JP6323109B2 - Document management system, key-value store apparatus, document management method, and program - Google Patents

Description

  The present invention relates to a document management system for document management, a key-value store device used therefor, a document management method, and a program for realizing them.

  Conventionally, document management systems for thousands to tens of thousands of end users are known. In the document management system, reference permission / inhibition control is performed by determining an access right for each user who accesses the document management system. In such a document management system, frequently accessed target documents are biased toward some documents, for example, common notification documents for all employees, the entire department, or managers or higher.

  In the document management system, document information is stored in a database in which a secondary storage device such as a hard disk is a storage destination because the number of documents is large and the document size is large. The secondary storage device is characterized in that the access performance is lower than that of the memory, but the cost per capacity is lower.

  By the way, when a Web application server is used as a front end of a document management system, a large number of reference requests from a plurality of Web application servers are made to a single document management system in a short time immediately after the start of work in the morning. For this reason, the concentration of access to the document management system causes a decrease in throughput, resulting in a problem that system performance deteriorates. This is because in the document management system, it is necessary to retrieve the access right information held in the database each time and perform access right determination, and it takes time to obtain information from the secondary storage device.

  In recent years, a key value store (KVS) has been proposed as one of methods for storing and managing data (see, for example, Patent Documents 1 and 2). In KVS, the data to be saved is saved as a pair together with the key set corresponding thereto, so that the data can be read at a high speed because it is only necessary to specify the set key. . Therefore, if KVS is used for management of access authority information of the document management system, it is considered that deterioration of system performance is suppressed.

JP 2011-8451 A JP 2013-37551 A

  By the way, as described above, if KVS is used for management of access authority information, it is considered that degradation of system performance is suppressed to some extent. However, the following problems cannot be solved by simply combining KVS with a conventional document management system.

  First, in the document management system, access right determination for a certain document is executed for each user to be referred to. Therefore, even when the access right is granted to other users, the information cached after the access right is judged on the Web application server side can be used only by the user who requested the reference. It is not available for reuse. For this reason, the conventional document management system has a problem that the memory efficiency in the cache is low, and the efficiency of the access authority determination process is not sufficient.

  Second, when the access authority information is updated on the document management system side, it is necessary to discard the memory cache on the Web application server side. Also in this respect, the efficiency of the access authority determination process is insufficient. In addition, when there are a plurality of Web application servers, it is necessary to discard the cache in all the Web application servers, and the efficiency of the access authority determination process is further insufficient.

  In addition, in a conventional document management system, when the system has been operated for many years and a large amount of documents already exists, the system performance is improved without changing the database or updating the data. There is also a problem that is difficult.

  An example of an object of the present invention is to provide a document management system, a key value store device, a document management method, and a program capable of solving the above-described problem and improving the access authority determination process when managing the access authority. Is to provide.

In order to achieve the above object, a document management system according to one aspect of the present invention includes a document management device that manages a document, and a key-value store device.
The document management apparatus includes:
An access authority determination unit that determines the presence or absence of the access authority of the request source in response to a document access request from the user;
A management processing unit that, when it is determined that the access authority is determined, permits access by the request source and outputs access authority information for specifying the access authority to the key value store device,
The key value store device
Memory,
A storage processing unit that stores the output access authority information that has been output in the memory in a key-value store format;
When the access authority information about the document that is the target of the access request is stored in the memory, the access authority information stored in the memory is used as a key from the access authority information stored in the memory. Extracting the attribute condition of the user permitted to access the document, further calculating a product set of the extracted attribute condition and attribute information specifying the attribute of the requesting user, and based on the result of the operation, In place of the access authority determining unit, an arithmetic processing unit that determines the presence or absence of access authority is provided,
It is characterized by that.

In order to achieve the above object, a key value store apparatus according to an aspect of the present invention provides:
Memory,
A storage processing unit that stores the access authority information that specifies the access authority that has been output from a device that determines the presence or absence of access authority in response to an access request from a user in the memory in a key-value store format;
When the access authority information about the target of the access request is stored in the memory, the access of the target is determined from the access authority information stored in the memory using the target of the access request as a key. The attribute condition of the permitted user is extracted, and further, a product set of the extracted attribute condition and attribute information specifying the attribute of the requesting user is calculated. And an arithmetic processing unit for determining the presence or absence of access authority.
It is characterized by that.

In order to achieve the above object, a document management method according to an aspect of the present invention is a document management method using a document management device that manages a document and a key-value store device, and
(A) by the document management apparatus, in response to a document access request from a user, determining the presence or absence of access authority of the request source;
(B) If it is determined in step (a) that access authority is granted, the document management apparatus permits access by the request source, and access authority information for specifying the access authority is converted into the key value Outputting to the store device,
(C) storing the access authority information output by the key-value store device in a memory in a key-value store format;
(D) The access authority information stored in the memory with the access request information as a key when the access authority information for the document requested to be accessed is stored in the memory. The attribute condition of the user permitted to access the document is extracted, and the intersection of the extracted attribute condition and the attribute information specifying the attribute of the requesting user is calculated, and the result of the calculation is calculated. On the basis of the document management device instead of determining the presence or absence of access authority; and
It is characterized by having.

Furthermore, in order to achieve the above object, a program according to one aspect of the present invention is provided.
By computer
(A) storing access authority information specifying the access authority, which is output from a device that determines whether or not there is an access authority in response to an access request from a user, in a memory of the computer in a key-value store format; Steps,
(B) When the access authority information about the target of the access request is stored in the memory, the target from the access authority information stored in the memory with the target of the access request as a key The attribute condition of the user who is permitted to access is extracted, and the intersection of the extracted attribute condition and the attribute information specifying the attribute of the requesting user is calculated, and based on the result of the calculation, Instead of the device, a step of determining whether or not there is an access authority is executed.

  As described above, according to the present invention, it is possible to improve the access authority determination process when managing access authority.

FIG. 1 is a configuration diagram showing the configuration of a document management system according to an embodiment of the present invention. FIG. 2 is a diagram showing an example of the data structure of information stored in the memory of the key-value store apparatus in the embodiment of the present invention. FIG. 3 is a diagram showing an example of types of user attribute information used in the embodiment of the present invention. FIG. 4 is a diagram showing an example of a hierarchical structure of an organization used in the embodiment of the present invention. FIG. 5 is a flowchart showing the operation of the Web application server device 40 connected to the document management system in the embodiment of the present invention. FIG. 6 is a sequence diagram showing the operation of the document management system according to the embodiment of the present invention, and shows a registration process for dividing the access right to the key / value store apparatus. FIG. 7 is a sequence diagram showing the operation of the document management system according to the embodiment of the present invention, and shows a process for determining whether or not there is an access authority in the key-value store apparatus. FIG. 8 is a diagram illustrating the concept of the set operation. FIG. 9 is a diagram illustrating a specific example of the calculation result. FIG. 10 is a flowchart showing the operation of the document management system in the embodiment of the present invention, and shows processing when access authority information is updated or deleted in the document management apparatus. FIG. 11 is a diagram showing a performance comparison between a conventional document management system and the document management system according to the embodiment of the present invention. FIG. 12 is a block diagram illustrating an example of a computer that implements the key-value store apparatus according to the embodiment of the present invention.

(Summary of Invention)
In general, it is said that the information acquisition speed from the memory is tens of thousands to hundreds of thousands times faster than the information acquisition speed from the hard disk. Therefore, information retrieval using a key-value store (KVS) that holds information on a memory is significantly faster than information retrieval in a file system or database constructed with a hard disk.

  Therefore, in the present invention, access authority information is stored in a KVS having a set operation function. If there is access authority information stored in the KVS at the time of the document reference request from the user, the KVS performs a set operation of the access authority information and the attribute information sent from the user, and the operation result is obtained. Based on this, the presence / absence of the access right is determined. In other words, according to the present invention, access right determination is performed at high speed on the KVS memory, not on the device that manages the document.

  As described above, according to the present invention, when the access authority information is cached in the KVS, the presence / absence of the access authority is determined on the KVS without accessing the document management apparatus. Therefore, according to the present invention, a reduction in system throughput due to concentration of access to the document management system is suppressed.

  In the present invention, the access authority information used for determining the access right is cached on the KVS, so that the access authority information can be shared among users, and the memory efficiency in the cache can be improved.

  Conventionally, when a document reference request is made via a plurality of Web application servers, it is necessary to cache access authority information for each Web application server in order to speed up access authority determination. Therefore, in order to ensure the atomicity of the access authority information, it is necessary to discard the caches on all Web application servers when updating the access authority information.

  On the other hand, in the present invention, when the access authority information is updated, the atomicity of the access authority information can be ensured only by discarding the cache in the KVS according to an instruction from the document management side.

  In addition, the system speed can be increased simply by adding the key value store device of the present invention to an existing document management system. At that time, it is necessary to change any existing database or data stored in the database. Absent.

(Embodiment)
Hereinafter, a document management system, a key / value store apparatus, a document management method, and a program according to an embodiment of the present invention will be described with reference to FIGS.

[System configuration]
First, the configuration of the document management system and the key-value store apparatus constituting the document management system according to the embodiment of the present invention will be described with reference to FIG. FIG. 1 is a configuration diagram showing the configuration of a document management system according to an embodiment of the present invention.

  As shown in FIG. 1, the document management system 100 according to the present embodiment includes a document management apparatus 10 that manages documents and a key-value store apparatus 20. In the present embodiment, the document management apparatus 10 is connected to a document database 30 that stores a large number of documents.

  The document management apparatus 10 includes an access authority determination unit 11 and a management processing unit 12. The access authority determination unit 11 determines the presence or absence of the access authority of the request source in response to a document access request from the user. When the management processing unit 12 determines that the user has access authority, the management processor 12 permits access by the request source and outputs access authority information specifying the access authority to the key value store device 20.

  The key / value store device 20 includes a memory 21, a storage processing unit 22, and an arithmetic processing unit 23. The storage processing unit 22 stores the access authority information output from the document management apparatus 10 in the memory 21 in the key value store format.

  When the access authority information for the document requested to be accessed is stored in the memory 21, the arithmetic processing unit 23 first stores the access authority stored in the memory 21 using the requested document as a key. The attribute condition of the user who is permitted to access the document is extracted from the information. Further, the arithmetic processing unit 23 calculates a product set of the extracted attribute condition and attribute information specifying the attribute of the requesting user, and based on the result of the calculation, the access authority determining unit 11 of the document management apparatus 10. Instead of determining whether there is access authority.

  In the conventional document management system, both the document data and the access authority information given to the document are stored in the document database, so that access to the document database occurs every time the presence / absence of access authority is determined. On the other hand, in the first embodiment, the access authority information that has been used once is cached in the key / value store device 20, and in this case, the presence / absence of the access authority is determined in the key / value store device 20. Performed by logical operation. For this reason, according to the present embodiment, the number of times of determination of presence / absence of access authority in the document management apparatus 10 can be reduced, and the access authority determination process can be made more efficient.

  Here, the configuration of the document management system 100 and the key value store apparatus 20 in the present embodiment will be described more specifically. First, as shown in FIG. 1, in the present embodiment, a server device that provides a Web application program (hereinafter referred to as “Web application server device”) is connected to the document management system 100. . In the present embodiment, the application program is not limited to the Web application program.

  In addition, the user can use a Web application program provided by the Web application server device via a Web browser installed in the terminal device 50 of the user. In the present embodiment, when a user wants to access a document stored in the document database 30, the user first accesses the Web application server from the Web browser.

  The web application server device 40 includes a document access unit 41. When there is an access from a user, the document access unit 41 performs user authentication by a directory server 60 described later. When user authentication is permitted, the document access unit 41 acquires user attribute information stored in the directory server 60 and accepts a document access request from the user.

  When the document access unit 41 receives a document access request from the user, the document access unit 41 first checks with the key value store device 20 whether the access authority information is stored in the memory 21. When the key / value store apparatus 20 stores the access authority information in the memory 21, the key / value store apparatus 20 is caused to determine the presence / absence of the access authority. On the other hand, when the key value store device 20 does not store the access authority information in the memory 21, the document access unit 41 makes an access request to the document management device 10.

  When the key value store device 20 or the document management device 10 determines that the user has access authority, the document access unit 41 acquires the data of the document that is the target of the access request, and transmits the result to the terminal device 50. To do. In the example of FIG. 1, only a single terminal device 50 is shown, but a plurality of terminal devices 50 can access the Web application server 40 simultaneously. In the example of FIG. 1, only a single Web application server device 40 is illustrated, but a plurality of Web application server devices 40 may exist.

  In the present embodiment, in the document management apparatus 10, information that specifies a document that is permitted to be accessed, its operation, and user attribute conditions is used as the access authority information. Therefore, the access authority determining unit 11 determines the presence or absence of the access authority based on the information that specifies the document to which access is permitted, the operation thereof, and the attribute condition of the user. Further, the management processing unit 12 outputs to the key / value store device 20 information specifying the document to which access is permitted, the operation thereof, and the attribute condition of the user. In the present embodiment, the access authority information is stored in the document database 30 together with the document data.

  Furthermore, in the present embodiment, when the access authority information needs to be updated, the management processing unit 12 may instruct the key / value store apparatus 20 to discard the access authority information stored in the memory 21. it can. Then, the management processing unit 12 updates the access authority information on the condition that the discarding is completed.

  In the key value store apparatus 20, the storage processing unit 22 uses the output access authority information as the key information for the document and the operation specified by the key and the attribute condition of the user specified by the information as the value information. , And stored in the memory 21 as “set type” data. The data structure of information stored in the memory 21 will be described later.

  In the present embodiment, the arithmetic processing unit 23 identifies key information corresponding to the document that is the target of the access request, and based on the identified key information, stores the value information corresponding to the key information from the memory 21. Extract. Further, the arithmetic processing unit 23 calculates a product set of the extracted value information and attribute information (hereinafter referred to as “user attribute information”) that specifies the attribute of the requesting user, and the result of the calculation is the result. If the set remains, it is determined that the user has access authority. And the arithmetic processing part 23 transmits access authority information to the Web application server apparatus 40 as a result response.

  Further, in the present embodiment, the arithmetic processing unit 23 sets an upper limit value of the memory capacity, an upper limit value of the number of data, and the like, such as FIFO (First In First Out) and LRU (Least Recently Used). Old cache information can be automatically discarded according to the rules.

  Further, as shown in FIG. 1, in the present embodiment, a directory server 60 is connected to the Web application server device 40. As described above, the directory server 60 performs user authentication in order to confirm access authority to the document management system 100. Further, in response to a request from the Web application server device 40, the directory server 60 provides user attribute information such as belonging organization information, belonging group information, organization hierarchy information, etc. for the user who requested the access request.

  Here, the data structure of information stored in the key-value store apparatus 20 will be described with reference to FIGS. FIG. 2 is a diagram showing an example of the data structure of information stored in the memory of the key-value store apparatus in the embodiment of the present invention. FIG. 3 is a diagram showing an example of types of user attribute information used in the embodiment of the present invention. FIG. 4 is a diagram showing an example of a hierarchical structure of an organization used in the embodiment of the present invention.

  As shown in FIG. 2, the access authority information is stored in the memory 21 of the key-value store device 20 as set-type data that can be logically operated in the key-value store format.

  In FIG. 2, as key information (K) of the access authority information, a character string combining a document object ID and a label indicating a permission operation for the object is registered. Specifically, examples of the permission operation include a reference operation for overview information such as the document title and creator (label: OBJ_READ), and a reference operation for detailed information such as the document file body and history (label: OBJ_DETAIL). Examples of key information in this case include the following (1) and (2).

(1) OBJID / 01234 + OBJ_READ
(2) OBJID / 01234 + OBJ_DETAIL

  The above (1) represents the reference operation of the summary information in the document with the object ID “01234”. The above (2) represents the reference operation for the detailed information in the document with the object ID “01234”.

  In FIG. 2, as the value information (V), the user attribute conditions permitted for the object are registered. The user attribute conditions are set based on, for example, the hierarchical structure of the organization and the group to which the user belongs.

  Specifically, it is assumed that information “OS / PUBLIC” in which the organization ID shown in FIG. 3 is “PUBLIC” (see FIG. 4) is registered as the user attribute condition. In this case, all members of the subordinate organization of the organization whose organization ID is “PUBLIC” are permitted.

  As shown in FIG. 2, in the present embodiment, the user attribute information is also stored in the memory 21 as set type data. The user attribute information here represents the user attribute information of the user accessing the document management system, that is, the requesting user. Note that the user attribute information has been transmitted from the Web application server device 40. The Web application server device 40 transmits the user attribute information to the key value store device 20 at the timing when it is confirmed that the access authority information is stored in the memory 21.

  In the user attribute information, the user ID of the user is registered as the key information (K). As value information (V), a character string representing the user attribute information shown in FIG. 3 is registered. Specifically, the value information includes “_ / EVERYONE” representing all members, “U / <USER ID>” representing a user ID, “O / OFFICE ID” representing an immediately belonging organization ID, and an upper organization ID. “OS / <OFFICE ID>” indicating “G / <GROUP ID>” indicating the belonging group ID, “C / <COMPANY ID>” indicating the belonging company ID, and the like are registered.

  Further, although not shown in FIG. 3, an ID representing the belonging role may be registered. Further, as an example of the upper organization ID, for example, as shown in the organization hierarchy tree shown in FIG. 4, if an organization exists above the organization “OFC1-1-1”, “OS / PUBLIC” “OS / OFC1”, “OS / OFC1-1”, “OS / OFC1-1-1”, and “O / OFC1-1-1”. In the present embodiment, those who have special access rights such as document registrants and system administrators are not set as targets in the key value store device 20.

[System operation]
Next, the operation of the document management system 100 according to the embodiment of the present invention will be described with reference to FIGS. In the following description, FIGS. In this embodiment, the document management method is implemented by operating the document management system 100. Therefore, the description of the document management method in the present embodiment is replaced with the following description of the operation of the document management system.

  First, in the present embodiment, the document management system 100 operates in response to an access request from the Web application server device 40. First, the operation of the Web application server device 40 will be described with reference to FIG. FIG. 5 is a flowchart showing the operation of the Web application server device 40 connected to the document management system in the embodiment of the present invention.

  In FIG. 5, it is assumed that the user accesses the Web application server device 40 via the Web browser installed in his / her terminal device 50, and then is authenticated by the directory server 60. To do. Further, it is assumed that the Web application server device 40 has already acquired the user attribute information of the user from the directory server 60.

  First, as shown in FIG. 5, in the Web application server device 40, the document access unit 41 receives a reference request for a document designated by the user from the terminal 50 (step A1).

  Next, the document access unit 41 inquires of the key value store device 20 whether or not the access authority information related to the document requested for the access request is stored in the memory 21 (step A2). Next, the document access unit 41 determines whether access authority information exists based on the inquiry result (step A3).

  If the access authority information exists in the memory 21 as a result of the determination in step A3, the document access unit 41 uses the user value information of the requesting user acquired from the directory server 60 in advance as the key value store device. 20 (step A4). In this case, the user attribute information is stored in the memory 21 of the key value store device 20 (see FIG. 2).

  When step A4 is executed, in the key-value store device 20, the arithmetic processing unit 23 executes a product set operation (FIG. 7), and determines whether or not the requesting user has access authority. Then, the document access unit 41 confirms the determination result of the presence / absence of access authority (step A5).

  If the access right exists as a result of the determination in step A5, the document access unit 41 acquires the access right information from the key value store device 20 and transmits it to the document management device 10 (step A6). . Further, the document access unit 41 acquires document information from the document management apparatus 10.

  Thereafter, the document access unit 41 transmits the document information acquired in step A6 to the user terminal device 50. Thereby, the content of the document designated by the user is displayed on the screen of the terminal device 50.

  If the access authority information does not exist in the memory 21 as a result of the determination in step A3, the document access unit 41 requests the document management apparatus 10 to access the document designated by the user (step A8). ). Furthermore, even if the access authority does not exist as a result of the determination in step A5, the document access unit 41 executes step A8.

  After execution of step A8, the document management apparatus 10 determines whether or not there is an access authority, and the document access unit 41 acquires document information according to the determination result. Specifically, if the access right exists as a result of the determination, the document information is transmitted to the document access unit 41. On the other hand, if the access right does not exist as a result of the determination, a comment indicating that there is no access right is transmitted to the document access unit 41.

  In step A5, even though it is determined by the key / value store device 20 that no access authority exists, step A8 is executed only when a special access authority such as a document registrant or system administrator is executed. This is because the person who has the password is not set as the target in the key value store device 20.

  Next, the operation in the document management system 100 when the access authority information is registered in the memory 21 of the key / value store apparatus 20 will be described with reference to FIG. FIG. 6 is a sequence diagram showing an operation of the document management system in the embodiment of the present invention, and shows a process of registering access right information to the key value store apparatus.

  As shown in FIG. 6, first, the document access unit 41 requests the document management apparatus 10 to access a document designated by the user (step B1). Thereby, in the document management apparatus 10, the access authority determining unit 11 determines whether or not the requesting user has access authority (step B2), and notifies the management processing unit 12 of the determination result (step B3).

  Next, when the access authority exists, the management processing unit 12 acquires the document information (text data or the like) of the requested document from the document database 30, and uses the acquired document information as the Web application server device 40. (Step B4). Although not illustrated in FIG. 6, when the access authority does not exist, the management processing unit 12 transmits to the Web application server device 40 that the access authority does not exist.

  Furthermore, the management processing unit 12 transmits access authority information that identifies the access authority that is the object of determination to the key value store device 20 (step B5). Thereby, in the key value store device 20, the storage processing unit 22 stores the transmitted access authority information into the memory 21 separately into the key information and the value information (step B6: see FIG. 2). Thereby, the access authority information is cached in the memory, and it is possible to determine whether or not the key / value store apparatus 20 has the access authority.

  Next, a process for determining whether or not there is an access authority in the key / value store apparatus 20 will be described with reference to FIG. FIG. 7 is a sequence diagram showing the operation of the document management system according to the embodiment of the present invention, and shows a process for determining whether or not there is an access authority in the key-value store apparatus.

  As shown in FIG. 7, first, in the Web application server device 40, the document access unit 41 stores, in the key value store device 20, access authority information related to the document that is the target of the access request in the memory 21. Is inquired (step C1).

  Next, in the key value store device 20, the arithmetic processing unit 23 confirms the data stored in the memory 21 (step C2), and transmits the confirmation result to the web application server device 40 (step C3).

  In step C3, when it is notified that the access authority information exists, the document access unit 41 uses the user value information of the requesting user previously acquired from the directory server 60 as the key value store device. 20 (step C4). Although not shown in FIG. 7, user attribute information is also stored in the memory 21 (see FIG. 2).

  Next, the arithmetic processing unit 23 extracts key information (see FIG. 2) corresponding to the document requested to be accessed from the user attribute information, and inputs the extracted key information to the memory 21 (step C5). . Thereby, the memory 21 extracts value information corresponding to the input key information, and outputs this to the arithmetic processing unit 23 (step C6).

  Next, the arithmetic processing unit 23 calculates a product set of the extracted value information and the attribute information of the requesting user transmitted in step C4. If the result set remains as a result of the calculation, It is determined that access authority exists (step C7). On the other hand, when no result set remains, the arithmetic processing unit 23 determines that no access authority exists. And the arithmetic processing part 23 transmits a determination result to the web application server apparatus 40 (step C8). Thereafter, in the Web application server device 40, steps A6 and A7 or A8 and A9 shown in FIG. 5 are executed.

  Although not shown in FIG. 7, if there is no value information corresponding to the input key information, the value information is not output in step C6, so the arithmetic processing unit 23 has access authority. A message to the effect is transmitted to the Web application server device 40.

  In FIG. 7, the confirmation result transmitted in step C3 may be transmitted together with the determination result in step C8. In this case, step C4 is executed even if it is not notified that access authority information exists. However, step C3 is effective when the processing time at step C7 is equal to or longer than the processing time of steps C2 and C3.

  Next, the union calculation process shown in FIG. 7 will be described with reference to FIGS. FIG. 8 is a diagram illustrating the concept of the set operation. FIG. 9 is a diagram illustrating a specific example of the calculation result.

  As shown in FIG. 8, a product set of “a set of attribute conditions included in access authority information to be determined” and “a set of user attribute information of the accessing end user” is calculated. If any user attribute information remains as a result of the calculation, it is determined that access authority exists (access permission).

  Specifically, as shown in FIG. 9, it is assumed that USER1 tries to refer to the document 1 overview, the document 2 overview, the document 3 overview, and the document 1 details. In this case, the document 1 outline, the document 2 outline, and the document 1 details can be referred to because the user attribute information remains. On the other hand, since the user attribute information does not remain for the document 3 outline, the reference is not permitted.

  Next, an operation when access authority information is updated or deleted in the document management apparatus will be described with reference to FIG. FIG. 10 is a flowchart showing the operation of the document management system in the embodiment of the present invention, and shows processing when access authority information is updated or deleted in the document management apparatus.

  As shown in FIG. 10, first, in the document management apparatus 10, the management processing unit 12 receives an access authority information update request from the outside (step D1).

  Next, the management processing unit 12 specifies the object ID described in the received update request, and instructs the key / value store device 20 to discard the access authority information including the specified object ID (step D2). ).

  Next, the management processing unit 12 determines whether or not a notification that the discarding of the access authority information is completed is transmitted from the key value store device 20 (step D3).

  If the access authority information has been discarded as a result of the determination in step D3, the management processing unit 12 updates the corresponding access authority information in the document database 30 (step D4). Specifically, the management processing unit 12 commits a data update operation or a data deletion operation to the document database 30.

  As described above, in the present embodiment, on the document management system 100, the access authority information to be updated is discarded from the cache before being committed. Therefore, the access authority before being updated or deleted from the cache after the commit. Information is never read. For this reason, according to the present embodiment, the atomicity of the access authority information can be ensured.

  On the other hand, if the access authority information is not discarded as a result of the determination in step D3, the management processing unit 12 determines that the update error has occurred and treats the update request as a failure in order to maintain atomicity (step D5 ).

[Effects of the embodiment]
As described above, according to the present embodiment, the access authority information used once is cached in the key / value store apparatus 20. In this case, the presence / absence of the access authority is determined by calculating the intersection of the attribute condition of the access authority information and the user attribute information by the key / value store device 20. Further, the access authority information can be used not only for the requesting user but also for related users. From this point of view as well, it is possible to reduce the number of times the document management apparatus 10 determines whether there is an access authority. As a result, the throughput of the entire system can be improved, and the access authority determination process can be made more efficient.

  Further, in the key value store device, only the access authority information used for the access authority determination process is stored in the memory, so that the amount of data to be extracted can be reduced when extracting the data to be determined. Therefore, the access authority can be determined at high speed and efficiently.

  Furthermore, according to the present embodiment, the document management system according to the present embodiment can be constructed by adding a key-value store device to an existing document management system. At that time, the system can be speeded up without changing the document database and stored data.

  Even when access authority information needs to be updated or deleted, the cache is centrally managed by the key-value store device. Therefore, simply discarding the access authority information from the cache will reduce the atomicity of the access authority information. Can be maintained.

  Here, the effect of the document management system in the present embodiment will be described with reference to FIG. FIG. 11 is a diagram showing a performance comparison between a conventional document management system and the document management system according to the embodiment of the present invention.

  As shown in FIG. 11, the time taken to acquire data by information retrieval from a document database constructed with a hard disk or the like is about 100 [msec]. On the other hand, the time required to acquire data by information retrieval from the memory in the key / value store apparatus is 1 [msec].

  Therefore, as shown in FIG. 11, in the conventional document management system, it takes 200 [msec] in total to acquire the access right information and the document information from the database. On the other hand, in this embodiment, if the access authority information is stored in the key value store device, the time required for the same processing is 101 [msec].

  As a result, for example, when 1000 users access a company-wide notification document permitted to all, the time consumed by the entire document management system is 200 seconds (1000 people × 200 [msec]). However, in this embodiment, the time is reduced to 101 seconds (1000 people × 101 [msec]).

[Modification]
In the above-described embodiment, only the access permission function is described. However, in the present embodiment, an access denial function may be provided. This aspect uses attribute conditions for which access is denied as value information of access authority information, performs access denial determination prior to access permission determination, and determines access denial when the result of the intersection operation remains It is feasible.

  In the above example, the document access unit is built in the Web application server. However, the present embodiment is not limited to this, and the document access unit may be built in the user terminal device. good.

  In the present embodiment, the key value store device is used to determine the presence or absence of access authority in the document management system, but the present invention is not limited to this. The key value store device 20 may be used for determining whether or not there is an access authority for a page and a portlet in an EIP (Enterprise Information Portal), whether or not there is an access authority for a Web page, and the like.

[program]
The program in the present embodiment may be a program that causes a computer to execute step B6 shown in FIG. 6 and steps C2, C5, C6, and C7 shown in FIG. By installing and executing this program on a computer, the key-value store apparatus according to the present embodiment can be realized. In this case, a CPU (Central Processing Unit) of the computer functions as the storage processing unit 22 and the arithmetic processing unit 23 to perform processing.

  Here, a computer that realizes the key-value store apparatus by executing the program in the embodiment will be described with reference to FIG. FIG. 12 is a block diagram illustrating an example of a computer that implements the key-value store apparatus according to the embodiment of the present invention.

  As shown in FIG. 12, the computer 110 includes a CPU 111, a main memory 112, a storage device 113, an input interface 114, a display controller 115, a data reader / writer 116, and a communication interface 117. These units are connected to each other via a bus 121 so that data communication is possible.

  The CPU 111 performs various calculations by developing the program (code) in the present embodiment stored in the storage device 113 in the main memory 112 and executing them in a predetermined order. The main memory 112 is typically a volatile storage device such as a DRAM (Dynamic Random Access Memory).

  Further, the program in the present embodiment is provided in a state of being stored in a computer-readable recording medium 120. Note that the program in the present embodiment may be distributed on the Internet connected via the communication interface 117.

  Specific examples of the storage device 113 include a hard disk drive and a semiconductor storage device such as a flash memory. The input interface 114 mediates data transmission between the CPU 111 and an input device 118 such as a keyboard and a mouse. The display controller 115 is connected to the display device 119 and controls display on the display device 119.

  The data reader / writer 116 mediates data transmission between the CPU 111 and the recording medium 120, and reads a program from the recording medium 120 and writes a processing result in the computer 110 to the recording medium 120. The communication interface 117 mediates data transmission between the CPU 111 and another computer.

  Specific examples of the recording medium 120 include general-purpose semiconductor storage devices such as CF (Compact Flash (registered trademark)) and SD (Secure Digital), magnetic storage media such as a flexible disk, or CD- An optical storage medium such as ROM (Compact Disk Read Only Memory) can be used.

  Part or all of the above-described embodiment can be expressed by (Appendix 1) to (Appendix 15) described below, but is not limited to the following description.

(Appendix 1)
A document management device for managing documents and a key-value store device;
The document management apparatus includes:
An access authority determination unit that determines the presence or absence of the access authority of the request source in response to a document access request from the user;
A management processing unit that, when it is determined that the access authority is determined, permits access by the request source and outputs access authority information for specifying the access authority to the key value store device,
The key value store device
Memory,
A storage processing unit that stores the output access authority information that has been output in the memory in a key-value store format;
When the access authority information about the document that is the target of the access request is stored in the memory, the access authority information stored in the memory is used as a key from the access authority information stored in the memory. Extracting the attribute condition of the user permitted to access the document, further calculating a product set of the extracted attribute condition and attribute information specifying the attribute of the requesting user, and based on the result of the operation, In place of the access authority determining unit, an arithmetic processing unit that determines the presence or absence of access authority is provided,
A document management system characterized by that.

(Appendix 2)
The management processing unit of the document management device outputs, as the access authority information, information specifying a document that is permitted to be accessed, its operation, and user attribute conditions to the key value store device,
The storage processing unit of the key-value store device stores the output access authority information in the memory using the document and the operation specified by the access authority information as key information and the user attribute condition as value information. And
The arithmetic processing unit of the key-value store apparatus extracts the corresponding value information from the memory based on the key information corresponding to the document, and further extracts the extracted value information and the requesting user. If the product set with the attribute information that identifies the attribute of is calculated, and the result set remains as a result of the operation, it is determined that the user has access authority.
The document management system according to attachment 1.

(Appendix 3)
The attribute condition of the user permitted to access is set based on the hierarchical structure of the organization and the group structure to which the user belongs.
The document management system according to appendix 1 or 2.

(Appendix 4)
The management processing unit of the document management apparatus instructs the key / value store apparatus to discard the access authority information stored in the memory when the access authority information needs to be updated, and then Update the access authority information on the condition that the destruction is completed,
The document management system according to any one of appendices 1 to 3.

(Appendix 5)
The access request is made from a server device providing an application program used by a user;
The server device determines whether the key-value store device stores the access authority information in the memory;
As a result of the determination, if the access access authority information is not stored, the access request is made to the document management device,
As a result of the determination, if the access authority information is stored, the key value store device is requested to determine the access authority.
The document management system according to any one of appendices 1 to 4.

(Appendix 6)
Memory,
A storage processing unit that stores the access authority information that specifies the access authority that has been output from a device that determines the presence or absence of access authority in response to an access request from a user in the memory in a key-value store format;
When the access authority information about the target of the access request is stored in the memory, the access of the target is determined from the access authority information stored in the memory using the target of the access request as a key. The attribute condition of the permitted user is extracted, and further, a product set of the extracted attribute condition and attribute information specifying the attribute of the requesting user is calculated. And an arithmetic processing unit for determining the presence or absence of access authority.
A key-value store device characterized by that.

(Appendix 7)
In the case where the device is a document management device, and the access authority information includes information that specifies the document that is permitted to be accessed, its operation, and user attribute conditions,
The storage processing unit stores the output access authority information that has been output, the document and the operation that it specifies as key information, and the attribute condition of the user as value information in the memory,
The arithmetic processing unit extracts the corresponding value information from the memory based on the key information corresponding to the document, and further specifies the extracted value information and the attribute of the requesting user If a product set with information is calculated and the result set remains as a result of the calculation, it is determined that the user has access authority.
The key-value store device according to appendix 6.

(Appendix 8)
The attribute condition of the user permitted to access is set based on the hierarchical structure of the organization and the group to which the user belongs.
The key-value store device according to appendix 6 or 7.

(Appendix 9)
A document management method using a document management device for managing documents and a key-value store device,
(A) by the document management apparatus, in response to a document access request from a user, determining the presence or absence of access authority of the request source;
(B) If it is determined in step (a) that access authority is granted, the document management apparatus permits access by the request source, and access authority information for specifying the access authority is converted into the key value Outputting to the store device,
(C) storing the access authority information output by the key-value store device in a memory in a key-value store format;
(D) The access authority information stored in the memory with the access request information as a key when the access authority information for the document requested to be accessed is stored in the memory. The attribute condition of the user permitted to access the document is extracted, and the intersection of the extracted attribute condition and the attribute information specifying the attribute of the requesting user is calculated, and the result of the calculation is calculated. On the basis of the document management device instead of determining the presence or absence of access authority; and
A document management method characterized by comprising:

(Appendix 10)
In the step (b), the management processing unit of the document management apparatus uses, as the access authority information, information specifying a document, its operation, and user attribute conditions that are permitted to be accessed, as the key value Output to the store device,
In the step (c), the key-value store device uses the access authority information that has been output as the document and the operation to be identified as key information, and the attribute condition of the user as value information. Store it in memory,
In the step (d), the key value store device extracts the corresponding value information from the memory based on the key information corresponding to the document, and further extracts the extracted value information and the request Calculate the intersection with the attribute information that identifies the attributes of the original user, and determine that you have access authority if the result set remains as a result of the operation.
The document management method according to attachment 9.

(Appendix 11)
The attribute condition of the user permitted to access is set based on the hierarchical structure of the organization and the group to which the user belongs.
The document management method according to appendix 9 or 10.

(Appendix 12)
(E) When the access authority information needs to be updated, the document management apparatus instructs the key value store apparatus to discard the access authority information stored in the memory. Update the access authority information on the condition that it has been completed,
The document management method according to any one of appendices 9 to 11.

(Appendix 13)
(F) determining whether the key-value store device stores the access authority information in the memory by a server device that provides an application program used by a user;
(G) As a result of the determination in the step (f), if the key / value store device does not store the access access authority information, the server device makes the access request to the document management device. , Steps and
(H) As a result of the determination in the step (f), when the key value store apparatus stores the access authority information, the server apparatus determines the access authority for the key value store apparatus. Asking for steps,
The document management method according to any one of appendices 9 to 13, further comprising:

(Appendix 14)
By computer
(A) storing access authority information specifying the access authority, which is output from a device that determines whether or not there is an access authority in response to an access request from a user, in a memory of the computer in a key-value store format; Steps,
(B) When the access authority information about the target of the access request is stored in the memory, the target from the access authority information stored in the memory with the target of the access request as a key The attribute condition of the user who is permitted to access is extracted, and the intersection of the extracted attribute condition and the attribute information specifying the attribute of the requesting user is calculated, and based on the result of the calculation, Instead of a device, a step for determining the presence or absence of access authority, and a program to be executed.

(Appendix 15)
In the case where the device is a document management device, and the access authority information includes information that specifies the document that is permitted to be accessed, its operation, and user attribute conditions,
In the step (a), the access authority information that has been output is stored in the memory as the document and the operation that it specifies as key information, and the attribute condition of the user as value information,
In the step (b), the corresponding value information is extracted from the memory based on the key information corresponding to the document, and the extracted value information and the attribute of the requesting user are specified. When the intersection with the attribute information to be operated is calculated, and the result set remains as a result of the operation, it is determined that the user has access authority.
The program according to appendix 14.

(Appendix 16)
The attribute condition of the user permitted to access is set based on the hierarchical structure of the organization and the group to which the user belongs.
The program according to appendix 14 or 15.

  As described above, according to the present invention, when the access authority of a document is managed, the access authority determination process can be made more efficient. INDUSTRIAL APPLICABILITY The present invention is useful for a system that requires determination of access authority, such as a document management system, a system for determining access authority for pages and portlets in an EIP (Enterprise Information Portal), and a system for determining access authority for Web pages. It is.

DESCRIPTION OF SYMBOLS 10 Document management apparatus 11 Access authority determination part 12 Management processing part 20 Key value store apparatus 21 Memory 22 Storage processing part 23 Arithmetic processing part 30 Document database 40 Web application server apparatus 41 Document access part 50 Terminal apparatus 60 Directory server 110 Computer 111 CPU
112 Main Memory 113 Storage Device 114 Input Interface 115 Display Controller 116 Data Reader / Writer 117 Communication Interface 118 Input Device 119 Display Device 120 Recording Medium 121 Bus

Claims (10)

A document management device for managing documents and a key-value store device;
The document management apparatus includes:
An access authority determination unit that determines the presence or absence of the access authority of the request source in response to a document access request from the user;
A management processing unit that, when it is determined that the access authority is determined, permits access by the request source and outputs access authority information for specifying the access authority to the key value store device,
The key value store device
Memory,
A storage processing unit that stores the output access authority information that has been output in the memory in a key-value store format;
When the access authority information about the document that is the target of the access request is stored in the memory, the access authority information stored in the memory is used as a key from the access authority information stored in the memory. Extracting the attribute condition of the user permitted to access the document, further calculating a product set of the extracted attribute condition and attribute information specifying the attribute of the requesting user, and based on the result of the operation, In place of the access authority determining unit, an arithmetic processing unit that determines the presence or absence of access authority is provided,
A document management system characterized by that. The management processing unit of the document management device outputs, as the access authority information, information specifying a document that is permitted to be accessed, its operation, and user attribute conditions to the key value store device,
The storage processing unit of the key-value store device stores the output access authority information in the memory using the document and the operation specified by the access authority information as key information and the user attribute condition as value information. And
The arithmetic processing unit of the key-value store apparatus extracts the corresponding value information from the memory based on the key information corresponding to the document, and further extracts the extracted value information and the requesting user. If the product set with the attribute information that identifies the attribute of is calculated, and the result set remains as a result of the operation, it is determined that the user has access authority.
The document management system according to claim 1. The attribute condition of the user permitted to access is set based on the hierarchical structure of the organization and the group structure to which the user belongs.
The document management system according to claim 1 or 2. The management processing unit of the document management apparatus instructs the key / value store apparatus to discard the access authority information stored in the memory when the access authority information needs to be updated, and then Update the access authority information on the condition that the destruction is completed,
The document management system according to claim 1. The access request is made from a server device providing an application program used by a user;
The server device determines whether the key-value store device stores the access authority information in the memory;
As a result of the determination, if the access access authority information is not stored, the access request is made to the document management device,
As a result of the determination, if the access authority information is stored, the key value store device is requested to determine the access authority.
The document management system according to claim 1. Memory,
A storage processing unit that stores the access authority information that specifies the access authority that has been output from a device that determines the presence or absence of access authority in response to an access request from a user in the memory in a key-value store format;
When the access authority information about the target of the access request is stored in the memory, the access of the target is determined from the access authority information stored in the memory using the target of the access request as a key. The attribute condition of the permitted user is extracted, and further, a product set of the extracted attribute condition and attribute information specifying the attribute of the requesting user is calculated. And an arithmetic processing unit for determining the presence or absence of access authority.
A key-value store device characterized by that. In the case where the device is a document management device, and the access authority information includes information that specifies the document that is permitted to be accessed, its operation, and user attribute conditions,
The storage processing unit stores the output access authority information that has been output, the document and the operation that it specifies as key information, and the attribute condition of the user as value information in the memory,
The arithmetic processing unit extracts the corresponding value information from the memory based on the key information corresponding to the document, and further specifies the extracted value information and the attribute of the requesting user If a product set with information is calculated and the result set remains as a result of the calculation, it is determined that the user has access authority.
The key value store apparatus according to claim 6. The attribute condition of the user permitted to access is set based on the hierarchical structure of the organization and the group to which the user belongs.
The key-value store apparatus according to claim 6 or 7. A document management method using a document management device for managing documents and a key-value store device,
(A) by the document management apparatus, in response to a document access request from a user, determining the presence or absence of access authority of the request source;
(B) If it is determined in step (a) that access authority is present, the document management apparatus permits access by the request source, and access authority information for specifying the access authority is stored in the key value Outputting to the store device,
(C) storing the access authority information output from the document management device in a key-value store format in a key-value store format by the key-value store device ;
(D) When the access authority information for the document requested for the access request is stored in the memory, the key / value store device uses the document requested for the access as a key to store the memory. The attribute condition of the user permitted to access the document is extracted from the access right information stored in the document, and the product set of the extracted attribute condition and attribute information specifying the attribute of the requesting user is Calculating the presence or absence of access authority instead of the document management device based on the calculation result; and
A document management method characterized by comprising: By computer
(A) storing access authority information specifying the access authority, which is output from a device that determines whether or not there is an access authority in response to an access request from a user, in a memory of the computer in a key-value store format; Steps,
(B) When the access authority information about the target of the access request is stored in the memory, the target from the access authority information stored in the memory with the target of the access request as a key The attribute condition of the user who is permitted to access is extracted, and the intersection of the extracted attribute condition and the attribute information specifying the attribute of the requesting user is calculated, and based on the result of the calculation, A step of determining the presence or absence of access authority instead of the device; and
A program that executes

Images