JPS61115150A - Secret protection system of file - Google Patents

Abstract

PURPOSE:To protect the secret of a file by providing the 2nd file security code which is set at the time of producing the file or after the production and modified if necessary. CONSTITUTION:A protection key collating part 30 is activated to collate keys, and the file is accessed only when the keys are equal. If the protection keys are not coincident, a file access error is informed, and the secret of the file can be protected with respect to the third party who does not know the protection key. When the protection key collating part 30 is activated from a file access control part 2, said part 30 reads out a file control information record relating to a file access request from the file 10 in a step 30, and holds the security code and an authority code. With such constitution that the authority code capable of being modified if necessary is equipped, all possible measures are taken for protecting the file secret by modifying arbitrarily the file security code when it is leaked.

Description

DETAILED DESCRIPTION OF THE INVENTION Object of the Invention Industrial Field of Application The present invention relates to a security protection system for files in an information processing system.

In conventional technical information processing systems, in order to protect the confidentiality of data and programs, a protection key called an operator security code is set for each data input/output device when the system is created, and a file security code or program security code is set for each data input/output device. A protection key called a security code, IJ code, etc. is set for each file.

Problems to be Solved by the Invention In the conventional file security method described above, the file security code cannot be changed after the file is created.
If this becomes known to a third party, there is a problem that, depending on the file security code, future security protection may not be possible.

Configuration of the Invention Means for Solving the Problems The security protection method of the present invention that solves the problems of the prior art described above is in addition to the conventional file security code that is set at the time of file creation and fixed thereafter. , by providing a second file security code that can be set during or after file creation and changed as necessary.

Even after the file security code is known to a third party, the file security code can be changed to protect the security of the file.

The following five examples will explain the effects of the present invention in detail.

Embodiment FIG. 1 is a functional block diagram showing the configuration of a portion related to the present invention in an information processing system to which one embodiment of the present invention is applied.

In FIG. 1, 2 is a file access control unit that receives a file access request and controls file access, 10 is a file management information storage file that stores file management information including a protection key, and 20 is a protection key. The authority code registration/updating unit 30 registers and updates the authority code, which is one of the parts, and the authority code registration/update unit 30 checks the protection key input at the time of file access with the protection key registered in the file management information storage file 10. This is the protection key matching section.

The file management information stored in the file 10 corresponds to what is generally called a dataset label 1 fine label or the like.

The file management information, as illustrated in FIG. 2, consists of a set of file management information records #0 to #n set corresponding to each of a plurality of files. Each file management information record includes the storage location of the file name, polynym serial number, etc.
data type.

It includes fields such as security code (SC) and authority code (AC).

The security code (SC) is a protection key that corresponds to the file security code in the conventional system. That is, this security code (SC) is set at the time of file creation and is fixed thereafter.

On the other hand, the authority code (AC).

This is a protection key that can be registered via the authority code registration/update section 20 during or after file creation and updated as necessary. Namely.

The authority code is typically not registered immediately after file creation, and the security code (SC) is not registered immediately after file creation.
) has been leaked to a third party, or if there is evidence of such leakage.

Registered for the first time. Afterwards, if it is discovered that the registered authority code has been leaked to a third party, or if there is evidence of such a leak,
Updated from time to time.

An example of the registration/update process by the authority code registration/update section 20 of FIG. 1 will be described with reference to the flowchart of FIG. 4.

The authority code registration/update unit 20 has an input/output value w1
When a request for registration or renewal of an authority code is received from The new authority code (ac) or the old authority code (ac) in case of update is taken from the input/output value W1.

In the next step 22, the file management information storage file 1 is created using the input file name as an index.
Security code (S C) of the corresponding file from 0
The file management information record containing the authority code (AC) is read out.

In the next step 23, the input security code (sc) is compared with the security code (sc) registered in the file 1o.

If the security codes match, in the first step 24 it is determined whether the authority code (AC) registered in the file 10 is "0". When AC="0".

The authority code registration/update unit 20 determines that registration of the authority code is requested.

Proceed to step 27, where the above input Seki 7,
Enter the security code (a C) and enter the security code (A C).
) to complete the registration of the security code.

On the other hand, the authority code registration/update section 20.

If it is determined that AC is not "0" in step 24, it is assumed that an update of the authority code is requested, and the old authority code (aC) inputted in the third step 25 and the authority registered in file 10 are Verify the code (AC). If this verification matches, a new authority code (ac) is received from the input/output device 1 at the step knob 26 and written to the authority code (AC) field in the corresponding file management record in the next step 27. The authority code update process ends.

The authority code registration/update unit 20 performs step 23
Alternatively, if there is no match in step 25, an "error" notification is sent to the human output value v1 in step 28, invalidating the registration/update process.

The file access control unit 2 in FIG.
When a file access request is received by specifying a security code and an authority code, the protection key verification unit 30 shown in FIG. 1 is first activated to perform verification, and file access is performed only if the verification matches. . That is, if the protection keys do not match, a file access error is notified and the file is protected against a third party who does not know the protection key.

An example of the operation of the protection key verification section 30 will be explained according to the flowchart of FIG. 5.

When the protection key collation unit 30 is activated by the file access control unit 2, first in step 31, it reads the file management information record related to the file access request from the file 10, and reads the security code (SC) and the authority code. Hold (AC). In the next step 32.

The security code (SC) specified at the time of the file access request is compared with the security code (SC) registered in the file IO. If the verification matches, in the second step 33, the authority code (aC) specified at the time of the file access request and the authority code (AC
) is compared. If all the matches match, the step 34 notifies the file access control unit B 2 of this fact.

On the other hand, if either the security code or the authority code does not match.

In step 35, the file access control unit 2 is notified of the mismatch.

Although the configuration in which the authority code is registered after the security code is leaked has been exemplified above, the authority code may also be registered at the time of file creation.

In addition, although the configuration in which file management information including the authority code is centrally managed in the file 10 has been illustrated, such file management information is distributed within corresponding files, and when registering or updating the authority code, the file I
It may be configured such that it is temporarily loaded into O, or it is registered/updated directly on that file.

Effects of the Invention As explained in detail above, the security protection system of the present invention is as follows:
In addition to the conventional file security code, the structure includes an authority code that is set at the time of file creation or after file creation and can be changed as necessary, so if the confidentiality of the file security code is leaked, By registering a new authority code and changing it at any time if the authority code becomes confidential, it is possible to ensure the security of files.

[Brief explanation of the drawing]

FIG. 1 is a functional block diagram showing an example of the configuration of a part related to the present invention in an information processing system to which an embodiment of the present invention is applied, and FIG. 2 is a functional block diagram showing an example of the configuration of a part related to the present invention. Conceptual diagram showing an example of the configuration of file management information, Part 3
The figure is a conceptual diagram showing an example of the structure of the file management information record of FIG. 2. Figure 4 shows the authority code registration/update section 20 in Figure 1.
Flowchart 1-1 for explaining an example of the operation of
The figure is a flowchart for explaining an example of the operation of the protection gear matching block 30 of FIG. 2.File access control section, 10.File management information storage file, 20.Authority code registration/update section, 3
0...Protection key verification unit, SC...Registered security code, SC...Security code manually entered from outside, AC...Registered authority code. ac: Authority code input from outside.

Claims (1)

[Claims] First and second protection keys set corresponding to a file are provided as file management information, and the first protection key is set at the time of file creation and is fixed thereafter, and A file security protection system characterized in that the second protection key is set during or after file creation and is changed as necessary.