefore, when it is desired to permit specific document data only to users who belong to a specific group, it can be easily realized by setting the group access right in this way. Various and flexible document management such as protection / management and distribution is possible. At this time, by setting the level of the user access right together with the group access right and deciding whether or not the effective access right is permitted, more detailed document protection management becomes possible.

A process corresponding to the inventions of claims 4 and 5 will be described. This is such that the expiration date can be freely set for the document protection attribute and the document access right level as described above, and the expiration date can be managed. Here, as one of the document protection attributes, FIG.
As shown in FIG. 5, "automatic deletion" is added, and it has a function of automatically deleting expired document data. Further, as described above, the document attribute management unit 1
7 and the document access right level management unit 16 are shown in FIG.
As shown in (a) and (b), a function for setting an expiration date is added.

Therefore, after the document data is created, the document attribute management unit 17 sets the document protection attribute and the expiration date in the file 13, and the document access right level management unit 16 sets the document access right level and the valid in the file 14. Set the deadline and the document access right level after the deadline. In the setting example shown in FIG. 8, for example, the current date is set to 1992/0.
The case where it is set to 8/01 is shown. The expiration date (prohibition deadline) of the attribute "edit" is 1992/10/10, and the expiration date (automatic deletion execution deadline) of the attribute "automatic deletion" is 1993/07.
/ 31, the expiration date of the document access right level "level 3" for the document doc1 is 1992/11/01 and changed to level 2, and the expiration date of the document access right level "level 2" for the document doc2 is 1993/05 / / 01, indicating that the level 1 has been changed. "-" Indicates unspecified.

Under such settings, the document protection monitoring unit 22
According to the flowchart shown in FIG. 9, the expiration date management of the document protection attribute and the document access right level is performed. First, the expiration date relating to the document protection attribute (“reference” “edit” “copy” “delete”) is checked, and if there is an expired attribute, a permission bit is set for that attribute. This means that the prohibited attribute is automatically released. For example, 1992/10 /
If the time is 10 or later, the prohibition on the attribute "edit" is released.

Next, in the document protection attribute, the expiration date for "automatic deletion" is checked. If the expiration date for automatic deletion is reached, the deletion bit for the attribute "delete" is checked, and if the permission bit is set. , Delete the document data. For example, at a time point after 1993/07/31, automatic deletion is executed. As a result, there is no need for subsequent deletion processing by the user, the operability is good, and the storage unit 5 also has a free space, and the disk full state can be prevented as much as possible. If the expiration date for automatic deletion has not been reached, or if the deletion bit is a prohibited bit even if it has been reached, the processing related to the attribute is terminated, and this time, the expiration date of the document access right level is checked and the expiration date is reached. If there is any, the access right level after the expiration is automatically changed. In this case, since the level is changed to the lower level, that is, the confidentiality is released or reduced, the document data can be provided to a wider range of users.

Incidentally, regarding file protection management,
For UNIX, like UNIX, whole, group,
Although there is a system in which the access right (Read, Write, Execut) is set to the user, this is different from the present invention in which the attribute and the access right are set for each document which is a meaningful continuous collection of files. It is a thing.

Regarding the setting of the effective access right, trustee and IRM (Inherited
There is a method of determining the effective address right of files and directories in combination with the Rights Mask). A trustee is an access right that a user and a group set for a directory / file that they want to access, and an IRM is an access right that is set for a file and a directory itself. Therefore, what sets the effective access right by collating these trustees and IRM is different from the present invention which determines the effective access right to the document data by collating the user's access right level and the document access right level. It is a thing.

[0038]

According to the first aspect of the present invention, at the stage of storing the document data in the storage unit, a document protection attribute indicating permission / prohibition regarding document processing such as reference, editing, and copying according to the importance of the document. Is added by the document attribute management unit, and the document processing of the document data is regulated by the document management unit according to the added document protection attribute, so the confidential document is protected and the original document data is deleted by mistake. It is possible to prevent a situation in which the content is edited or transformed by editing.

According to the second aspect of the invention, the level of the document access right is set for each user and each document, and the level of the access right of the user at the time of use is set as the target. Since the permission or denial of access is determined by comparing with the access right level of the document data, it is possible to store the access right only to specific users when creating the document data, and to save it to third parties. A security effect of hiding document data can be easily and surely provided.

According to the invention described in claim 3, in addition to the invention described in claim 2, a group access right is set as a document access right for each group consisting of a plurality of specific users, and the group access right is used at the time of use. Since the access right of the group to which the person belongs matches the group access right set for the target document data, it is allowed if it matches, so the document data can be It will be possible to protect and distribute it, and various and flexible document management will become possible.

According to the invention described in claim 4, in the invention described in claim 1, an attribute management unit is provided in which the expiration date can be freely set for the document protection attribute, and the expiration date set by the document protection monitoring unit is set. Since the document data itself or the document protection attribute corresponding to the expiration date is managed and deleted, it is possible to automatically delete the document or cancel the security at the expiration date by the setting process when creating the document data. Therefore, the document management work can be reduced and the storage section can be effectively used.

Similarly, according to the invention as claimed in claim 5, in the invention as claimed in claim 2 or 3, the expiry date of the document access right level to be set and the access right level management in which the level can be freely changed can be set. Since the expiration date set by the document protection monitoring unit is managed and the level of the document access right corresponding to the expiration date is changed, the document is automatically created later by the setting process when creating the document data. It is possible to take flexible measures such as enhancing the openness of data, and it is possible to fully utilize the characteristics of the integrated document processing device shared by an unspecified number of people.

[Brief description of drawings]

FIG. 1 is a block diagram of a system showing an embodiment of the present invention.

FIG. 2 is an explanatory diagram showing how document protection attributes are added.

FIG. 3 is an explanatory diagram showing how a document access right level is added.

FIG. 4 is an explanatory diagram showing a setting example of access right levels of a user and a document.

FIG. 5 is a flowchart showing a level check process.

FIG. 6 is an explanatory diagram showing a user group ID setting example.

FIG. 7 is a flowchart showing a user group ID matching process.

FIG. 8 is an explanatory diagram showing an example of validity period addition setting.

FIG. 9 is a flowchart showing an expiration date monitoring process.

[Explanation of symbols]

 3 central processing unit 5 storage section 8 editing section 9 printing section 10 reading section 11 communication section 16 document access right level management section 17 document attribute management section 18 document management section 19 user access right level management section 20 group access right management section 21 documents Access right verification unit 22 Document protection monitoring unit

Claims (5)

[Claims] 1. A storage unit for storing document data, an editing unit for editing data, a printing unit for printing out data, a reading unit for reading and inputting data, a communication unit for transmitting and receiving data to and from the outside, and the like. An integrated document processing device comprising a functional unit and a central processing unit for controlling these functional units, wherein document processing such as storage, editing, reading, and sending / receiving of document data is shared by a plurality of users. A document management unit is provided for adding a document protection attribute indicating permission / prohibition regarding document processing such as reference, editing, and copying when storing document data, and a document management unit for restricting document processing of the document data according to the added document protection attribute. An integrated document processing device characterized by being provided with. 2. A storage unit for storing document data, an editing unit for editing data, a printing unit for printing out data, a reading unit for reading and inputting data, a communication unit for transmitting and receiving data to and from the outside, and the like. In an integrated document processing device that includes a functional unit and a central processing unit that controls these functional units, and a plurality of users share document data such as storage, editing, reading, and transmission / reception of document data, A user access right level management unit that sets a document access right level in the storage unit and stores the document access right level in the storage unit; and sets the document access right level for each document data when storing the document data in the storage unit. A document access right level management unit to be stored in the storage unit is provided to check the document access right level of the user and the document access right level of the stored document data. An integrated document processing device comprising a matching document access right collating unit, and a document management unit which determines whether or not to permit access of the document data to the user according to the collation result. 3. A group access right management unit for setting document access rights for each group of a plurality of specific users and storing them in the storage unit, and storing each document data in the storage unit when storing the document data. The document access right level is set for each document and the group access right is set and stored in this storage unit as the document access right level management unit, and only the users who belong to the group having the matching group access right concerned the relevant document data. 3. The integrated document processing device according to claim 2, wherein the integrated document processing unit is a document management unit that permits the access of. 4. A document protection management unit that allows the expiration date of a document protection attribute to be freely set, manages the set expiration date, and deletes the corresponding document data itself or the document protection attribute when the expiration date is reached. The integrated document processing device according to claim 1, further comprising a monitoring unit. 5. An access right level management unit that can set the expiration date and level change freely for the set document access right level, manages the set expiration date, and manages the document access right when the expiration date is reached. 4. A document protection monitoring unit for changing the level is provided.
The integrated document processing device described.