TWI430130B - File usage permission management system - Google Patents

Description

File usage rights management system

The invention relates to the use rights of the electronic file, in particular, the file use right management system for automatically retrieving the use rights of the file.

There are several types of traditional electronic file confidentiality methods. The most common ones use software programs to assign specific permissions to users or groups when the electronic files are stored. When the electronic files are opened, the users are The name and password determine whether the user or the group is authorized to process the file. Unauthorized users or groups will not be able to process the electronic file to prevent the leakage of confidential electronic files.

The above electronic file storage process selects whether to set the usage right first when the electronic file is stored, for example, if the file is directly archived, if the user or the group is set first, then the use permission is set to complete the electronic file archiving process. Furthermore, the electronic file opening process is to first determine whether the opener is the file producer when the electronic file is opened, and if so, directly open and perform the operation, such as otherwise determining whether it is an approved user or using a group, if otherwise rejecting Open, if yes, open the electronic file and perform operations according to the permissions granted.

However, the above conventional electronic file confidentiality method has several problems. For example, the permission content of the above electronic file is stored in the electronic file, so if the file producer wants to modify the user or use the group right to the file, the file producer cannot modify the file unless the file producer can recycle all the files. The user or the use of the group to use the file, this will not be able to modify the file permissions. If a confidential file is carried out by the original company or internal personnel, as long as the original company or internal personnel knows the confidentiality of the confidential file, the confidential file may be subject to the original internal personnel. Unrestricted circulation, resulting in internal confidential leakage. Therefore, the present invention provides a solution to overcome the problem of the inability to manually modify the rights generated by the above-described conventional electronic file security method.

In view of the above problems, the present invention discloses a file usage rights management system.

In one aspect, the file usage rights management system of the present invention includes a network; the server includes a first network coupling interface and a first database, wherein the first network coupling interface is coupled to the network And the first database includes a plurality of file identifiers and a plurality of rights data; and a user terminal device, wherein the user equipment includes a second network coupling interface, a storage unit, and a file usage filtering module, wherein the second The network coupling interface is coupled to the network, wherein the storage unit includes a file, and the file is accompanied by a file identification code, wherein the file use filter module is used to filter the use of the file by the user.

One of the advantages of the present invention is that the file usage rights management system can use the mobility management file.

Another advantage of the present invention is that the file usage rights management system can effectively prevent accidentally outflowing files from being used by outsiders, and eliminate the risk of unauthorized use of confidential data.

Yet another advantage of the present invention is that the file usage rights management system allows users of different classes to have different levels of access to the same file, and effective management of confidential files can only be used by users of higher ranks.

The advantages of the present invention will be apparent from the following description of the preferred embodiments of the invention.

The invention will be described in conjunction with the preferred embodiments and the accompanying drawings. It is to be understood that the preferred embodiments of the present invention are intended to be illustrative only and not to limit the invention. Therefore, the invention may be applied to other embodiments in addition to the preferred embodiments. The invention is not limited to any embodiment, but should be determined by the scope of the appended claims and their equivalents.

The present invention discloses a file usage rights management system for managing user rights to use files. Referring to the first figure, in a preferred embodiment of the present invention, the file usage rights management system 10 of the present invention includes a user terminal device 101, such as a personal or notebook computer, a personal digital assistant (PDA), etc., a server 110, and Network 118. The network 118 includes, but is not limited to, a local area network (LAN), an Internet, and a virtual private network (VPN). In an embodiment of the present invention, the user equipment 101 includes a processing unit 102, a storage unit 103, a file usage filtering module 106, and a network coupling interface 109. The storage unit 103, the file usage filter module 106, and the network coupling interface 109 are each coupled to the processing unit 102. The storage unit 103 is for storing at least one file, such as the file 104, and each file, such as the file 104, is accompanied by a unique file ID (File ID) 105. The file usage filter module 106 is used to filter the user's access rights to each file, such as the file 104. The usage rights for the file 104 described herein include, but are not limited to, readability, writeability, printability, copyability, and the like. In an embodiment of the invention, the file usage filter module 106 can be implemented in software. The file usage filter module 106 includes a database 107 in which at least one rights data 108 is stored. Network coupling interface 109 is coupled to network 118. The network coupling interface 109 includes a wired network coupling interface or a wireless network coupling interface.

In an embodiment of the present invention, as shown in the first figure, the server 110 includes a processing unit 111, a console 112, a database 113, and a network coupling interface 117. Console 112, database 113, and network coupling interface 117 are each coupled to processing unit 111. The server 110 is coupled to the network 118 via a network coupling interface 117 for further coupling to the consumer device 101 via the network coupling interface 109. The database 113 is used to store a plurality of user account data 114, a plurality of file identification codes 115, and a plurality of rights data 116. The console 112 is configured to set the account data 114, the file identifier 115, and the rights data 116 stored in the database 113. For example, the console 112 can be used to edit, for example, delete, change, or add account data stored in the database 113. 114. The file identification code 115 and the rights information 116 may be used to set a time schedule for editing, for example, deleting, changing or adding the account information 114, the file identification code 115, and the rights information 116. The server 110 filters the user's login through the account management mechanism. Network coupling interface 117 is coupled to network 118. The network coupling interface 117 includes a wired network coupling interface or a wireless network coupling interface.

As shown in the second figure, each account data in the account information 214, such as account number 1 and account number 2, is a file identification code corresponding to a different group in the file identification code 215. As shown in the second figure, each file identification code in the file identification code 215 corresponds to one of the rights data in the permission data 216, such as the rights data 1, the rights data 2, or the rights data 3, wherein the rights of each rights data The level is different. It should be noted that, in an embodiment of the present invention, as shown in the second figure, although different account numbers may correspond to the same file identifier, the same file identifier corresponding to different accounts may correspond to different levels of rights data. . That is, although different users can use the same file, different users can use different levels of the same file. For example, in the second figure, the file identification code 1 corresponding to the account number 1 corresponds to the authority data 1, and the file identification code 1 corresponding to the account number 2 corresponds to the authority data 2. On the other hand, in another embodiment of the present invention, the same file identification code corresponding to different account accounts may correspond to the rights data of the same level. That is, different users can use the same privilege level for the same file. For example, in the second figure, the file identification code 2 corresponding to the account number 1 corresponds to the authority data 1, and the file identification code 2 corresponding to the account number 2 also corresponds to the authority data 1.

In an embodiment of the present invention, when the user wants to use the client device 101 to use the file 104 stored by the storage unit 103, the file usage filtering module 106 starts and obtains the file identification code 105 of the file 104, and transmits The network coupling interface 109 is coupled to the network 118 for further coupling and connection to the server 110 via the network coupling interface 117. The user will be required to enter the account password to log in to the server 110, and the file identification filter 105 will be transmitted to the database 113 of the server 110 via the network 118 through the authenticated file usage filter module 106. After receiving the file identification code 105, the user database and the file identification code 105 are used as parameters to search the authority data 116 for the account data and the authority data corresponding to the file identification code 105, and search for The obtained authority data is transmitted to the file usage filtering module 106 via the network 118 and stored in the database 107 therein to form the authority data 108. The authority data 108 describes the user's authority to use the file 104, including but not limited to whether it is readable, readable, printable, copyable, or the like. Next, the file usage filter module 106 uses the usage rights described in the rights information 108 to filter the user's use of the file 104. For example, if the rights data 108 is readable, non-writable, printable, and non-reproducible, the user cannot write and copy the file 104, and can only read and print the file 104.

In an embodiment of the present invention, when the producer or manager of the file 104 wants to change the usage rights of the particular user to the file 104, the file producer or manager can connect to the server 110 and enter the account. To log in to the server 110, the console 112 is used to change the authority data corresponding to the file identifier 105 corresponding to the account of the specific user in the database 113. Thus, when the specific user wants to use the file 104 by the user equipment 101, the rights data downloaded to the server 110 will be different from the rights data 108 obtained by the previous connection, and the specific user pairs the file 104. The actions that can be performed are subject to change. When the producer or manager of the file 104 wishes to change the usage rights of each user to the file 104, the above steps are repeated for each user account corresponding to the file identifier 105.

In another embodiment of the present invention, when the producer or manager of the file 104 wants to prohibit a particular user from using the file 104, the file producer or manager can connect to the server 110 and enter the account to Log in to the server 110, and use the console 112 to delete the authority data corresponding to the file identifier 105 corresponding to the account of the specific user in the database 113, or change the permission level of the permission data to the lowest level, that is, Perform any action on file 104. In this way, when the specific user wants to use the file 104 by the user equipment 101, although the server 110 is connected to the server 110, the authority data corresponding to the file identifier 105 cannot be downloaded, or the rights obtained by the download are the lowest level. With the permission, the specific user cannot perform any action on the file 104. When the producer or manager of the file 104 wants to prohibit each user from using the file 104, the above steps are repeated for each user account corresponding to the file identifier 105.

In another embodiment of the present invention, when the producer or manager of the file 104 wants to set the file 104 to be unavailable to any user or a specific user after a predetermined time point or after a predetermined period of time, or to set After automatically changing the usage rights of any user or specific user to the file 104 after a predetermined time point or after a predetermined time period, the file producer or manager can connect to the server 110 and enter the account to log in to the server. The controller 110 is configured to set a time schedule for which the permission data corresponding to the file identification code 105 corresponding to the account of each user or a specific user in the database 113 is to be deleted, or the scheduled change is to be changed. The time schedule of the rights data corresponding to the file identifier 105 corresponding to the account number of each user or a specific user in the database 113. In this way, when the predetermined time point arrives or the predetermined time period elapses, when any user or a specific user wants to use the file 104 by the user equipment, although it is connected to the server 110, the file identifier 105 cannot be downloaded. The permission data or the obtained permission data are different from the previously obtained permission data. Therefore, any user or specific user cannot act on the file 104 or can perform the action after the predetermined time point or the predetermined time period has elapsed. Changed. The above-mentioned technology for setting time schedule editing permission data is called automatic file recovery mechanism, and the advantage is that the file producer or manager can flexibly manage the usable time point or the usable time period of the confidentiality files of each level. That is to say, the use of the file use rights management system can flexibly control the circulation and use time of each confidential file, and automatically reclaim the use rights of the file file by setting the time schedule.

As described above, the present invention provides a file usage right management system, which can manage the use rights of a file, and can prevent the use of the outgoing person through the file use right management system of the present invention, even if the file, for example, a confidential file flows out. The file can also be used to change the access rights of confidential documents in the company or in the organization. In addition, because the file to be used in this file usage rights management system must be connected to the server first, it is impossible to download or update the permission data if the server account cannot be authenticated or cannot be connected to the server. Unable to use file. Therefore, the file use right management system of the present invention can effectively prevent accidentally outgoing files from being used by outsiders, and prevent the risk of unauthorized use of confidential data. Furthermore, as described above, the correspondence between the account data, the file identification code, and the authority data in the database of the file usage rights management system of the present invention enables users of different classes to use different levels of the same file. Permissions, effective management of confidential files can only be used by users with higher levels.

The present invention has been described above by way of a preferred example, and is not intended to limit the spirit of the invention. Modifications and similar configurations made within the spirit and scope of the invention are intended to be included within the scope of the appended claims.

10. . . File usage rights management system

101. . . User equipment

102. . . Processing unit

103. . . Storage unit

104. . . file

105. . . File identification code

106. . . File filter module

107. . . database

108. . . Permission data

109. . . Network coupling interface

110. . . server

111. . . Processing unit

112. . . Console

113. . . database

114. . . Account information

115. . . File identification code

116. . . Permission data

117. . . Network coupling interface

118. . . network

214. . . Account information

215. . . File identification code

216. . . Permission data

The above elements, and the features and advantages of the present invention, will be more apparent by the accompanying reading method and the drawings thereof, wherein:

The first figure is a schematic diagram of a file usage rights management system in accordance with a preferred embodiment of the present invention.

The second figure is a correspondence diagram of account data, file identification code and authority data in the database of the server of the file usage authority management system according to the preferred embodiment of the present invention.

10. . . File usage rights management system

101. . . User equipment

102. . . Processing unit

103. . . Storage unit

104. . . file

105. . . File identification code

106. . . File filter module

107. . . database

108. . . Permission data

109. . . Network coupling interface

110. . . server

111. . . Processing unit

112. . . Console

113. . . database

114. . . Account information

115. . . File identification code

116. . . Permission data

117. . . Network coupling interface

118. . . network

Claims (13)

A file usage rights management system includes: a network; a server, the server includes a first network coupling interface and a first database, wherein the first network coupling interface is coupled to the network, And the first database includes a plurality of file identification codes, a plurality of rights data, and a plurality of account data; and a user terminal device, the user terminal device includes a second network coupling interface, a storage unit, and a file usage filtering a module, wherein the second network coupling interface is coupled to the network, wherein the storage unit includes a file, the file is accompanied by a file identification code, wherein the file uses a filtering module to filter the user The file usage permission, the file use filter module includes a second database, and when the user wants to use the file by the user device, the file uses the filter module to obtain the file identifier of the file and The file identifier of the file is transmitted to the first database of the server, and the user inputs the account and password to log in to the server, and the server Searching the account number of the account and the file identifier of the file for the account and the authority data corresponding to the file identifier of the file, and transmitting the searched permission data to the file The filter module is used and stored in the second database, and the file uses the filter module to control the user's permission to use the file according to the permission data obtained by the search. The file usage rights management system of claim 1, wherein the server further comprises a console for setting the plurality of account data, the plurality of file identification codes, and the plurality of rights data. The file usage rights management system of claim 1, wherein the server further comprises a console for setting a time schedule for editing the plurality of account data, the plurality of file identification codes, and the plurality of rights data. The file usage rights management system of claim 1, further comprising a network, wherein the first network coupling interface and the second network coupling interface are respectively coupled to the network, wherein the network includes a regional network road. The file usage rights management system of claim 4, wherein the network comprises an internet. The file usage rights management system of claim 4, wherein the network comprises a virtual private network. The file usage rights management system of claim 1, wherein the first network coupling interface comprises a wired network coupling interface. The file usage rights management system of claim 1, wherein the first network coupling interface comprises a wireless network coupling interface. The file usage rights management system of claim 1, wherein the second network coupling interface comprises a wired network coupling interface. The file usage rights management system of claim 1, wherein the second network coupling interface comprises a wireless network coupling interface. The file usage rights management system of claim 1, wherein the different account numbers in the plurality of account data correspond to file identification codes of different groups in the plurality of file identification codes. The file usage rights management system of claim 1, wherein the different account numbers in the plurality of account data correspond to the same single file identification code in the plurality of file identification codes, and the same single file identification code corresponds to the plurality of rights Permission data for different levels in the data. The file usage rights management system of claim 1, wherein the plurality of file identification codes in the first database comprise the file identification code in the storage unit.