JPS62242273A - Security management system - Google Patents

Abstract

PURPOSE:To obtain a security management system adapted to a delicate, simple, flexible and integrated office system by referring to a decision table by the respective designations or the pass-word of an inputted management object and an user and deciding the acceptance and the rejection of an access. CONSTITUTION:A decision table 4 determines an access right level for every type of user in a management object (cabinet, folder, document) for an environment (system, office, person), with -PW meaning a user who does not know the password and LIST meaning a user recorded on the list. When a user ID, an object ID and a request R are inputted from a keyboard display 3, a processor 5 retrieves user file 2 by making the user ID as a key, accepts the access irrespective of the request R based on the decision table 4, when the user is a person responsible for the system, and displays the file 2 on the keyboard display 3. When the user is not the responsible person, the processor 5 retrieves an object file 1 by making the object ID as a key, examines the envoronment to which the object belongs and the processing is carried out corresponding to the result.

Description

[Detailed Description of the Invention] (Industrial Application Field) The present invention provides a cabinet in an integrated office system;
This document relates to a security management method for folder 9 documents, etc.

Office automation aimed at streamlining office operations
Chiron has rapidly developed from the introduction of single products to systemization, and has not only improved the efficiency of individual work in the office, but also
There is a growing demand for an integrated office system that supports the operation of all corporate activities and aims to streamline and automate them.

On the other hand, in order to organize corporate activities, individuals, offices as a group of individuals defined as a unit to share and carry out their respective areas of responsibility within the company, and systems as a group of individuals or offices. In order to deal with problems raised from within and outside the company, information related to each area of responsibility is managed in the form of cabinets, folders, documents, etc.

How can the above documents be stored in an integrated office system based on the logical structure of an office? The lily management method is
A naturalness that fits actual office work and a simple mechanism that is easy for users to use are required. Furthermore, it is desired that the system has a flexible structure that can meet the needs of each user who conducts business in a variety of environments.

(Prior Art) This type of conventional security management (hereinafter simply referred to as "management") is based on a user, other users in the group to which the user belongs, and a directory in which file management information is stored. This is done by setting reference rights, update 11i grounders, and execution rights for each general user. The execution right is the right to execute the program if the managed object is a program file, or the right to search the directory if the managed object is a directory.

(Problem to be solved by the invention) In such a conventional method, what is the problem to be managed? There are problems such as the hierarchy of users and users does not match the logical structure of the office, and the management method is complicated and rigid because access privilege levels are set for each user and managed object. It cannot be said that it is suitable for an integrated office system where confidentiality is of paramount importance.

(Means for Solving the Problem) The method of the present invention is a security management method for cabinets, folders, documents, etc. in an integrated office system.

An object file that stores in advance attribute information including a password and special user list for the managed object.

A user file that stores user attribute information for managed objects in advance.

and input/output devices operated by the user.

Based on the attribute information of the managed object and the user's attribute information, a decision table is provided for each managed object to determine five access privilege levels, and when a user accesses the managed object, input is made using an input/output device. The system is characterized in that permission or disapproval of access is determined by referring to a determination table based on each designation of the object to be managed, the user, and the password.

(Implementation row) Next, embodiments of the present invention will be described with reference to the drawings.

FIG. 1 is a block diagram showing an embodiment of the present invention, including an object file 1 and a user file 2.

Keyboard display 3, decision table 4, and processing device 5
It consists of

The object file 1 identifies the environment of the object (system, office, personal) for each object ID.

If it is a system environment or an office environment, the access privilege level as described below.If it is an office environment, the office salt, ′! ! If the user is in a private environment, the user will request an indication of whether the object has a password, if so, the password, and whether or not the object has a special user list (hereinafter simply referred to as the list). When such a display and list is provided, attribute information including a user ID and the like is stored in advance.

In principle, passwords are for certain objects.

This is set when you want to specifically limit users from a set of users who have a certain level of access rights.

Used to differentiate levels of access rights between users who know the password and those who don't.

In addition, the list should, in principle, be limited to only the members of the own office for objects in the office.

Used specifically to grant access rights to members of other offices. - The user file 2 contains attribute information such as a user ID, an indication of whether the user is a system manager, an indication of whether the user is an office manager, and information about the office to which the user belongs. Stored in advance.

The keyboard display 3 is used by the user to perform input/output operations in an interactive manner with the processing device, and, as will be described later, is used to input user requests.

In response to a question from the processing device, a password is entered and a display indicating whether the request has been accepted or not is performed.

The decision table 4 includes managed objects (cabinets, folders) classified by m boundaries (system, office, personal), as shown in detail in FIG.

The access right level is determined for each type of stopper for each document (document).

In FIG. 2, PW is a user who is an office member who does not know the password, and PW is a user who is an office member but does not know the password.

LIST is the list of users, Menno (LI).
ST means a user who is not an office member and is not on the list, and user means a user who is not the owner of the managed object.

In addition, the numbers in Figure 2 indicate access rights and levels, O is for non-access, level 0.1 is for reference only, level 1.2 is for registration, level 2, and 3 is for update. 3 and 4 respectively mean level 4 where all operations are possible. However, any level has access rights to all levels below that level; for example, level 3 allows registration and reference.

Note that displays with a range of levels, such as cabinets in a system environment or documents in an office environment, indicate the level range that can be specified by part of the attribute information in the object file 1 mentioned above. be.

FIG. 3 is a flowchart showing the operation of this embodiment.

The operation of this embodiment will be described below with reference to FIG.

When a user wants to access a certain object,
First, the user enters the user ID, object ID, and request name from the keyboard display 3 (step 2). The processing device 5 searches the user file 2 using the input user ID as a key.

Read the corresponding attribute information (step ■). When it is determined from this attribute information that the user is the system manager (step ■), the processing device j15 makes a decision to allow access regardless of the request based on decision table 4, and sends a message to that effect. A display is displayed on the keyboard display 3. This corresponds to the fact that in FIG. 2, when the user is the system manager, level 4 is given to all objects.

When it is determined in step (2) that the user is not the system manager, the processing device 5 searches the object file 1 using the previously input object ID as a key and reads the corresponding attribute information (step (2)). Based on this attribute information, it is determined whether the object is in a personal, office, or system environment (step ■), and the process responds accordingly.

Various processes are performed as classified and described below.

(11 In the case of a personal environment If the object is in a personal environment, the user can access it by checking whether the user ID in the attribute information of the object matches the user ID entered manually. If you are the owner of the object, you can access it regardless of the request, and if you are not the owner, you cannot access it.

(2) In the case of an office environment If the object is in an office environment, it is determined whether the user is a member of the office by matching the office name in each attribute information of the user and the object (step (2)).

(2, 1) If the user is an office member: Based on the user's attribute information, if the user is in charge of the office, access is allowed regardless of the request.

If you are not the office manager, depending on the attribute information of the object,
Check whether the object has a password (step ■), and if it has a password, process it! e5 displays a message on the keyboard display 3 urging the operator to press that key. When the user enters a password relying on his or her memory, the processing device 5 compares the entered password with the password in the attribute information of the object (step [phase]). R
02) Processed (step [phase]) and access is allowed regardless of the request unless it is a cabinet. The content of the judge (L 2 ) process is the judge (R,
, L) processing will be explained later in a generalized form with reference to FIG.

In step [phase], if the user does not know the password or accidentally enters a key and the password does not match, the access right level in the attribute information of the object is set to aL (step 0). , Judge (几, L
) processing is performed (step 0).

(2, 2) If you are not an office member, it is checked whether the object is in the list or not according to the attribute information of the object (step [phase]). Check whether the user ID group includes the user ID entered using the key (
step [phase]). If the user is not on the list, access is not possible, and if the user is on the list, the same processing is performed in steps O and @, respectively.

(3) In the case of a system environment, it is checked whether the object has a password (step o), and if there is, it is checked whether the password matches (step [phase]). When there is no password or when the passwords match, the judgment (R, 2) process is performed (step ◎), and when the passwords do not match, the same processes as in steps 0 and ■ are performed in steps @ and O, respectively.

FIG. 4 is a flowchart showing the contents of the judge (RoL) process. The processing device 5 reads the request number and the constant value (step ), and if the constant L=O (step ), access is disabled, and if the constant 11=4 (step
) Access is not allowed, and if L is one of 1, 2, or 3 (step ), permission or denial of access is determined as follows depending on the magnitude relationship between the request R and the constant R.

When the constant L=l, access is allowed or disabled depending on whether the contents of the request box are within the range allowed by the access right level l (step 2). next,
When the constant L=2, access is allowed or disabled depending on whether the request is within the range allowed by access right level 2 (step 2). Finally, when the constant L=3, whether access is allowed or not is determined depending on whether the request is within the range allowed by access right level 3 (step ).

The effect of this embodiment is that by increasing the access priority level from the conventional four to five, including access denied, and by separating registration and updating, more detailed security management can be performed. That's true.

(Effects of the Invention) According to the present invention, as detailed above, users and objects are hierarchically defined so that the access right level is determined as a function of the users and objects, and furthermore, in addition to passwords, By adopting a special user list and setting it in combination with access privilege levels, it is possible to provide a security management method that matches the logical structure of the office, is detailed, simple, and flexible, and is compatible with integrated office systems. effective.

[Brief explanation of drawings]

FIG. 1 shows one embodiment of the present invention, the WJz diagram shows a detailed diagram of this embodiment, and FIGS. 3 and 4 show diagrams for explaining the operation of this embodiment, respectively. 1...Object file, 2...User file, 3...Keyboard display, 4
...Decision table, 5...Processing device. ,/-ゝglance,

Claims (1)

[Claims] A security management method for cabinets, folders, documents, etc. in an integrated office system, comprising: an object file that stores in advance attribute information including a password and a special user list for the management object; a user file that stores user attribute information in advance; an input/output device operated by the user; and at least five access privilege levels for each managed object based on the attribute information of the managed object and the user. When the user accesses the managed object, the managed object and the user's respective designations and passwords input by the input/output device are used to refer to the decision table and decide whether or not to permit the access. A security management method characterized by: