JP2004046460A - File management system and access control system - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To set a different access right in accordance with an access from an in-house or an external even the access includes the same object by the same user. <P>SOLUTION: A client 70 delivers user information in accessing to the object, including a cabinet, a document or the like and the IP (Internet Protocol) address of a Web server used in logging to a file management server 30. The file management server 30 obtains installation information corresponding to the IP address registered in an available Web server installation information table 32 and retrieves the access right information on the object using the user information and the installation information as a key to determine the presence or absence of the access right to the object of the user. <P>COPYRIGHT: (C)2004,JPO

Description

[0001]
TECHNICAL FIELD OF THE INVENTION
The present invention relates to an access control method in a file management system, and more particularly to an access control method at the time of in-company / out-company login in a Web-based file management system.
[0002]
[Prior art]
Today, with the advancement of the Internet and other technologies, common workspaces (such as corporate wear) are provided both inside and outside the company and across company boundaries, and their needs are expanding. As described above, while the seamlessness of the file management system and the like is progressing, the security is increasingly required.
[0003]
By the way, as an access control method in a conventional file management system, an access right is made different depending on a terminal group (see Japanese Patent Application Laid-Open No. 02-282842), or the validity of access is changed according to a time zone (see Japanese Patent Application Laid-Open No. Various methods have been known for suppressing the contents of a presentation by a user (see Japanese Patent Application Laid-Open No. 03-154969).
[0004]
[Problems to be solved by the invention]
However, according to the conventional technology, the security level is the same regardless of whether a user accesses an object such as a cabinet, a folder, or a document (document) from inside the company or an object from outside the company. There is a problem that access is not possible even if there is a request from the company for security enhancement compared to the case where an object is accessed. The reason is that, in the file management server, access rights used for right authentication (Authorization) can be set in units of objects such as cabinets, folders, and documents. However, even when the same user accesses the same object from within the company, This is because, even when the same object is accessed from outside the company, the access right information set for the object is the same.
[0005]
An object of the present invention is to set different access rights for the same user to access the same object in a Web-based file management system depending on whether the access is from inside the company or from outside the company. An object of the present invention is to provide an access control method in a file management system.
[0006]
Another object of the present invention is to provide a Web-based file management system, in which even if the same user accesses the same object, the right is determined according to whether the access is from inside the company or from outside the company. An object of the present invention is to provide an access control method in a file management system in which authentication is made different.
[0007]
[Means for Solving the Problems]
The access control method in the file management system according to the present invention is based on a Web-based file management system that determines whether a user ID received from a client is registered in a user information list table when a client requests a login to a file management server. Check if the user ID is registered, check if the password received from the client matches the password registered in the user information list table corresponding to the user ID, and if the password matches Is an authentication server that acquires the user information of the user from the user information list table and returns it to the client, an instance ID indicating the target object, the user information obtained from the authentication server, and the Web A client that passes the IP address of the server to the file management server, a database that registers objects and access right information for each object, and an available Web server installation information table. When there is, the installation information corresponding to the IP address is acquired from the available Web server installation information table, the access right information of the target object is searched using the user information and the installation information as keys, and the user's access to the target object is performed. A file management server that determines whether the user has an access right, accesses the object when the user has the access right to the target object, and transmits an access result to the client.
[0008]
Further, in the access control method in the file management system of the present invention, the access right information indicates at least a request source indicating a user and whether a Web server passed at the time of login exists inside or outside a firewall. It is characterized by including installation information and whether or not the user has an access right to the object.
[0009]
Further, in the access control method in the file management system of the present invention, the available Web server installation information table includes an IP address of the Web server and installation information indicating whether the Web server exists inside or outside the firewall. And characterized in that:
[0010]
On the other hand, in the access control method in the file management system of the present invention, the client acquires user information as an authentication result from the authentication server when logging in to the file management server, and acquires the IP address of the Web server via which the client has passed. Passing the user information and the IP address to a file management server at the time of an access request to an object, and determining whether the IP address is registered in an available Web server installation information table by the file management server; A step in which the file management server obtains installation information corresponding to the IP address from the available Web server installation information table when the IP address is registered; Retrieving the access right information of the object to determine whether or not the user has the access right to the object; and when the user has the access right to the object, the file management server accesses the target object and returns the access result. The method includes a step of transmitting to the client and a step of receiving the access result of the object from the file management server by the client.
[0011]
On the other hand, the program according to the present invention includes, when logging in to the file management server, acquiring the user information as an authentication result from the authentication server and acquiring the IP address of the Web server that has passed through the computer; A step of passing the user information and the IP address to a file management server and a step of receiving an access result of an object from the file management server are performed.
[0012]
Further, the program of the present invention includes a step of determining whether an IP address is registered in a computer by referring to an available Web server installation information table, and a step of determining whether the available Web address is registered when the IP address is registered. A step of obtaining installation information corresponding to the IP address from a server installation information table; a step of searching access right information using the user information and the installation information as keys to determine whether the user has an access right to the object; Accessing the object when the user has the right to access the object, and transmitting the access result to the client.
[0013]
The present invention is characterized in that installation information (information inside / outside a firewall) of an in-house Web server or an external Web server that is passed when logging in to a file management server is used in right authentication performed by the file management server. Things. When a user logs in to a file management server from a client via an internal Web server, the user can access an object to be accessed (hereinafter, referred to as a target object), while the client manages the file via an external Web server. When logging in to the server, the target object cannot be accessed. For this reason, the installation information of the Web server is used as it is as part of the access right information from the user to the file management server.
[0014]
BEST MODE FOR CARRYING OUT THE INVENTION
Hereinafter, embodiments of the present invention will be described in detail with reference to the drawings.
[0015]
[First Embodiment]
FIG. 2 is a system configuration diagram of a file management system to which the access control method according to the first embodiment of the present invention is applied. This file management system is connected to an in-house network 10 such as a local area network (LAN), an authentication server 20 connected to the in-house network 10, a file management server 30 connected to the in-house network 10, and to the in-house network 10. Web server (hereinafter referred to as an internal Web server) 40, a firewall 50 connected to the internal network 10, a firewall 50 and a Web server (hereinafter referred to as an external Web server) 60 connected to an external line such as the Internet. And a plurality of clients 70 that log in to the file management server 30 via the in-company Web server 40 or the external Web server 60.
[0016]
Referring to FIG. 1, the authentication server 20 includes an authentication unit 21 and a user information list table 22.
[0017]
FIG. 3 shows a data structure diagram of the user information list table 22 managed by the authentication server 20. In the user information list table 22, user information including a user ID (IDentification), a user name, a password, a department ID, a department name, and the like of a user who is permitted to log in to the file management server 30 are registered and managed collectively. Have been.
[0018]
Referring to FIG. 1, the file management server 30 includes a database 31 and an available Web server installation information table 32.
[0019]
The database 31 hierarchically holds objects such as cabinets and documents in a tree shape, and each object has access right information (A *) (* represents a wild card) as an attribute. . Each object (instance) has a unique instance ID automatically generated at the time of registration on the database 31, and the instance ID is used to specify the object. The instance ID is passed from the client 70 to the file management server 30 together with the user information (P1) and the IP address (IP1) of the internal Web server 40 or the external Web server 60. In the example of FIG. 1, the database 31 includes “cabinet” and “document D1”, “document D2”, and “document D3” under the “cabinet”. In the “document D1”, the access right information A1 is registered as an attribute (the same applies to other objects).
[0020]
Referring to FIG. 4, the access right information (A *) is managed in one table for each object, and is formed of a combination of conditional expressions (AND condition, OR condition, etc.) using user information (P *). Can be set with. The access right information (A *) includes a request source, a position range, installation information, and presence / absence of an access right (reference right, update right, and delete right). The request source is a character string representing a user, a department, etc. In the position range, for example, a name, a department name, a place of work, a position, and the like are stored. The installation information is a condition that the user logs in to the file management server 30 via the in-house Web server 40 or the out-of-office Web server 60 (0 in the in-house Web server 40 and 1 in the outside Web server 60). The presence / absence of the access right (reference right, update right, and delete right) is represented as ○ or × for easy understanding, but is managed as a numerical value on the database 31.
[0021]
In the file management server 30, reference rights, update rights, deletion rights, and the like are defined as types of access rights that can be set for objects such as cabinets and documents. For example, when a reference to an object is requested from the client 70, the file management server 30 performs right authentication to determine whether the requesting user has a reference right to the target object.
[0022]
The file management server 30 incorporates the installation information of the in-house Web server 40 or the out-of-office Web server 60 as one category of the access right information, so that the user can access the target object when authenticating the right by accessing the in-house Web server. Only the access right information (A *) that is compatible with the installation information of the Web server 40 or the external Web server 60 is subjected to the right authentication (determined by being divided into two).
[0023]
FIG. 5 is a diagram showing a data structure of the available Web server installation information table 32. The available Web server installation information table 32 is a file management system in which an IP address and installation information indicating whether the Web server is installed inside or outside the firewall 50 (0 when inside the firewall 50, 1 when outside the firewall 50) are recorded as files. Only the number of registered internal Web servers 40 and the number of external Web servers 60 that can be used to log in to the server 30 are registered. The file management server 30 authenticates the right of the user for the object based on the user information and the IP address and the available Web server installation information table 32.
[0024]
The file management server 30 cannot determine which of the inside and outside of the firewall 50 the user has logged in to, via the web server installed inside or outside the firewall 50, based on only the IP address (IP1) of the via web server passed from the client 70. The installation information is registered in advance in 30 available Web server installation information tables 32.
[0025]
Referring to FIG. 6, the user authentication (Authentication) process in the authentication server 20 includes a user ID registration determination step S101, a password validity determination step S102, and a user information return step S103.
[0026]
Referring to FIG. 7, the rights authentication (Authorization) process in the file management server 30 includes an IP address registration determination step S201, an installation information acquisition step S202, an object existence determination step S203, a user access right presence / absence determination step S204, It comprises an object return step S205.
[0027]
Next, the operation of the access control method in the file management system according to the first embodiment thus configured will be described.
[0028]
(1) User authentication (Authentication) by the authentication server 20
[0029]
The user needs to log in to the file management server 30 from the client 70 via the internal Web server 40 or the external Web server 60 before accessing the object of the file management server 30. The user usually logs in to the file management server 30 from the client 70 connected to the in-house network 10 via the in-house Web server 40 installed in the firewall 50. However, when logging in to the file management server 30 from a client 70 at a business trip or at home, the user can log in to the file management server 30 only through the external Web server 60 installed outside the firewall 50. It is. However, it is possible for a user to access an object from inside the company via the external Web server 60 unless the firewall 50 restricts the object.
[0030]
When a user logs in to the file management server 30 from the client 70 via the internal Web server 40 or external Web server 60, user authentication by the authentication server 20 is performed.
[0031]
Specifically, the user inputs a user ID and a password from the login screen of the client 70, and requests a login to the file management server 30. At this time, communication between the client 70 and the authentication server 20 is performed, and user authentication by the authentication server 20 is performed. Communication between the client 70 and the file management server 30 is performed by the client 70 by performing operations such as acquisition of an attribute list, update confirmation on an update screen, acquisition of a subordinate list of cabinets and folders, and deletion of a target. This is the time when the button was pressed.
[0032]
The authentication server 20 first checks whether the user ID received from the client 70 is registered in the user information list table 22 (Step S101). If the user ID has not been registered, the authentication server 20 returns an error to the client 70.
[0033]
If the user ID has been registered, the authentication server 20 checks whether the password received from the client 70 matches the password registered in the user information list table 22 corresponding to the user ID (step S102). ). If the passwords do not match, the authentication server 20 returns an error to the client 70.
[0034]
If the passwords match, the authentication server 20 acquires the user information (P1) of the user from the user information list table 22 and returns it to the client 70 (step S103), and ends the processing.
[0035]
At the same time as logging in to the file management server 30, a cabinet list table (not shown) is acquired, and a user-specific cabinet list table is usually displayed on the screen of the client 70. The objects displayed in the cabinet list table are only those for which the logged-in user has an access right, and only some attributes of each object are displayed in the cabinet list table.
[0036]
(2) Authorization in File Management Server 30
[0037]
After the cabinet list table (not shown) unique to the user is displayed on the screen of the client 70, when the user requests access to the object from the client 70, the file management server 30 determines whether the requesting user has access to the object. Rights authentication is performed to determine whether or not an object (hereinafter, referred to as a target object) has access rights.
[0038]
First, the client 70 passes the instance ID indicating the target object to the file management server 30 together with the user information obtained from the authentication server 20 and the IP address (IP1) of the internal Web server 40 or external Web server 60.
[0039]
The file management server 30 performs user right authentication for the target object based on the user information (P1) obtained by the user authentication and the IP address (IP1) of the internal Web server 40 or the external Web server 60 that has passed. .
[0040]
Here, consider a case where the user H (user information P1) requests a reference to the "document D1" (see FIG. 5). It is assumed that the access right information (A1) shown in FIG. 5 is set as the attribute of the user H that is the request source in the “document D1”.
[0041]
When the user H makes a reference request for “document D1” while displaying the object list under “cabinet” on the client 70 (only a part of the attributes of “document D1” is displayed) (presses the reference button). Then, the client 70 passes the user information (P1) and the IP address (IP1) of the via Web server (the internal Web server 40 or the external Web server 60) to the file management server 30.
[0042]
First, the file management server 30 determines whether or not the IP address (IP1) of the via Web server passed from the client 70 is registered in the available Web server installation information table 32 (Step S201).
[0043]
If the IP address (IP1) is registered in the available Web server installation information table 32, the file management server 30 sets the installation information (0 inside the firewall 50 and 1 outside the firewall 50) corresponding to the IP address of the passing Web server. ) Is obtained (step S202).
[0044]
Next, the file management server 30 checks whether “document D1” exists in the database 31 based on the instance ID (Step S203). The file management server 30 collectively manages a list table corresponding to the objects existing on the database 31, and performs a comparison process between the instance ID and the data of the list table.
[0045]
If “document D1” exists on the database 31, the file management server 30 performs right authentication to determine whether the requesting user H has the reference right to “document D1” (step S204). More specifically, the file management server 30 first acquires the access right information (A1) of “document D1”. At this time, if the IP address of the via Web server is registered in the available Web server installation information table 32, and if the installation information corresponding to the IP address is determined to be 0, the file management server 30 transmits the “user H Only the condition "can be referenced and updated" can be subject to rights authentication. Therefore, in this case, the file management server 30 determines that the user H has the reference right and the update right of the “document D1”.
[0046]
Next, the file management server 30 acquires the document D1 and its attributes from the database 31 and returns them to the client 70 (Step S205).
[0047]
Upon receiving the document D1 and its attributes from the file management server 30, the client 70 can refer to them.
[0048]
In the above description of the operation, the case where the access is a reference has been described as an example, but it goes without saying that almost the same operation is performed even when the access is an update and a deletion.
[0049]
Also, the case where the object is a document has been described as an example, but it goes without saying that access control to the object can be performed not only for each document but also for each folder or each cabinet.
[0050]
As described above, according to the first embodiment, by providing a mechanism for performing the right authentication in consideration of whether the Web server that passes through when logging in to the file management server 30 exists inside the company or outside the company. Regarding access to the same object from the same user, the right authentication can be made different depending on whether the access is from inside the company or from outside the company. For example, regarding access to the same object from the same user, reference can be made from inside the company or from outside the company, but updating can be prohibited only from inside the company.
[0051]
[Second embodiment]
FIG. 8 is a block diagram showing a configuration of an access control method in the file management system according to the second embodiment of the present invention. The access control method in the file management system according to the present embodiment is different from the access control method in the file management system according to the first embodiment shown in FIG. The only difference is that the file management server 30 has a file management server program 300.
[0052]
The authentication server program 200 is read by the authentication server 20, which is a computer, and controls the operation of the authentication server 20 as an authentication unit 21 and a user information list table 22. The operation of the authentication server 20 under the control of the authentication server program 200 is exactly the same as the operation of the authentication server 20 in the first embodiment, and therefore, detailed description thereof is omitted.
[0053]
The file management server program 300 is read by the file management server 30 as a computer, and controls the operation of the file management server 30 as a database 31 and an available Web server installation information table 32. The operation of the file management server 30 under the control of the file management server program 300 is exactly the same as the operation of the file management server 30 in the first embodiment, and thus the detailed description is omitted.
[0054]
【The invention's effect】
A first effect is that by expanding the range of conditions that can be set as access rights, an access control function corresponding to diversifying user usage situations can be provided. The reason is that there is provided a mechanism for performing the right authentication in consideration of whether the Web server that passes through when logging in to the file management server exists inside the company or outside the company.
[0055]
The second effect is that it is possible to enhance security in connection with it. The reason is that, for example, regarding access to the same object from the same user, reference can be made from within the company or from outside the company, but updating can be prohibited only from inside the company. .
[Brief description of the drawings]
FIG. 1 is a block diagram showing a configuration of an access control method in a file management system according to a first embodiment of the present invention.
FIG. 2 is a system configuration diagram of a file management system to which an access control method according to a first embodiment is applied.
FIG. 3 is a data structure diagram of a user information list table managed by the authentication server in FIG. 1;
FIG. 4 is a data structure diagram of access right information managed by a database in FIG. 1;
FIG. 5 is a data structure diagram of an available Web server installation information table in FIG. 1;
FIG. 6 is a flowchart illustrating a user authentication process in the authentication server in FIG. 1;
FIG. 7 is a flowchart showing a rights authentication process in the file management server in FIG. 1;
FIG. 8 is a block diagram illustrating a configuration of an access control method in a file management system according to a second embodiment of the present invention.
[Explanation of symbols]
10. In-house network
20 Authentication server
21 Authentication means
22 User information list table
30 File management server
31 Database
32 Available Web Server Installation Information Table
40 In-house Web server
50 Firewall
60 Outside Web server
70 Client
200 Authentication server program
300 File management server program
S101 User ID registration determination step
S102 Password validity determination step
S103 User information return step
S201 IP address registration determination step
S202 Installation information acquisition step
S203 Object existence determination step
S204 User access right presence / absence determination step
S205 Object return step

Claims (6)

In a web-based file management system,
When the client requests a log-in to the file management server, it checks whether the user ID received from the client is registered in the user information list table, and if the user ID is registered, the password received from the client is the password of the user. Check if the password matches the password registered in the information list table corresponding to the user ID, and if the password matches, obtain the user information of the user from the user information list table and return it to the client An authentication server,
A client that passes an instance ID indicating a target object, user information obtained from the authentication server, and an IP address of a Web server passed at the time of login to the file management server;
A database for registering objects and access right information for each object, and an available Web server installation information table, wherein when a client requests access to the object, the available Web server installation information table The installation information corresponding to the IP address is acquired, the access right information of the target object is searched using the user information and the installation information as a key, and it is determined whether the user has the access right to the target object. A file management server for accessing the object when the user has the right and transmitting the access result to the client. The access right information includes, at least, a request source indicating a user, installation information indicating whether a Web server through which the user has logged in is present inside or outside a firewall, and whether or not the user has an access right to an object. The access control method in the file management system according to claim 1, wherein the access control method includes: 2. The file according to claim 1, wherein the available Web server installation information table includes an IP address of the Web server and installation information indicating whether the Web server exists inside or outside a firewall. An access control method in the management system. A step in which the client obtains the user information as an authentication result from the authentication server when logging in to the file management server, and obtains the IP address of the Web server passed through;
A step in which a client passes the user information and the IP address to a file management server when requesting access to an object;
A step of the file management server determining whether or not the IP address is registered in the available Web server installation information table;
A step in which a file management server acquires installation information corresponding to the IP address from the available Web server installation information table when the IP address is registered;
A step in which the file management server searches the access right information of the target object using the user information and the installation information as keys to determine whether the user has an access right to the object;
When the user has access to the object, the file management server accesses the target object and sends the access result to the client;
Receiving an access result of an object from a file management server by a client. Acquiring a user information as an authentication result from an authentication server when logging in to a file management server, and acquiring an IP address of a web server via the computer; A program for executing a step of passing to a file management server and a step of receiving an access result of an object from the file management server. Determining whether the computer has registered an IP address with reference to an available Web server installation information table; and, when the IP address has been registered, determining the IP address from the available Web server installation information table. Obtaining the installation information corresponding to the user, searching the access right information using the user information and the installation information as a key to determine whether the user has the access right to the object, and having the user have the access right to the object. And accessing the object when the device is running, and transmitting the access result to the client.

Images