JPH10289134A - Access management system in data base - Google Patents

Abstract

PROBLEM TO BE SOLVED: To control an access right with a time element as an object in a data base. SOLUTION: In the case that a user issues a query to a data base part 101 in an input part 105, a data base access control part 103 decides the propriety of reference to the data base part 101 based on the query by referring to a data base access definition table file 104 based on a user name set in the process of issuing the query, a data base name, a file name and an item name specified by the query and the time of issuing the query. A data base control part 102 accesses the data base 101 based on the query for which the propriety of the reference is controlled as mentioned above and displays the result at a display processing part 106.

Description

DETAILED DESCRIPTION OF THE INVENTION

[0001]

[0001] 1. Field of the Invention [0002] The present invention relates to a technique for controlling access to a database.

[0002]

2. Description of the Related Art
When an access right is set for a file (table) or an item of a database, an access attribute such as “read / disable” and “write / disable” is set for each user and each group.

[0003] That is, conventionally, access rights have been controlled for database operators. Here, in the operation of the database, there are cases where it is desired to restrict access to the database depending on the time zone.

Conventionally, however, the system operator had to manually change the setting of the access right to the database at predetermined time intervals.
In this case, when there are many files and items to which the access right is to be set, there is a problem that the setting of the access right must be changed for a long time.

An object of the present invention is to make it possible to control an access right for a time element in a database.

[0006]

SUMMARY OF THE INVENTION The present invention is based on an access management device for controlling access to a database.

A first aspect of the present invention has the following configuration. Then, first, for each predetermined data element (file, item, etc.) constituting the database and for each user who uses the database, the right of access to the predetermined data element by the user (whether reference, update, etc.) is performed. Or, a table storage means (table storage means) for storing a database access definition table in which an access condition (such as a default search condition for an item) and a time range (a start time, an end time, etc.) to which the access right or access condition is applied are set Database access definition table file 104).

[0008] Then, when a query specifying access to the database is issued, based on the user who issued the query, the data element in the database specified by the query, and the time information when the query was issued, By referring to the database access definition table stored in the table storage means,
It has database access control means (database access control unit 103) for controlling access to the database based on the query.

According to the configuration of the first aspect of the present invention described above, it is possible to execute access right or access condition control based on a time zone for an issued query. A second aspect of the present invention has the following configuration.

First, for each predetermined data element constituting the database and each user who uses the database, the access right or access condition to the predetermined data element by the user and the access right or access condition are applied. And a first table storage means (database access definition table file 104) for storing a plurality of sets of database access definition tables in which a time period of the day is set.

Next, a second table storage means (distribution access definition table file 40) for storing a distribution access definition table in which a database access definition table to be selected is set for each day of the week or a specific date.
2).

When a query specifying access to the database is issued, the distribution access definition table stored in the second table storage means is referred to based on the day and date when the query was issued. Selects one of a plurality of database access definition tables stored in the first table storage means, issues a query, issues a data element in the database specified by the query, and issues the query. By referring to the selected database access definition table based on the time information provided,
It has database access control means (database access control unit 401) for controlling access to the database based on the query.

According to the configuration of the second aspect of the present invention described above, it is possible to control the access right or access condition based on different time zones for each day of the week or for each specific date with respect to the issued query.

According to the present invention, when used by a computer, a computer readable program for causing the computer to perform the same function as the function realized by the configuration of the first or second aspect of the present invention. It can also be configured as a storage medium.

[0015]

Embodiments of the present invention will be described below in detail with reference to the drawings. <First Embodiment> FIG. 1 is a system configuration diagram of a first embodiment of the present invention.

The database unit 101 stores one or more databases storing one or more files (tables) in which one or more items are defined. Input unit 1
Reference numeral 05 denotes an operation required for each user to operate the database unit 101, for example, SQL (Structured Query Language)
Is specified in an interactive format or a batch processing format.

The database access control unit 103 and the database access definition table file 104 are the parts most relevant to the present invention. That is, when the user issues a query to the database unit 101 in the input unit 105, the database access control unit 103 determines the user name set in the process that issued the query and the database name ( By referring to the database access definition table file 104 based on the DB name), the file name, the item name, and the time at which the query was issued,
It is determined whether reference (select operation) to the database unit 101 based on the query is possible.

The database access control unit 10
In step 3, when the reference by the query issued from the input unit 105 is permitted, the database control unit 102
Refers to the corresponding database, file, and item in the database unit 101 based on the query, and displays the reference result on the display processing unit 106.

As described above, in the present embodiment, the query issued from the input unit 105 is used to perform the reference control based on the time zone by using the database access definition table file 104 in which the availability of the reference by the time zone can be set. Is a major feature related to the present invention.

FIG. 2 is a data configuration diagram of the database access definition table file 104. In this table file, the input section 1
User name specified in 05 (for example, login name)
Is set.

In the start time field, the start time of a time zone for which the reference is set is set. In the end time field, the end time of the time zone for which the reference is set is set.

In the database name (DB name) field, the name of a database for which reference is set is set. In the file name field, a file name (table name) to be referred to or not in the database specified in the database name field is set.

In the item name field, the name of an item that can be referred to in the file specified by the file name field in the database specified by the database name field is set.

In the reference availability field, the availability of reference is set. Now, when “OK” is set in the reference permission / inhibition field, the time zone specified by the file name field in the database specified by the database name field in the time zone determined by the start time field and the end time field Reference can be made to the item specified in the item name field in the file.

FIG. 3 is an operation flowchart showing the operation of the system according to the first embodiment shown in FIG. First, when the user specifies a query from the input unit 105 to refer to a predetermined item in a predetermined file included in a predetermined database in the database unit 101 in an interactive format or a batch processing format, the database access control is started. The unit 103 opens the database access definition table file 104 (step 30).
1).

Next, the database access control unit 103
Is the database access definition table file 104
A read instruction for reading one set of settings (for one horizontal row in FIG. 2) is issued (step 302).

Next, the database access control unit 103
Determines whether an EOD (end of data) code indicating the end of the file is detected as a result of issuing the read instruction in step 302 (step 303).

If no EOD code is detected, step 30
4 is NO, the database access control unit 1
03 determines whether or not one set of contents of the database access definition table file 104 read by the read command is valid information (step 30).
4). "When the loaded settings are valid information"
Means that the user name set in the process that issued the above query is set in the user name field (see FIG. 2) of the read setting contents, and the start time field and the end of the read setting contents are set. This refers to a case where the time at which the query was issued is included in a time zone determined by the time field (both refer to FIG. 2).

If the read settings are valid information and the determination in step 304 is YES, the database access control unit 103 loads the read settings into a main storage memory (internal buffer) (not shown).
After that, the database access control unit 103 returns to the process of step 302, and issues again a read command for reading the next set of setting contents of the database access definition table file 104.

On the other hand, if the read setting is not valid information and the determination in step 304 is NO, the database access control unit 103 returns to the processing in step 302 and returns to the database access definition table file 104
A read command for reading the next set of settings is issued again.

By repeatedly executing the processing of steps 302 to 305, the database access definition table file 104 corresponding to the user who issued the query and corresponding to the time zone when the query was issued is stored in the main memory. The settings are expanded.

As a result of issuing the read instruction in step 302, if the EOD code is detected in step 303 and the determination in step 303 becomes YES, the database access control section 103 can access the database specified by the issued query. Is determined (step 306). More specifically, the database access control unit 103 determines whether or not reference is possible among the setting contents of the database access definition table file 104 expanded on the main storage memory (see FIG. 2).
Is determined by the issued query by determining whether the database name specified by the issued query has the setting content set in the database name field (see FIG. 2). It is determined whether the database is accessible.

If the database specified by the issued query is accessible and the determination in step 306 is YES, the database access control unit 1
03 further determines whether the file specified by the issued query is accessible (step 307). Specifically, the database access control unit 103 specifies the content specified by the issued query among the setting contents of the database access definition table file 104 expanded on the main storage memory, which is searched and extracted in step 306. It is determined whether or not the file specified by the issued query is accessible by determining whether or not the setting content whose file name is set in the file name field (see FIG. 2) exists. .

The file specified by the issued query is also accessible, and the determination in step 307 is YE
In the case of S, the database access control unit 103 excludes items that cannot be referred from among the items specified by the issued query from the targets of reference (read) by the query, and deletes the query. The data is passed to the database control unit 102 (step 309). More specifically, the database access control unit 103 executes step 3 of the items specified by the issued query.
07, the database access definition table file 10 expanded on the main storage memory and extracted.
Items corresponding to item names that are not included in the item name field of each setting content of item 4 are excluded from reference targets by the query.

When the database control unit 102 receives the issued query from the database access control unit 103, the database control unit 102
Reference is made to a predetermined item in a predetermined file included in a predetermined database in the database unit 101 (step 310).

Then, the database control unit 102 causes the display processing unit 106 to display the reference result in step 310 (step 311), and ends the control processing for the issued query.

On the other hand, if it is determined in step 306 or 307 that the database or file specified by the issued query is inaccessible and the determination is NO, the database access control unit 103 Causes the display processing unit 106 to display the reference disabled (step 308), and ends the control processing for the issued query. <Second Embodiment> FIG. 4 is a system configuration diagram of a second embodiment of the present invention.

In the configuration shown in FIG. 4, the first circuit shown in FIG.
The parts denoted by the same reference numerals as in the embodiment of FIG.
It has the same function as in the case of. 4 differs from the configuration of FIG. 1 in that a plurality of sets (#A, #A)
B, #X, #Y,...), And a distribution access definition table file 402 for selecting one from the plurality of database access definition table files 104 for each day of the week or for each specific date. Is prepared, and the database access control unit 401 uses the distribution access definition table file 402 and the database access definition table file 104 selected from the setting content to respond to the query issued from the input unit 105 by day of week or The point is that reference control is performed based on a different time zone for each specific date.

Specifically, as the plurality of database access definition table files 104, FIG.
As illustrated in (b), the basic table configuration is shown in FIG.
In the same manner as in the first embodiment shown in FIG. 1, those having different settings are prepared.

As shown in FIG. 5C, the distribution access definition table file 402 has the contents in which the database access definition table file 104 to be selected is set for each day of the week and for each specific date. Things are prepared.

Now, as in the case of the first embodiment described above, the user instructs the input unit 105 to refer to a predetermined item in a predetermined file included in a predetermined database in the database unit 101. When the query is specified in the interactive format or the batch processing format, the database access control unit 401 obtains today's date and day of the week, and then, in the distribution access definition table file 402, first stores an entry corresponding to today's date. A search is performed, and if the entry is found, the database access definition table file 104 set in the entry is selected. If an entry corresponding to today's date is not found, the database access control unit 401 further searches for an entry corresponding to today's day of the week, and sets the database access set in the entry found as a result. Definition table file 104
Select

Thereafter, using the database access definition table file 104, the same control operation as in the first embodiment shown in the operation flowchart of FIG. 3 is executed. <Other Embodiments> In the control operation shown in FIG. 3 and the like executed in the above-described first and second embodiments of the present invention, the query issued by the input unit 105 is stored in the database unit 101. This is for specifying a record reference (dump output) for a single file included in a single database.

However, the present invention is not limited to this. Even when a query or the like for instructing a combination of a plurality of files is specified, the date and the day of the week are referred to by referring to the database access definition table file 104. , Access control based on a time element such as a time zone.

The query issued by the input unit 105 includes updating of file items, deletion of file records, definition of file items, definition of files, etc., other than reference (reading) of file items. In the case of specifying, the access right of each access is controlled based on time elements such as date, day of the week, time zone, and the like, by setting access permission / non-permission corresponding to each access in the database access definition table file 104. Is possible.

Further, in a certain time zone, the search condition is set in the database access definition table so that a predetermined search condition is added to a specific user by default, that is, even if it is not specified as a query. It can also be set in the file 104.

The present invention relates to a floppy disk or a CD storing a computer program having a function realized by the first or second embodiment of the present invention.
-A storage medium such as a ROM disk, an optical disk, and a portable (removable) hard disk is also claimed.

[0047]

According to the configuration of the first aspect of the present invention, it is possible to control the access right or the access condition based on the time zone for the issued query.

According to the configuration of the second aspect of the present invention, it is possible to control the access right or the access condition based on different time zones for each day of the week or for each specific date for the issued query. .

[Brief description of the drawings]

FIG. 1 is a system configuration diagram of a first embodiment.

FIG. 2 is a configuration diagram of a database access definition table file.

FIG. 3 is an operation flowchart of the first embodiment.

FIG. 4 is a diagram illustrating a system configuration according to a second embodiment;

FIG. 5 is a configuration diagram of a database access definition table file and a distribution access definition table file according to a second embodiment.

[Explanation of symbols]

Reference Signs List 101 database unit 102 database control unit 103, 401 database access control unit 104 database access definition table file 105 input unit 106 display processing unit 402 distribution access definition table file

Claims (4)

[Claims] 1. An access management apparatus for controlling access to a database, wherein each of predetermined data elements constituting the database and each user who uses the database in the database, wherein the user Table storage means for storing a database access definition table in which an access right or an access condition to the data element is set, and a time range to which the access right or the access condition is applied; and a query for specifying the access to the database. At the time of issuance, the database access definition stored in the table storage means based on a user who issued the query, a data element in the database specified by the query, and time information at which the query was issued. By referencing the table , The access management unit in a database which comprises a, a database access control means for controlling access to said database based on the query. 2. An access management device for controlling access to a database, wherein each predetermined data element included in the database and each user who uses the database, wherein the predetermined number of users is used by the user. First table storage means for storing a plurality of sets of database access definition tables in which an access right or an access condition to the data element is set and a time zone within a day to which the access right or the access condition is applied; For each day of the week or a specific date, a second table storage means for storing a distribution access definition table in which the database access definition table to be selected is set, and when issuing a query specifying access to the database, Based on the day and date when the query was issued, the second By referring to the distribution access definition table stored in the table storage means, selecting one from the plurality of database access definition tables stored in the first table storage means, and executing the query By referring to the selected database access definition table based on the issuing user, the data element in the database specified by the query, and the time information when the query was issued, An access management device for a database, comprising: database access control means for controlling access. 3. A storage medium read by a computer when used by a computer, wherein each predetermined data element in the database and each user who uses the database include:
A function of storing a database access definition table in which an access right or an access condition to the predetermined data element by the user and a time range to which the access right or the access condition is applied; and an access to the database is designated. At the time of issuing the query, by referring to the database access definition table based on the user who issued the query, the data element in the database specified by the query, and the time information when the query was issued A function of controlling access to the database based on the query; and a computer-readable storage medium for causing the computer to perform: 4. A storage medium which is read by a computer when used by a computer, wherein each of predetermined data elements constituting the database and each user who uses the database includes:
A function of storing a plurality of sets of a database access definition table in which an access right or an access condition to the predetermined data element by the user and a time zone in a day to which the access right or the access condition is applied are set; A function of storing a distribution access definition table in which the database access definition table to be selected is set for each day of the week or a specific date; and when a query specifying access to the database is issued, the query is issued. By referring to the distribution access definition table based on the day of the week and the date, one of the plurality of database access definition tables is selected and the user who issues the query and the database specified by the query are selected. The data elements in and the query was issued Based on the information during, by referring to the database access definition table said selected, computer readable storage medium of function and, a for causing the computer to control access to the database based on the query.