JP4882550B2 - Object management system, object management method, and computer program - Google Patents

Description

  The present invention relates to an object management system, an object management method, and a computer program that can set access authority to an object from a user such as document reference, editing, and copying, and more particularly to a user who is denied access to an object. The present invention relates to an object management system, an object management method, and a computer program in which an object manager or owner sets an access right.

  Along with the development of information technology, a system in which a resource object such as a document is converted into electronic data and used for a plurality of users on a network has become widespread. In this type of document management system, the concept of access authority that restricts access from a user, such as referencing, editing, and copying, for a registered document is common. In particular, with the expansion of the network usage range and the decentralization of systems, problems similar to computer security occur in a complex form, and access control to objects is an indispensable technical issue.

  As a typical method of access right management, an access control list (ACL) is known. The access control list generally has a structure in which principals (users, groups, etc.) permitted to access individual objects and access rights given are managed as a list for each object.

  Normally, the access right is set such that when the object is created, the access right of the parent object is taken over, or a user who accesses the object at the time of object creation adds. In addition, when editing an object after that, if a user who does not have access rights tries to access the object, a request is issued to the administrator, and the administrator must perform a procedure to grant the access right each time. There is a problem that it takes a lot of time and effort.

  For example, an access right setting device capable of setting an access right by a request from a user who uses a resource that can be used on a limited basis on a network has been proposed (see, for example, Patent Document 1). ). When the device receives access request information describing the access right setting contents such as resource, time, access content, etc. from a user whose access to the network resource is restricted, the device receives the access request information of the resource. It is transferred to the administrator, and the access right is set in response to the administrator confirming the request contents and giving approval.

  However, the user needs to create access request information and transfer it to the administrator when the use of resources is restricted. Further, the administrator must confirm the request contents. However, when the access request to the resource frequently occurs, the confirmation work becomes troublesome.

WO01 / 0820286

  An object of the present invention is to provide an excellent object management system, object management method, and computer program capable of suitably setting a user's access authority to an object such as document reference, editing, and copying. .

  A further object of the present invention is to provide an excellent object management system, an object management method, and a computer which can smoothly set an access right for a user who is denied access to an object by an administrator or owner of the object. To provide a program.

  The present invention has been made in consideration of the above-mentioned problems. The first aspect of the present invention is that storage means for storing an object and a user who has been given access rights to each object stored in the storage means. An access right information storage unit that stores access right information that associates an identifier with an access right that the user has, and the access right information storage unit when there is a request for access to an object stored in the storage unit Access control means for referring to the access right information stored in the means to determine whether the access request to the object is given to the user who requested the access, and to restrict access to the object; The identifier of the user whose access to the object is denied by the access control means, the access is denied An access denied user information storage means for storing access denied user information including an access right to the object and an identifier of the object to which access is denied, and an administrator or owner of the object stored in the storage means to the object An access denied user information presenting means for presenting the access denied user information, and a user included in the access denied user information presented by the access denied user information presenting means in response to a request from an administrator or owner of the object An object management system comprising an access right setting means for setting an access right in the access right information or changing a setting content.

  As a technique for managing objects on the network, an access control list is generally used. However, after an object is created, it is complicated to set a new access right for a user who wants to edit the object.

  Therefore, in the object management system according to the present invention, when the user cannot access the object, the information of the user who has not been able to access is recorded in a usable (readable and writable) state on the object management system. I am trying to keep it.

  When accessing the system, the owner of the object can call user information that could not access the object, for example, by simply clicking a button on the property screen of the object. In response to such a selection operation, a list of users that could not be accessed is displayed on the UI screen. The owner of the object can confirm the information of each user who is denied access to his / her object via this screen, and can set the access right for each user as necessary.

  The access right to the object generally includes a search display right, a read right, a write right, and the like. In the object management system according to the present invention, an administrator or owner of an object can select which access right is recorded by the user who accesses the object when the user information is recorded.

  For example, when the administrator or owner of an object wants to set only the read right among the access rights, if the fact is set in the system, the read right for the object is denied on the above-mentioned UI screen. Since only the user information is displayed in a list, it becomes easier for the administrator or owner of the object to check the user information.

  In addition, the second aspect of the present invention provides an access to an object based on a user who is given an access right to each object stored in the storage means and access right information that stores the contents of the access right held by the user. A computer program written in a computer-readable format so as to execute processing for controlling the computer on the computer, and the computer has requested access to the object stored in the storage means An access control procedure for referencing the access right information to determine whether the access request to the object is given to the user who requested the access, and to restrict access to the object; Users who are denied access to the object as a result of executing the control procedure An access denied user information storage procedure for storing access denied user information including an identifier, an access right to the object to which access is denied, and an identifier of the object to which access is denied; Access denied user information presentation procedure for presenting access denied user information and user access included in the access denied user information presented by the access denied user information presenting means in response to a request from an administrator or owner of the object An access right setting procedure for setting a right in the access right information or changing a setting content is executed.

  The computer program according to the second aspect of the present invention defines a computer program described in a computer-readable format so as to realize predetermined processing on the computer. In other words, by installing the computer program according to the second aspect of the present invention on the computer, a cooperative action is exhibited on the computer, and the same as the object management system according to the first aspect of the present invention. An effect can be obtained.

  According to the present invention, it is possible to provide an excellent object management system, object management method, and computer program capable of suitably setting user access authority to an object such as document reference, editing, and copying. .

  Further, according to the present invention, there are provided an excellent object management system, object management method, and computer program capable of smoothly setting an access right for a user who is denied access to an object by an administrator. be able to.

  Hereinafter, embodiments of the present invention will be described in detail with reference to the drawings.

  The present invention relates to an information management system for managing objects such as documents, drawings, images, schedule tables, folders, and the like, and it is possible to set access authority to an object from a user such as document reference, editing, and copying. FIG. 1 schematically shows a functional configuration of a document management system 1 according to an embodiment of the present invention.

  The document management apparatus 10 includes a control device 110 and a storage device 120. The document management apparatus 10 can actually be configured on a general computer system such as a personal computer (PC).

  The control device 110 includes an input / output device 111, a security management device 112, and a search device 113.

  The input / output device 111 performs data input / output operations with the client 20 via the network.

  The security management device 112 performs security management on a computer network such as authentication processing and encryption processing when performing data communication with the client 20 through the input / output device 111. Further, the security management device 112 determines whether or not the document whose document repository is to be searched by the search device 113 can be accessed according to the access authority of the client 20, and details thereof will be described later.

  The search device 113 searches for the corresponding document from the storage device 120 according to the search condition received from the client 20 through the input / output device 111. The search device 113 stores the past search history in the search database 123 and reuses the search database 123 when searching for a new document.

  The storage device 120 includes an access control list (ACL) database 121, an attribute database 122, a search database 123, and a document repository 124. The entity of the storage device 120 is an external storage device such as a hard disk locally connected to the document management device 10 or a large-scale storage device on a network.

  The ACL manages a list of users (or user groups) who are allowed to access the object and the access authority given (well-known), and the ACL database 121 stores an ACL for each object. is doing.

  The document repository 124 stores an entity of an object such as a document registered in the document management apparatus 10 or stores reference information to a storage location of the object entity. The attribute database 122 stores file names, outlines, descriptions, and the like for each document object registered in the document repository 124. In the search database 123, purpose information related to each document object stored in the document repository 124 (for example, information for searching for an object based on a search key) is stored in association with each other.

  The document management apparatus 10 according to the present embodiment introduces a mechanism in which information on a user who cannot access an object is recorded, and the owner of the object confirms the user information and sets an access right. FIG. 2 illustrates a functional configuration for realizing this mechanism.

  In the control device 110, the search device 113 uses the search database 123 and the attribute database 122 in response to an access request received from the client terminal 20 via the input / output device 111, and stores the object stored in the document repository 124. Perform a search.

  When the security management device 112 receives an access request from the client terminal 20 via the input / output device 11, the security management device 112 refers to the ACL database 121 and grants a legitimate access authority regarding the operation of the object requested by the user of the client terminal 20. Check if you have.

  In the present embodiment, the ACL database 121 includes an access right denial user storage unit 121 in addition to an access right list storage unit 121A that stores an ACL for each object.

  When the user cannot access the object, the security management apparatus 112 records the user information in the access right denied user storage unit 121B in a usable (readable and writable) state.

  The access right denied user storage unit 121B stores the identifier of the user whose access is denied, the denied access right, the identifier of the object whose access is denied, and the like in a usable state (readable and writable).

  When the administrator or owner of an object makes an access right setting request via the input / output device 111 as a user of the client terminal 20, the security management device 113 is denied access to the object managed or owned by the user. The user information read from the access right denied user storage unit 121B is output through the UI screen of the client terminal 20 to display a list of users who could not access the object.

  When the administrator or owner of the object clicks a button for displaying a specific access-denied user on this list display screen, the information on the user, the object whose access is denied, and the denied operation information Is read from the access denied user information storage unit 121B into the security management apparatus 113, and the access right is set in the access right list storage unit 121A.

  FIG. 3 shows a configuration example of an object property screen displayed on the UI screen of the object manager or owner. When a user who has management rights or ownership for an object displays the property screen, if there is a user who is denied access to the object, an “access right setting request” button shown in the figure is displayed.

  FIG. 4 shows a configuration example of a screen for displaying a list of users who have not been able to access an object, which is displayed when the “access right setting request” button is clicked.

  The administrator or owner of the object can list which user has been denied access with which access right for the object through the illustrated screen. When setting an access right for an access denied user, check the check box at the left end of the corresponding record and press the apply button to make an access right setting request.

  In response to this, an access right setting request is issued from the client terminal 20 operated by the administrator or owner of the object to the security management apparatus 113 in the document management apparatus 10, and the security management apparatus 113 follows the request. In the access right list storage unit 121A, the access right of the access denied user is newly registered, or the current registration content is changed.

  FIG. 5 shows a processing procedure for displaying the access denied user list shown in FIG. 4 in the form of a flowchart.

  When the “access right setting request” button is clicked on the access right setting UI screen shown in FIG. 3, an access right setting request is issued to the security management apparatus 113 in the document management apparatus 10 (step S1). ).

  Access rights to objects generally include search and display rights, read rights, write rights, etc., but the administrator or owner of an object is responsible for the user information when the user who accessed the object is denied. Can be selected. The security management apparatus 113 acquires the access right to be displayed from the access right information setting (step S2).

  Next, the security management apparatus 113 acquires information on the user whose access right set in step S2 is denied for the corresponding object from the access denied user information storage unit 121B (step S3).

  Then, the access right setting request list shown in FIG. 4 is created and displayed on the UI screen of the client terminal 20 operated by the manager or owner of the object.

  FIG. 6 shows a processing procedure for setting or changing the access right of the user who is denied access to the object in the form of a flowchart.

  The administrator or owner of the object can list which user is denied access with which access right for the object through the screen shown in FIG. When setting the access right for the access denied user, the check box at the left end of the corresponding record is checked and the apply button is pressed to make an access right setting request (step S11).

  In response to this, an access right setting request is issued from the client terminal 20 operated by the administrator or owner of the object to the security management device 113 in the document management device 10, and the security management device 113 accesses the security management device 113 according to this request. The access right of the access denied user is newly registered in the right list storage unit 121A, or the current registration content is changed (step S12).

  If the access right changing process fails, all subsequent processes are skipped, and this process routine is terminated.

  On the other hand, when the access right changing process is successful, the access right changing execution user is deleted from the access right list storage unit 121A (step S13), and the access right changing execution user is deleted from the access right denied user information storage unit 121B. (Step S14), and this processing routine is terminated.

  The present invention has been described in detail above with reference to specific embodiments. However, it is obvious that those skilled in the art can make modifications and substitutions of the embodiment without departing from the gist of the present invention. That is, the present invention has been disclosed in the form of exemplification, and the contents described in the present specification should not be interpreted in a limited manner. In order to determine the gist of the present invention, the claims should be taken into consideration.

FIG. 1 is a diagram schematically showing a functional configuration of a document management system 1 according to an embodiment of the present invention. FIG. 2 is a functional configuration diagram for explaining a mechanism in which information on a user who cannot access an object is recorded, and the owner of the object confirms the user information and sets an access right. FIG. 3 is a diagram illustrating a configuration example of an object property screen. FIG. 4 is a diagram illustrating a configuration example of a list display screen of users who cannot access an object. FIG. 5 is a flowchart showing a processing procedure for displaying a list of access denied users. FIG. 6 is a flowchart showing a processing procedure for setting or changing the access right of the user who is denied access to the object.

Explanation of symbols

DESCRIPTION OF SYMBOLS 1 ... Information management system 10 ... Document management apparatus 110 ... Control apparatus 111 ... Input / output device 112 ... Security management apparatus 113 ... Search apparatus 120 ... Storage apparatus 121 ... ACL database 122 ... Attribute database 123 ... Search database 124 ... Document repository 20 ... client

Claims (5)

Storage means for storing objects;
Access right information storage means for storing access right information in which an identifier of a user who is given access rights to each object stored in the storage means and an access right that the user has are associated with each object ;
When there is a request for access to the object stored in the storage means, the identifier of the user who is given the access right to each object and the access right that the user has, stored in the access right information storage means the door by referring to the access right information associated with each object, it is determined whether the requested access rights to the requested object to the requesting user of the access is granted, access to the object Access control means for restricting,
Access denied user information storage for storing access denied user information including an identifier of a user whose access to the object is denied by the access control means, an access right to the object whose access is denied, and an identifier of the object whose access is denied Means,
In response to the access right setting request from the user, the access right setting request is read out from the access denied user information storage means for the object that is managed or owned by the user who made the access right setting request, and the access right setting request is made. Access denied user information presenting means to be presented to the user ,
Included in the access-denied user information based on access-denied user information for an object managed or owned by the user presented by the access-denied user information presenting means in response to a request from the user who made the access right setting request Stored in the access right information storage means so that the user has an access right of the type in which the access included in the access denied user information is denied with respect to the object included in the access denied user information Access right setting means for setting or changing setting contents in the access right information;
An object management system comprising: An object management method for controlling access to an object based on access right information in which a user who is given access right to each object stored in a storage means and an access right that the user has are associated with each object. And
Access right information for storing, in the access right information storage means, access right information in which an identifier of a user who is given access rights to each object stored in the storage means and an access right held by the user are associated with each object. A memory step;
When there is a request for access to an object stored in the storage means, an access right that associates each object with the identifier of the user who is given the access right to each object and the access right that the user has An access control step of referencing the information to determine whether the requested access right to the requested object is granted to the user requesting the access, and to restrict access to the object;
In the access control step, the access denied user information including the identifier of the user who is denied access to the object, the access right to the object to which access is denied, and the identifier of the object to which access is denied is stored in the access denied user information storage means. An access denied user information storage step to store;
In response to the access right setting request from the user, the access right setting request is read out from the access denied user information storage means for the object that is managed or owned by the user who made the access right setting request, and the access right setting request is made. An access denied user information presentation step to be presented to the user ;
Included in the access denied user information based on the access denied user information for the object managed or owned by the user presented in the access denied user information presentation step in response to a request from the user who made the access right setting request Stored in the access right information storage means so that the user has an access right of the type in which the access included in the access denied user information is denied with respect to the object included in the access denied user information An access right setting step for setting or changing setting contents in the access right information;
An object management method comprising: A computer performs a process for controlling access to an object based on access right information in which a user who is given access right to each object stored in the storage means and an access right that the user has are associated with each object. A computer program written in a computer readable form for execution on the computer,
Access right information for storing, in the access right information storage means, access right information in which an identifier of a user who is given access rights to each object stored in the storage means and an access right held by the user are associated with each object. Storage procedure;
When there is a request for access to an object stored in the storage means, an access right that associates each object with the identifier of the user who is given the access right to each object and the access right that the user has An access control procedure for referring to the information to determine whether the requested access right to the requested object is granted to the user requesting the access, and to restrict access to the object;
As a result of executing the access control procedure, an access denied user information including an identifier of a user who is denied access to the object, an access right to the object whose access is denied, and an identifier of the object whose access is denied An access denied user information storage procedure stored in the information storage means ;
In response to the access right setting request from the user, the access right setting request is read out from the access denied user information storage means for the object that is managed or owned by the user who made the access right setting request, and the access right setting request is made. Access denied user information presentation procedure to be presented to the user ,
Included in the access denied user information based on the access denied user information for the object managed or owned by the user presented in the access denied user information presentation step in response to a request from the user who made the access right setting request Stored in the access right information storage means so that the user has an access right of the type in which the access included in the access denied user information is denied with respect to the object included in the access denied user information An access right setting procedure for setting or changing the setting contents in the access right information;
A computer program for running In response to the access right setting request being made on the object property screen displayed on the information processing apparatus used by the object manager or owner of the object, the access denied user information presentation procedure is executed .
The computer program according to claim 3, which is caused to be executed by the computer. In the access denied user information storage procedure, the access denied user information for which access to the object is denied is stored only for the access right of the content selected by the administrator or owner of the object.
The computer program according to claim 3.