KR100845309B1 - Method and Apparatus for controlling accessing right of contents - Google Patents

Abstract

The present invention relates to a method and apparatus for controlling access rights of content that is easy to authorize and adjust by introducing a concept of negative authority that can release authority granted in a unilaterally granting authority for each content. One or more positive rights granting one or more positive rights to allow access to the corresponding content for each content, and one or more negative rights to release access to the content if there is a target to be released from among the subjects to which the positive rights are granted. , And with reference to the granted positive rights and negative rights, deny or allow access request for the content.

Authorization, content, access, deauthorization

Description

Method and Apparatus for Controlling Access Right of Contents {Method and Apparatus for controlling accessing right of contents}

1 is a block diagram illustrating an example of a portal service system;

2 is an exemplary view illustrating a permission explanation screen for explaining a conventional access permission setting method;

3 is a flowchart illustrating a content rights generation process according to a method for controlling access to content according to the present invention;

4 is a view showing an authority setting screen as an embodiment of the present invention;

5 is a flowchart illustrating a process of controlling access to content according to the present invention;

6 (a) is an illustration of a user rights management table according to the present invention, (b) is an illustration of a content rights management table according to the present invention, and

7 is a block diagram showing an apparatus for controlling access to content according to the present invention.

The present invention relates to a method and a device for controlling access rights to content provided through a network, and in particular, by introducing a concept of negative rights that can release the rights granted in a method of granting rights unilaterally for each content. The present invention relates to a method and apparatus for controlling access rights of content that can be easily authorized and adjusted.

In recent years, with the development of communication technology and digital technology, portal services that provide various contents within one site have been actively provided, and various kinds of portal sites are currently implemented, among which information from inside and outside the enterprise and Provided for the purpose of efficiently managing and providing data, it is called an enterprise portal (EP).

FIG. 1 illustrates a basic structure of an EP system, and provides a portal site through a server 13 connected to a plurality of client terminals 11 through a switch 10 and then accesses the portal site. When authentication and authority are verified, and user authentication is made and it is confirmed that the user has the authority, the service of reading, writing, or deleting the content requested by the user is provided according to the authority.

At this time, the type of content provided through the EP system varies from general common sense to corporate information, and therefore, the target for providing the corresponding content varies depending on the content. That is, some content may be open to users, while other specific content may only be available to employees, and some content may only be available to managers.

Therefore, in such a portal system, access rights must be managed differently for each content to be provided.

2 is a diagram illustrating an example of a conventional authority setting screen in order to explain a conventional content access authority management method.

In the related art, when a specific content is generated, a right to access the corresponding content is granted by group, by user, by department, or by rank.

That is, in the permission setting screen as shown in FIG. 2, the target to grant the right to access the corresponding content in the area 21 for specifying the grant target range is a group unit, a user unit, a position unit, or a position unit. The selected target is searched through the search area 22. The subjects in the selected range appear in the left window 24, and select the object to be authorized from the items shown in the left window 24 and move it to the right window 25 through the selection button 26. The subjects displayed in the right pane 25 represent the users selected to authorize.

In addition, it is possible to select the type of authority (read, write, delete, etc.) to be granted through the area 23.

As described above, if the target to be authorized is selected in a group unit, a position unit, or a position unit, and the setting completion button is pressed, the target persons displayed in the right window 25 are registered as a user having access to the corresponding content.

However, as described above, since the conventional method is made from a method of granting authority to a user who can access the corresponding content, it is difficult to set or adjust the authority.

For example, according to the conventional method, if you want to allow access to all users regardless of position or group, select an item (for example, COMMON) indicating all user rights on the authority setting screen as shown in FIG. If you select the type of permission (read, write, delete), all users will have access. In addition, in the case where the authority is to be given only to a person of a specific group or a specific position, the desired group, position or position may be selected from the group, position or position.

However, when granting authority to the entire user, but wanting to exclude only a portion of the user, there was an inconvenience in that the authority must be granted to the remaining users one by one except the user.

In addition, if the rights are granted to all users and there is no function to recover only the rights of some users, the rights can be revoked. I had to find all the users except the user to grant permission.

The present invention has been proposed to solve the above-mentioned conventional problems, and an object of the present invention is to introduce a concept of negative authority that can release the authority granted in a unilaterally authorizing manner for each content. The present invention provides a method and apparatus for controlling access rights of content that can be easily authorized and adjusted.

In order to achieve the above object of the present invention, the access rights control method of the content of the present invention,

A positive authorization step of granting at least one positive authority for allowing access to the corresponding content for each content;

A negative authority granting step of granting one or more negative rights for releasing the right to access the content when there is a target to be released from among the subjects to which the positive rights are granted; And

And an access control step of denying or allowing an access request for the content with reference to the granted positive right and negative right.

In addition, the content access right control method of the present invention, characterized in that it further comprises the step of registering and managing the given positive rights and negative rights in the content rights table.

In addition, the entries of the content rights table are configured for each of the rights granted, each entry includes a service identification ID indicating the content for which the right is defined, a target identification ID indicating the object to which the right is granted, and And a privilege type indicating whether the authority is a positive authority or a negative authority, and detailed authority information indicating the type of access to which the authority is allowed. The positive authority is defined by group, position, position, department, and user. It includes at least one of group authority, department authority, position authority, rank authority, user authority, and the authority detailed information, characterized in that it includes one or more of read, write, delete.

In addition, in the access rights control method of the content according to the present invention, the access control step,

If access to the content is requested, checking the authority information of the user who requested access;

Identifying negative rights information defined in the content;

Checking whether there is a negative right granted to the user among negative rights defined in the identified corresponding content;

Denying the requested access if there is a negative right for the user as a result of the checking;

If there is no negative right for the user as a result of the checking, confirming a positive right defined in the corresponding content;

Checking whether there is a positive right granted to the user among the identified positive rights; And

In the step, if the user has a positive right granted to the user, the requested access, and if there is no positive right granted to the user, characterized in that it comprises the step of denying the requested access.

In addition, in the method for controlling access to content according to the present invention, the user rights information includes a user ID for identifying a corresponding user for each entry and a group ID indicating one of a group, a position, a position, and a department to which the user belongs. It is characterized by checking in the user authority table included.

In addition, the present invention is another configuration means for achieving the above object, the content to manage the positive rights for granting the right to grant access to the content defined for each content and the negative rights to release the rights granted to the content A storage unit for storing an authority table and a user authority table for managing user authority information defined for each user; An interface unit for receiving a permission setting request according to generation of content and an access request for each generated content and outputting a response to the request; A content right generation unit that defines one or more positive rights and negative rights for the corresponding content and adds the same to the content rights table when a right setting of the content is requested through the interface unit; And when the request for access to the content is confirmed through the interface unit, referring to the content authority table and the access authority stored in the storage unit, the user authority table, and confirms the negative authority, the positive authority, and the user authority information on the content requested to be accessed. The present invention provides an apparatus for controlling access rights of a content including an access control unit that denies a corresponding access request if there is a negative right or neither a negative right nor a positive right exists, and permits access if a positive right exists.

DETAILED DESCRIPTION Hereinafter, exemplary embodiments of the present invention will be described in detail with reference to the accompanying drawings. However, in describing the operating principle of the preferred embodiment of the present invention in detail, if it is determined that the detailed description of the related known function or configuration may unnecessarily obscure the subject matter of the present invention, the detailed description thereof will be omitted.

In addition, the same reference numerals are used for parts having similar functions and functions throughout the drawings.

In the portal service system shown in FIG. 1, the access control method and apparatus of the present invention described below are applied to a server 13 that provides and operates a portal site, thereby accessing the portal site of the client terminal 11. To control.

According to a preferred embodiment of the present invention, the method for controlling access to content according to the present invention includes a positive authorization step of granting one or more positive rights to allow access to the corresponding content for each content, and among the subjects to which the positive rights are granted. A negative authorization step of granting at least one negative right to release access to the content if there is a target to be released; And an access control step of denying or allowing an access request for the content with reference to the granted positive right and negative right.

3 is a flowchart illustrating a process of granting the positive authority and the negative authority in the method for controlling access to content according to an embodiment of the present invention.

Referring to FIG. 3, in the method of controlling access rights according to the present invention, when a content (or a menu for accessing a corresponding content on a portal site) to be provided in a portal is generated (S310), a right to be granted in relation to the content is defined. It includes the step (S320). The authority definition step (S320) is a step of predefining matters such as a name or a condition related to the authority.

In the positive authorization step (S330), the target to be allowed to access the content is selected to grant the defined authority. In the positive authorization step (S330), as in the case of the existing authorization, as a target to which the authority is granted, a group, a position, a position, or a user can be selected, and when the authority is granted to a specific group, position, or position, Privileges are granted to all users who belong to the group or have the corresponding title or position. In order to effectively manage this, if users are managed by matching users with the group, position, or position to which the user belongs, even if the authority is given only to the position, position, or group, the position, position, or group to which the above authority is granted in actual access control Access control for users belonging to can be enabled. This will be described in more detail later with reference to FIG. 5.

If there are some users who want to release the authority among the subjects authorized in step S330 (S340), the authority is granted in the positive authorization step (S330) by performing the negative authorization step (S350). Select one or more of the targets to grant a negative permission that specifies revocation.

And by storing the positive rights and negative rights granted by the step (S330) and step (S350), the right generation for the content is completed (S360).

4 illustrates an example of a user interface screen for setting rights of content according to a method for controlling access right of contents according to the present invention.

Referring to FIG. 4, in the user interface screen for setting rights according to the present invention, a first selection area 41 for selecting and assigning an authorization target into a virtual group, a user, a department, a position, a position, and the like, and a user Second selection area 42 which can be searched by directly inputting an object, a third selection area 43 for selecting the type of authority to be granted, and the first selection area 41 and the second selection area ( The objects corresponding to the range selected in 42) are displayed, and the fourth selection area 44 for designating one or more of the displayed objects as a positive right or a negative right, and designated as the positive authorization in the fourth selection area 44 A first display area 45 in which the object is displayed and a second display area 46 in which the object designated as the negative authority in the fourth selection area 45 are displayed.

After specifying a positive authority object and a negative authority object in the first display area 45 and the second display area 46, respectively, and selecting a completion button (shown in the lower part of FIG. 4), the first display area 45 is selected. Positive authority to which predetermined authority is given is set to the object designated to), and negative authority to release the authority granted to the object designated to the second display area 45 is set.

Each server that provides the portal service in the portal service system sets an authority for each content as described above, and then confirms whether the user who has access to the content is a user having the set authority, and performs the access request. Allow or deny.

5 is a flowchart illustrating an access control process using a set authority in a method for controlling access right of contents according to an exemplary embodiment of the present invention.

Referring to FIG. 5, when an access of a specific user is requested to the content whose authority is generated as described above with reference to FIG. 3 (S500), first, the authority information of the requesting user is checked (S510). This is to confirm whether the user has the authority to manage the corresponding content, that is, whether the user is an administrator. Usually all types of access are allowed to the administrator to manage the content.

As a result of the check, if it is an administrator (S520), since the separate authority check is unnecessary, the access is immediately allowed (S530).

On the contrary, as a result of the check, if the user is not an administrator, it is necessary to confirm whether the user is an accessible user. That is, it checks which rights are set in the corresponding content.

The negative authority is compared with the authority of the user who requested the access among the rights defined in the identified content, and it is determined whether the negative authority is granted to the corresponding user (S550, S560). If negative authority is granted to the corresponding user, access is immediately restricted (S590).

On the contrary, if the negative authority is not granted to the corresponding user, it is again determined whether the positive authority is granted to the corresponding user by comparing the positive authority with the authority of the user defined among the contents (S570, S580). .

If the positive authority is confirmed as the user, the access is allowed, and if the positive authority is not granted, access is denied (S590).

In the above-described content access rights control method, the user rights and content rights can be managed through a separate table.

FIG. 6A illustrates an example of a user authority table that manages user's information and authority granted to the user in the above-described method for controlling content access rights of the present invention, and (b) shows content defined for each content The authorization table is an example.

Referring to FIG. 6A, each entry of the user authority table includes a user ID for distinguishing a user by setting a unique value for each user, a group ID indicating a group, a job title, or a position to which the user belongs. Including a user name, displays the user's name. In addition, in the case of a corporate portal, it may further include a company identification ID indicating a corresponding company.

Referring back to (a) of FIG. 6, two user rights are granted to the user 'Hong Gil-dong' identified by the user ID u00001. One is administrator (ADMIN) authority and the other is authority of group belonging to G0001. As such, each user may be granted one or more privileges.

Subsequently, referring to FIG. 6B, in the content rights table for managing rights granted for each content through the same process as in FIG. 3, each entry represents one right, and each entry has a right defined content. Service identification ID for classifying the information, object identification information indicating an object having access authority of the corresponding content, type information of the corresponding authority, and information indicating an access type granted by the authority. In addition, as described above, it may further include a company identification ID.

In the above, the right type information should include information indicating whether it is a negative right or a positive right. In addition, the right type information may indicate whether the corresponding right is a virtual group right, a department right, a position right or a rank right. For example, in FIG. 6B, 'G' indicates virtual group authority, 'D' indicates department authority, 'P' indicates position authority, and 'T' indicates position authority. 'U' indicates user rights, and 'N' indicates negative rights that define no rights. In the above example, if the right type is 'N', the right is negative, and the rest are all positive rights.

In addition, the type of access of the authority corresponds to read, write and delete.

For example, referring to the content rights table shown in (b) of FIG. 6, five rights are defined for the content divided by 'F00001234', and three of the five defined rights are negative rights. to be. That is, group authority to grant read permission to the virtual group named 'COMMON' to which all users belong, group authority to grant read and write authority to the ADMIN group, and delete authority to user 'u00001'. It has the user right to grant the GUEST group, three negative rights to release the authorization to the user 'u00002' and the group 'G00002'.

That is, according to the example shown in (b) of FIG. 6, for the content identified by 'F00001234', all users except the GUEST group, the user 'u00002', and the user belonging to the group 'G00002' Can access and view the contents, the administrator can read as well as write the contents, and the user 'u00001' can delete the contents of the contents.

Referring to (a) and (b) of FIG. 6 again, the access right control process will be described again. For the content identified as 'F0001234', in step S510, the user right table as shown in FIG. See the authorization information of the user who requested access. And with reference to the content rights table as shown in FIG. 6 (b), to check the rights defined in the content requested access.

First, a comparison is made between a negative right in which the right type is set to 'N' and the user right in the content right table to determine whether the user corresponds to a target of the negative right. In the case of the user 'Hong Kil-Dong', since it does not correspond to the negative authority subject, the remaining positive authorities of the content authority table are checked again. In the case of the 'hong gil dong', it corresponds to the COMMON group, the ADMIN group, and the user 'uOOO01', therefore, a request for reading, writing, and deleting the content of the user, 'hong gil dong' is allowed.

7 is a block diagram illustrating an apparatus for controlling access to content according to the present invention. The access right control apparatus for the content controls access to all content provided in the server 13 of the portal service system shown in FIG. 1.

Referring to FIG. 7, when the authority setting of the content is requested, the apparatus for controlling access of content according to the present invention defines one or more positive rights and negative rights for the corresponding content, and adds them to the content rights table. A content authority for managing a positive authority for granting a right to grant access to the corresponding content defined for each content in the content authority generator 71 and a content right for releasing the authority granted to the corresponding content in the content right generator 71. A storage unit 72 for storing a table, a user authority table for managing user authority information defined for each user, and a content authority table and access stored in the storage unit 72 when a request for access to content is confirmed. Refer to the permissions table to use and use negative and positive rights for the content for which access is requested. The access control 73 for checking the authority information, rejecting the access request if the negative authority or the negative authority and the positive authority do not exist, and allowing access if the positive authority exists, and the authority according to the creation of the content And an interface unit 74 for receiving a setting request and an access request for each generated content and outputting a response to the request.

The content rights generation operation in the content rights generation unit 71 is performed as described above with reference to FIG. 3, and the process of controlling access for each content in the access control unit 73 is described above with reference to FIG. 5. This is done as described.

In addition, as described above with reference to (b) of FIG. 6, the content rights table is defined for each entry for each given authority, and each entry corresponds to a service classification ID for displaying the content for which the right is defined, and It includes an object identification ID indicating the object to which the authority is granted, an authority type indicating whether the authority is a positive authority or a negative authority, and authority detail information indicating an access type in which the authority is allowed.

As described above with reference to (a) of FIG. 6, the user authority table defines authority granted to each user for each entry, and each entry includes a user ID for identifying the user, a group to which the user belongs, and a job title. And a group ID indicating one of a job title, a job title, and a department. The user authorization table includes a new entry when a user first joins the portal site and when a new job title, job title, department, or group is assigned to the user. Is added.

The present invention described above is not limited to the above-described embodiment and the accompanying drawings, and various substitutions, modifications, and changes can be made without departing from the spirit of the present invention. It will be apparent to those skilled in the art.

As described above, the method and apparatus for controlling access to content according to the present invention can more efficiently and easily grant authority through a negative right defining permission release in managing access rights to content provided by a portal site. You can also easily adjust permissions to exclude some users from already created permissions.

Claims (12)

In the method of controlling the access rights of the content performed in the access control device of the content, An authorization permission granting step of granting at least one permission to allow access of the corresponding content for each content; A release authority granting step of granting at least one release authority for releasing an access right to the content when there is a target to be released from among the subjects to which the authority has been granted; And And an access control step of denying or allowing an access request for the content with reference to the granted permission and release permission. The method of claim 1, And registering and managing the granted permission and release rights in a content permission table. The method of claim 2, The entries in the content rights table are configured for each permission granted, and each entry includes a service classification ID indicating a content for which a corresponding permission is defined, a target classification ID indicating a target to which the corresponding permission is granted, and a corresponding permission. And a permission type indicating whether the permission is granted or released, and detailed information indicating the type of access to which the permission is permitted. The method of claim 3, The permission authority may include at least one of a group authority, a position authority, a department authority, a group authority, a department authority, a position authority, a position authority, and a user authority defined for each user. The method of claim 3, wherein the authority detail information includes at least one of read, write, and delete. The method of claim 3, wherein the access control step If access to the content is requested, checking the authority information of the user who requested access; Checking the release authority information defined in the corresponding content; Checking whether there is a release right granted to the user among the release rights defined in the identified corresponding content; Denying the requested access if there is a release right for the user as a result of the checking; If there is no release right for the user as a result of the checking, checking the permission right defined in the corresponding content; Checking whether there is a permission right granted to the user among the checked permission rights; And And if the user has the permission to be granted in the step, allowing the requested access, and if there is no permission to be granted to the user, denying the requested access. Way. The method of claim 6, The user authority information is checked in a user authority table including a user ID for identifying a corresponding user for each entry and a group ID indicating one of a group, a position, a position, and a department to which the user belongs. How to control permissions. Content permission table that manages the permission to grant the right to grant access to the corresponding content defined by content, and release permission to release the rights granted to the content, and user permission table that manages user permission information defined by user. Storage unit for storing; An interface unit for receiving a permission setting request according to generation of content and an access request for each generated content and outputting a response to the request; A content rights generation unit for defining one or more permission rights and release rights for the content and adding the content rights to the content rights table when the permission of content is requested through the interface unit; And When the request for access to the content is confirmed through the interface unit, the content authority table and the access stored in the storage unit are referred to the user authority table to check the release authority and the permission authority and the user authority information for the content requested to be accessed. The apparatus for controlling access rights of content including an access control unit for rejecting an access request if there is a release right, or if there is no release right and an allowable right, and allowing access if the right exists. The method of claim 8, The entries in the content rights table are configured for each permission granted, and each entry includes a service classification ID indicating a content for which a corresponding permission is defined, a target classification ID indicating a target to which the corresponding permission is granted, and a corresponding permission. And a permission type indicating whether the permission is granted or released, and detailed information indicating the type of access to which the permission is permitted. The method of claim 9, The permission authority may include at least one of group authority, position authority, department authority, group authority, department authority, position authority, position authority, and user authority defined for each user. The apparatus of claim 9, wherein the authority detailed information includes at least one of read, write, and delete. The method of claim 8, The user authority table defines an authority granted to each user for each entry, and each entry includes a user ID for identifying the user and a group ID indicating one of a group, a position, a position, and a department to which the user belongs. Device for access control of content, characterized in that confirmed in the user rights table.

Images