JPH096662A - Device and method for transferring file - Google Patents

Abstract

PURPOSE: To prevent the wrong access and to improve the security by defining and limiting the directories of the accessible server file systems for every client. CONSTITUTION: A server EW has a security management data base 6 which stores a key word 61, a client host name 62 that is defined by the word 61 and a login name 63, and an access definition data base 7 which sets an accessible range of every client by a key word 71, an execution command 72 that is defined by the word 71 and a directory 73. When a user file is transferred, the server EW designates a key word. Then the server EW collates the key word with the data base 7 in the file transfer state and carries out the command 72 in a designated directory.

Description

Detailed Description of the Invention

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a file transfer method and a file transfer apparatus, and more particularly to a file transfer method and a file transfer apparatus having a security function when transferring files between computers via a computer network.

[0002]

2. Description of the Related Art In this type of computer network, there are a server for providing resources such as various functions and services and a plurality of users who are clans, and the clans are placed on the hard disk of the server. It has a so-called file sharing function that allows the above resources such as program files and data files to be accessed at the same time and executed or updated at the same time.

This file sharing function has a security function for restricting this kind of access in order to prevent inconveniences such as copying, misuse or destruction of data not directly related to the purpose by the client.

There is ftp as a conventional general file transfer device having this type of security function.

The conventional first file transfer device, ft
Referring to FIG. 5, which shows a block diagram of the configuration of p, the first conventional file transfer apparatus includes an EWS 2 for a client and an EWS for a server connected by a network 1.
WS3, ftp client program (hereinafter referred to as client) 40 existing on EWS2, ftp server program (hereinafter referred to as server) 50 including command interpreter section 51 existing on EWS3, and client user authentication existing on EWS3 And a password information database 8 for performing.

Referring to FIG. 6 showing an example of the structure of the password information database 8, the password information database 8 contains the registered name of the user, that is, the login name 81 and the password character 82.

Next, referring to FIG. 7 which is a flowchart showing a first conventional file transfer method for executing file transfer by executing FIGS. 5, 6 and ftp in a batch method, the conventional first file transfer method will be described. Explaining the method, first, the client 40 is started, and the user name, password and file name are input (step P1). ftp server 5
0 compares the user name and password character string on the password information database 8 with the user name and password character string notified from the client EWS 2 (step P
2) As a result of comparison (step P3) If the authentication fails, the client 40 is notified of the error (step P4).
The process ends without file transfer (steps P12 and P13). When the authentication is successful, the server 50 searches the file system held by the server 40 for a file corresponding to the input file name (step P
7) If it cannot be found (step P8), an error is notified to the client 40, and if found, the transfer of the file is started (steps P9 and P10). After the transfer is completed, both programs on the client 40 side and the server 50 side are ended (steps 710 and 711).

Next, the second conventional file transfer method for executing the file transfer by executing ftp in the interactive system is shown in the same flow chart in FIG. Referring to the difference between this second conventional file transfer method and the first file transfer method, the server starts the command interpreter 51 when the authentication is successful in step P3, and the prompt of the command interpreter 51 is sent to the client. To step P5, the user inputs a transfer command and a transfer target file name from the prompt displayed on the client 40, and further steps P9 and P10.
After the completion of the file transfer in step P11, if it is not confirmed whether or not there is another transfer target file, the process ends in step P12, and if there is, the process returns to step P6 and repeats steps P11 to P11.
And to add.

To deny access from other users by ftp, it is necessary to add ownership to all directory files, generate an error at step P7, and deny access to the files themselves.

As described above, the server 50 authenticates the client who is the user only when connecting to the EWS 3, and after the connection is completed, the client can basically refer to the entire file system. The client does not have a function to check the accessible directory space each time the command is executed. Although the client is authenticated using the password information database 8, the login name of this password information database 8 does not have an access restriction function only by designating the directory at the time of login, and the directory access restriction can be performed for each client. Absent.

A simplified version ftp (tftp) is available as a second conventional file transfer device for restricting access. In this conventional second file transfer apparatus, a directory accessible by the user can be set, and directories higher than the directory can be made inaccessible. This setting is equally valid for all users.

[0012]

DISCLOSURE OF THE INVENTION Problems to be Solved by the Invention
In the second file transfer method and the first file transfer device, the server program authenticates the client who is the user only when connecting to the server machine, and basically can refer to all of the file system after the connection is completed. It is possible, since it does not have a function to check the directory space accessible by the user after the above connection, and the login name of the password information database that authenticates the client has only the function to specify the directory at the time of login and does not have the access restriction function. , If different users own files in different directory spaces in the same file system, they have access to the directory space managed by other people, so there is a drawback that confidentiality cannot be maintained between users. .

It is possible to set mutual exclusion by defining ownership of directories and files, but it is very difficult to set each directory and file consistently. There was a problem.

Further, the second conventional file transfer device is
Although it has a directory access restriction function, it does not authenticate users, so access cannot be restricted on a client / user basis and data cannot be restricted on the server between different clients / users. was there.

[0015]

A file transfer apparatus according to the present invention is a client E which is connected via a network and runs a client program used by a user.
In a file transfer device including a WS and a server EWS that runs a server program including an interpreter that is a program analysis routine, the server EWS stores a keyword and a security management database storing security management information defined by the keyword, and It comprises a keyword and an access definition database for setting an accessible range for each of the client programs by the access definition information defined by the keyword.

A file transfer method according to the present invention is performed between a client EWS which is connected via a network and which runs a client program used by a user and a server EWS which runs a server program including an interpreter which is a program analysis routine. In the file transfer method, the server program includes a security management database that stores security management information and an access definition database that sets an accessible range for each of the client programs, and the user starts the client program and First, the client program inputs the first keyword and the transfer file name, and the client program adds the first client host and the user name and transmits to the server program.
And a second step of matching each of the first keyword, client host name, and user name received by the server program with the second keyword, client host name, and user name of the security management database. And a third step of comparing the definition content of the access definition database corresponding to the first keyword when it is confirmed as a formal registration client as a result of the collation, and the third step in the third step. After confirming that the keyword 1 is a correct keyword, a fourth step of replacing the defined directory with a virtual root directory that restricts access to other than the specified directory, and searching a transfer target file under the virtual root directory The fifth step of It is characterized in that in the access definition database when including a sixth step of executing a transfer command that is uniquely defined for the keyword.

[0017]

DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENT A first embodiment of the present invention will now be described with reference to FIG. 1, which is also shown in block form with common reference characters / numbers for components common to FIG. The file transfer device according to the present exemplary embodiment includes a network 1 common to the conventional one,
In addition to a client EWS 2 including a client program (hereinafter referred to as a client) 4, a server program (hereinafter referred to as a server) including an EWS 3A for a server connected to the network 1 and a command analysis routine (interpreter) 51 running on the EWS 3A. 5, a security management database 6 for security management, and an access definition database 7 defining an accessible range for each client.

Referring to FIG. 2A showing the contents of the security management database 6, the security management database 6 includes a keyword 61 and a client whose access is permitted to the server 3A defined as a set when the keyword is designated. It includes a host name 62 and a client login name 63. The server 5 collates each of the keyword, the client host name, and the client user name sent from the client 4 with these contents 61 to 63 of the security management database 6, and rejects the access request if they are not correctly registered.

Referring to FIG. 2B showing the contents of the access definition database 7 placed on the EWS 3A and the access range limited by the keywords, the access definition database 7 is defined as a set of keywords 71.
And a command 72 that is actually executed when the keyword is specified, and a directory 73 that is accessible when the command 72 is executed. In this figure, the keyword 71 “FENDE” is set for the entire file system 10.
An accessible directory range 101 when "R" is specified and an accessible directory range 102 when the keyword 71 "GIBSON" is specified are shown.

Next, the second embodiment of the present invention when the file transfer apparatus of FIGS. 1 and 2 and this embodiment is applied to the batch system.
The operation of this embodiment will be described with reference to FIG. 3, which is a flowchart showing the process of the file transfer method of the above embodiment. First, the user starts the client program 4 and inputs a keyword and a transfer file name (step S).
1). In addition to the input keyword and transfer file name, the client 4 automatically sends the client host name,
The user name is acquired, and these pieces of information are transmitted to the server 5. The server 5 collates each of the received keyword, client host name, and user name with the contents 61 to 63 of the security management database 6 (step S2). As a result of the collation (step S3), if it is not confirmed that the client is an officially registered client, an error notification is given to the client 4 (step S4), and the process ends without file transfer (step S15, S1
6). If confirmed, the notified keyword is compared with the definition contents of the access definition database (step S
7) After confirming that the keyword is correct (step S8), the defined directory is virtually replaced with the root directory (step S9). By this step S9, access to other than the specified directory is restricted. Next, the transfer file is searched under the specified directory (virtual root directory) (step S10), and if the file is found (step S1).
1) A transfer command that is uniquely defined for a keyword in the access definition database 7 is executed. In this embodiment, a command for transferring a file from the server 5 to the client 4 is activated (step S12). The client 4 receives the file transmitted from the server 5 (step S13). When the transmission / reception of the file is completed, the operation of the transfer command is completed (steps S15 and S16).

Next, the processing of the file transfer method of the third embodiment of the present invention when the file transfer apparatus of FIGS. The operation of the present embodiment will be described with reference to FIG. 4 similarly showing a flowchart with common reference characters / numerals. The file transfer method of the present embodiment shown in this figure and the first embodiment described above will be described. Is different from step S3.
If the confirmation is successful in step S5, the server 5 activates the command interpreter 51 and displays the command interpreter 51 prompt on the client in step S5, and the user selects the transfer command and the transfer target file name from the prompt displayed on the client 4. Step S6 of inputting,
Further, after the file transfer in steps S12 and S13, if it is not confirmed whether or not there is another transfer target file, the process ends in step S15, and if there is, the process returns to step S6 and the following steps S
Step S14 which repeats up to 14 is added. As a result, the keyword and the access definition file are collated each time the file is transferred.

[0022]

As described above, according to the file transfer method and the file transfer apparatus of the present invention, the keywords, the client user name, the client host name, the execution command, and the accessible directory to be paired with the keywords are previously stored in the database. It is defined and the user is obliged to use this keyword when executing file transfer. By assigning a different keyword to each client, it is possible to restrict the accessible directory for each client. .

[Brief description of drawings]

FIG. 1 is a block diagram showing a file transfer device according to a first embodiment of the present invention.

FIG. 2 is a diagram showing an example of contents of a security management database, contents of an access definition database and designation of an access range in FIG.

FIG. 3 is a flowchart showing a file transfer method according to a second embodiment of the present invention.

FIG. 4 is a flowchart showing a file transfer method according to a third embodiment of the present invention.

FIG. 5 is a block diagram showing an example of a conventional first file file transfer device.

FIG. 6 is a diagram showing an example of contents of a conventional password information database.

FIG. 7 is a flowchart showing a first conventional file transfer method.

FIG. 8 is a flowchart showing a second conventional file transfer method.

[Explanation of symbols]

 1 network 2,3 EWS 4,40 client 5,50 server 6 security management database 7 access definition database 8 password information database 51 command descriptor 61,71 keyword 62 client host name 63 client login name 72 command 73 directory

Claims (4)

[Claims] 1. A client EWS which is connected through a network and runs a client program used by a user and a server EWS which runs a server program including an interpreter which is a program analysis routine.
In the file transfer device, the server EWS stores a keyword and a security management database storing security management information defined by the keyword, and the keyword and access definition information defined by the keyword for each of the client programs. A file transfer device comprising: an access definition database for setting an accessible range. 2. The security management information includes a client host name and a client login name of an access permission target to the server program, which is defined as a set when the keyword is specified, and the access definition information specifies the keyword. 2. The file transfer device according to claim 1, further comprising a command executed corresponding to the command and a directory accessible when the command is executed. 3. A client EWS which is connected via a network and runs a client program used by a user, and a server EWS which runs a server program including an interpreter which is a program analysis routine.
In the file transfer method between the client program and the server program, the server program includes a security management database that stores security management information and an access definition database that sets an accessible range for each of the client programs. Start up first
The first keyword and the transfer file name and the client program adds the first client host and the user name to the server program, and sends the first program to the server program; and the first keyword and the client received by the server program. The second step of collating each of the host name and user name with the second keyword of the security management database and each of the client host name and user name, and as a result of the collation, it was confirmed that the client is an official registration client. In this case, a third step of comparing the definition content of the access definition database corresponding to the first keyword, and a directory defined after confirming that the first keyword is a correct keyword in the third step To a directory other than the specified directory. Access to a virtual root directory that restricts access to the file, a fifth step of searching for a transfer target file under the virtual root directory, and a keyword in the access definition database when the transfer file is found. And a sixth step of executing a transfer command uniquely defined by the file transfer method. 4. The seventh aspect of the present invention, wherein after confirming that the first keyword is a correct keyword in the third step, the server program starts the command interpreter and displays a prompt of the command interpreter on the client program. An eighth step in which the user inputs a transfer command and a file name to be transferred in response to the prompt display to the client program, and another transfer after the file transfer in the sixth step is completed The file transfer according to claim 3, further comprising: a ninth step of ending the process if the presence or absence of the target file is not confirmed, and returning to the seventh step and repeating the subsequent process if there is. Method.