JPS5862745A - Secret protection system in information retrieval system - Google Patents

Abstract

PURPOSE:To prevent the leakage of secret information, by allowing a specific item to be retrieved only when the retrieval is done with a special code predetermined based on the qualification of a personnel of information retrieval. CONSTITUTION:A secret protection providing means SAL reads a retrieval condition formula and a secret protection file PSW received in an input buffer CBUF, adds the condition formula for the secret protection and writes the result to a job buffer WBUF. Next, a retrieval result log forming means RSL reads the formula from the buffer WBUF and writes a representing value of information group corresponding to conditions from a retrieval objective data DB to a retrieval log file WSET. An output means OPL takes data stored in the WSET as processing objectives. Thus, as far as a specifically qualified personnel does not process a specific coding, the secret information can not be leaked and the secrecy can be protected with a simple device.

Description

DETAILED DESCRIPTION OF THE INVENTION The present invention relates to a security protection system in an information retrieval system, and aims to speed up processing and increase the degree of freedom in how to maintain security.

Conventionally, the range of information that can be referenced has been limited depending on the qualifications of the user (searcher).

However, in that case, the restrictions are on an item-by-item basis.

There was no restriction based on the content (value) K of the same item. In addition, the process for checking qualifications is performed every time each playing card is processed, resulting in a heavy load on the computer and a slow response.

For example, consider searching for personnel information in a company. Personnel information includes a large number of items for each employee, viz.

It consists of name, age, address, affiliation, position, employee number, educational background, rewards and punishments, personnel assessment, etc. Generally, when searching for such information, a conditional expression expressing the object to be searched is input. For example, you can specify something like ``Restore people who are over 30 years old and belong to a sales-related department.''On the other hand, to ensure confidentiality, check the user's qualifications from the user's ID card, etc., and specify a certain level. Only information within a range can be output, but in the past, the qualifications of searchers were graded arbitrarily, but the information to be searched was graded on an item-by-item basis, and a certain item could be output by a highly qualified searcher. It was a sort of vertical checking system where the information was shown to those with lower qualifications but not to those with lower qualifications. Therefore, for a qualified person of a certain grade, items with a certain value above a certain value will not be shown, but items below that value will be shown. In other words, it was not possible to check horizontally. For example, regarding the item title, it was not possible to show the data of employees who are general manager or above, but to show the data of employees who are 2nd section manager or below, as a qualification check.

Furthermore, conventionally, a qualification check is performed every time a transaction is opened, which results in a large computational load. This search process is performed on a record-by-record basis, and each record contains all the items.
This is because if qualifications are checked on an item-by-item basis, each time a record that meets the input conditions is found, it will be necessary to perform a process of deleting non-referenceable items and outputting the record.

The present invention aims to solve these conventional drawbacks, and for this purpose, when specifying search conditions, conditions for security protection are added to perform search processing.

In the present invention, for example, in the above example, a qualification check is performed such that only employee data (all items) with a position equal to or lower than the position of the searcher can be referred to. Here, as mentioned above, when performing a search using the conditions of "1 year old, 30 years or older, sales related", if the searcher's title is a section manager.

The actual search inside the computer is based on the following conditions: ``Age 30 years or older, working in sales, and below the rank of section manager.''

Therefore, even if the person is 30 years old or older and is involved in sales, no data will be available on people above the general manager level. In this case, if the initial search condition is ``Age 30 years or older, Sales related, Position of General Manager or higher'', 0 matching results will be output. Note that the conditional expression 9, ``above the general manager and below the section manager'' is a logical contradiction, but in this case, no error is displayed, and it is output in the form of #untrue.

DB is search target data, pswFi security file.

WSBT is a search result set file, SAL is a security addition means, R8L is a search result set creation means, and OPL is a value output means. In the figure 1 security information means 8A
In L, the search condition expression and the security file PSW received in the input buffer CBUF are read, a condition expression for security protection is added, and the data is written to the buffer yWBUF for work 9. Next, the search result set creation means R8L reads the conditional expression from the work buffer WBUF, and retrieves the representative value (for example, employee number) of the information group that corresponds to the condition from the inspection target data DB into the search set file W8 g 'I' K Write. The value output means OPL outputs the set stored in the search set file W8ETK' to be processed.

According to the embodiment of the present invention, the search result set file WSE
Since the information group Kti stored in TK and the information group Kti of confidentiality do not exist, there is no need to check the value in the value output means OPL, and the value can be protected without affecting efficiency. Ru. In addition, conditions for 9 security protection are added internally and are excluded from processing targets during searches.

Complete security is achieved without the security information being known to the searcher.

According to the present invention, since the security of a value is set using one conditional expression, it is possible to process it as one search conditional expression, and processing can be performed without requiring a special inspection for one security IIO. Also, to manage the search result set using representative values.

By simply setting one security condition, related information can be protected at the same time.

Moreover, if the conventional vertically divided security check is further combined with respect to the set file WSET.

Very detailed security protection becomes possible.

[Brief explanation of the drawing]

The figure is a configuration diagram of an embodiment of security information based on the present invention. In the figure, CBUF and WBUF are data/(tufa, P8W is a security file, and DB is search target data. P8Vlj security security check T is a search result set file, \8^L is an rli voice protection attachment means, and R8LF
i search result set creation means, OPL indicates value output means.

Claims (1)

[Scope of Claim] A system for performing information retrieval by giving a specific value or range of values for one or more items as an input condition from among a large number of information groups each consisting of counting items. 1. A security protection system for an information retrieval system, characterized in that a value or range of values of a predetermined item determined in advance based on the qualifications of a searcher is added to the input conditions to perform a search.