Information processing device and information processing program

Abstract

To control processing of a requested file for each file operation request.SOLUTION: A file management apparatus 10 refers to a conditional expression DB 17 and uses at least one of an attribute of a user who has made a file operation request and file information of the file for which the operation request has been made to calculate points representing the degree of secrecy of the file for which the operation request has been made, and executes processing corresponding to the point for the file for which the operation request has been made, according to rules stored in a rule DB 18 that associates the point with processing for the file to add restrictions on the operation to the file for which the operation request has been made.SELECTED DRAWING: Figure 2

Description

[Technical Field]

[0001] The present invention relates to an information processing device and an information processing program. [Background technology]

[0002] Patent Document 1 discloses a file management device including a security level setting means for setting a first security level for a file based on the characteristics of the file created by a user, an optimum security level determination means for determining an optimum security level suitable for the file based on the second security level set for the file by the user and the first security level set by the security level setting means, and a process execution means for executing a process related to the file based on the optimum security level determined by the optimum security level determination means. [Prior art documents] [Patent documents]

[0003] [Patent Document 1] Japanese Patent Application Laid-Open No. 2015-133087 Summary of the Invention [Problem to be solved by the invention]

[0004] In order to prevent users from freely accessing files, access rights may be set in advance for users and files.

[0005] In this case, file operations are performed according to the set access rights, so the same process is performed every time a file operation request is made, and it is not possible to flexibly change the permission for file operations depending on the content of the file for which an operation request was made and the user making the operation request.

[0006] An object of the present invention is to provide an information processing device and an information processing program that can control processing of a requested file for each file operation request. [Means for solving the problem]

[0007] An information processing device according to a first aspect includes a processor, and the processor obtains a confidentiality value representing the degree of confidentiality of the file for which an operation request has been made, using at least one of the attributes of a user who has made a file operation request and file information of the file for which an operation request has been made, and performs processing corresponding to the confidentiality value on the file for which an operation request has been made, in accordance with predetermined rules that associate the confidentiality value with processing on the file.

[0008] In the information processing device of the second aspect, in the information processing device of the first aspect, the processor acquires a conditional expression in which the confidential value is associated with at least one of a user condition related to a user attribute and a file condition related to file information, and executes processing corresponding to the sum of the confidential values ​​associated with each of the conditional expressions that satisfy the condition.

[0009] In the information processing device of the third aspect, in the information processing device of the second aspect, the user conditions include conditions that specify the relationship between the user who registered the file for which an operation request was made and the user who made the operation request for the file, and the file conditions include at least one of a condition that specifies a character string used in the file name of the file for which an operation request was made and a condition that specifies a character string used in the content of the file for which an operation request was made.

[0010] An information processing device according to a fourth aspect is the information processing device according to the third aspect, wherein the content of the file for which the operation request has been made is expressed by at least one keyword extracted from the body of the file.

[0011] An information processing device according to a fifth aspect is an information processing device according to any one of the first to fourth aspects, wherein the predetermined rules are defined for each user, and the processor performs processing corresponding to the confidential value on the file for which an operation request has been made, in accordance with the predetermined rules defined for the user who has made the file operation request.

[0012] An information processing device according to a sixth aspect is an information processing device according to the fifth aspect, wherein the predetermined rules are also defined for each group to which a user belongs, and when the confidentiality value corresponds to both the predetermined rule defined for the user who made the file operation request and the predetermined rule defined for the group to which the user who made the file operation request belongs, the information processing device performs processing corresponding to the confidentiality value on the file for which an operation request was made, in accordance with the predetermined rule that performs processing that results in a higher level of confidentiality for the file.

[0013] An information processing program according to a seventh aspect is a program for causing a computer to obtain a confidentiality value representing the degree of confidentiality of the file for which an operation request has been made, using at least one of the attributes of a user who has made a file operation request and the file information of the file for which an operation request has been made, and to execute processing corresponding to the confidentiality value on the file for which an operation request has been made, in accordance with predetermined rules that associate the confidentiality value with processing on the file. [Effects of the Invention]

[0014] According to the first and seventh aspects, there is an effect that it is possible to control the processing of the requested file for each file operation request.

[0015] According to the second aspect, there is an effect that the processing of the requested file can be controlled by changing the secret value associated with the conditional expression.

[0016] According to the third aspect, the effect is that processing of the requested file is controlled based on conditions that define the relationship between the user who registered the file and the user who requested the file operation, and at least one of conditions related to the file name and conditions related to the file contents.

[0017] According to the fourth aspect, there is an effect that the user does not need to perform the task of inputting the contents of the registered file into the information processing device.

[0018] According to the fifth aspect, even if the confidentiality value is the same, it is possible to change the processing of the requested file for each user.

[0019] According to the sixth aspect, there is an effect that the confidentiality of the file can be increased compared to when a rule corresponding to a process that lowers the confidentiality of the file is adopted from among the plurality of rules. [Brief explanation of the drawings]

[0020] [Figure 1] FIG. 1 illustrates an example of the configuration of a file management system. [Figure 2] FIG. 2 illustrates an example of a functional configuration of a file management apparatus. [Figure 3] FIG. 10 illustrates an example of the data structure of a user DB. [Figure 4] FIG. 2 is a diagram illustrating an example of the data structure of a file DB. [Figure 5] FIG. 10 is a diagram illustrating an example of the data structure of a conditional expression DB. [Figure 6] FIG. 10 is a diagram showing an example of a setting screen for a conditional expression. [Figure 7] FIG. 2 is a diagram illustrating an example of the data structure of a rule DB. [Figure 8] FIG. 10 is a diagram illustrating an example of a rule setting screen. [Figure 9] FIG. 2 is a diagram illustrating an example of the configuration of a main part of an electrical system of the file management device. [Figure 10]10 is a flowchart illustrating an example of the flow of a registration process in the file management device. [Figure 11] 10 is a flowchart illustrating an example of the flow of an acquisition process in the file management device. [Figure 12] FIG. 10 is a diagram illustrating another example of the rule DB. DETAILED DESCRIPTION OF THE INVENTION

[0021] The present embodiment will be described below with reference to the drawings. Note that the same components and processes are given the same reference numerals throughout the drawings, and redundant description will be omitted.

[0022] Figure 1 shows an example of the configuration of a file management system 1 that manages files. A "file" is one of the units of data management in a computer, and is a collection of data structured according to a predetermined format. "Management" refers to performing operations on files, such as storing, deleting, editing, moving, copying, and retrieving files, in accordance with user instructions.

[0023] As shown in Fig. 1, the file management system 1 includes at least one user terminal 2 and a file management device 10. The user terminal 2 and the file management device 10 are connected via a communication line 4. There are no restrictions on the connection form of the communication line 4, and the connection form of the communication line 4 may be wired, wireless, or a combination of wired and wireless. Furthermore, the communication line 4 may be either a public line or a dedicated line.

[0024] The user terminal 2 is an information device used by each user (user A and user B in the example of FIG. 1). The user terminal 2 may be any type of information device as long as it has at least one of the following functions: a data communication function via the communication line 4 and a file-related function such as creating, editing, and viewing files. For example, the user terminal 2 may be a computer, a smartphone, a tablet terminal, a wearable device, or the like. There is no limit to the number of user terminals 2 that can be connected to the file management device 10.

[0025] The file management device 10 is a device that stores (hereinafter referred to as "registering") files received from the user terminal 2 via the communication line 4 in a storage device that can be read and written by the file management device 10, and processes files among the registered files for which an operation request has been made in accordance with the instructions of the user terminal 2 that made the request.

[0026] As will be explained later, the file management device 10 does not unconditionally process a file for which an operation request has been made in accordance with the instructions of the user terminal 2, but rather calculates a security level that indicates the degree of confidentiality of the file each time an operation request is received, and determines whether or not to execute the requested operation based on the security level. Furthermore, even when the file management device 10 executes a requested operation, it does not simply execute the requested operation as is, but determines the degree of restriction to be imposed on the requested operation based on the security level.

[0027] 2 is a diagram showing an example of the functional configuration of file management device 10. File management device 10 includes functional units, namely, a communication unit 11, a control unit 12, a file management unit 13, and a calculation unit 14, as well as databases, namely, a user DB 15, a file DB 16, a conditional expression DB 17, and a rule DB 18. Note that "DB" is an abbreviation for database. The database according to this embodiment is not limited to, for example, a commercially available relational database, and there are no restrictions on how it is implemented as long as it has a mechanism for storing a specified file in a storage device and reading out the specified file from the storage device.

[0028] The communication unit 11 transmits and receives data to and from the user terminal 2 in accordance with instructions from the control unit 12 .

[0029] The control unit 12 interprets an operation request received from the user terminal 2 via the communication unit 11, and performs file management by outputting instructions according to the content of the operation request to the communication unit 11, the file management unit 13, and the calculation unit 14.

[0030] Operation requests received from the user terminal 2 include file-related operations such as registering a specified file, deleting, editing, moving, copying, and retrieving files already registered in the file management device 10, and editing file attributes.

[0031] File attributes are information added to a file and are represented by the contents of the file, i.e., information different from the file body. Specifically, file attributes include, for example, the file name, the file creation date and time, and the file size. The file body and file attributes are examples of "file information" according to this embodiment.

[0032] The file management unit 13 registers the specified file in the file DB 16 and also acquires the specified file from the file DB 16 .

[0033] When a user sends an operation request to the file management device 10 through the user terminal 2, the operation request is accompanied by the user name of the user who made the operation request, and the user name of the user who owns the user terminal 2 is registered in advance in the user DB 15.

[0034] Fig. 3 is a diagram showing an example of the data structure of the user DB 15. As shown in Fig. 3, the user DB 15 stores, for each user, the user name of the user who owns the user terminal 2 and a user ID that is uniquely associated with each user in advance.

[0035] The file management unit 13 acquires information about the user who made the operation request (in this case, the user ID) from the user DB 15 based on the user name added to the operation request. Naturally, a user ID may be added to the operation request instead of a user name, and in this case, the file management unit 13 may acquire the user name from the user DB 15 as information about the user who made the operation request. Hereinafter, information about the user who made the operation request will be referred to as "user information." The user information stored in the user DB 15 is not limited to the user name and user ID, and may include various information associated with the user, such as the user's age, years of service, department, and address.

[0036] That is, the file management unit 13 acquires the user information of the user who has made the operation request from the user DB 15. The user information is an example of the "user attribute" according to the present embodiment.

[0037] If the operation request received from the user terminal 2 is a registration request, the file management unit 13 registers the file specified in the registration request in the file DB 16.

[0038] Fig. 4 is a diagram showing an example of the data structure of the file DB 16. As shown in Fig. 4, in the file DB 16, a file ID, a file name, file contents, and a registered user ID are associated with each file.

[0039] The file ID is an identifier for uniquely identifying a file registered in the file DB 16 .

[0040] The file name is the name of the file registered in the file management device 10.

[0041] The file contents are the body of the file, that is, the information that is displayed by an application when the application for viewing the file contents is launched.

[0042] The registered user ID is the user ID of the user who has requested the file to be registered (referred to as the "registered user"), and is set to the user ID acquired from the user DB 15 based on the user name added to the operation request, for example.

[0043] The file management unit 13 registers the file requested for registration in the file DB 16 in association with the file ID, file name, file contents, and registered user ID.

[0044] When registering file contents in the file DB 16, the file management unit 13 may, for example, obtain all data corresponding to the body of the file from the file and set it as the file contents, but the method of setting the file contents is not limited to this. The file management unit 13 may also extract at least one keyword from the body of the file and set it as the file contents. Specifically, the file management unit 13 may set a keyword included in the body of the file from among predetermined keywords as the file contents. Furthermore, the file management unit 13 may extract from the file a word whose importance is determined to be equal to or greater than a threshold value using a learning model that has machine-learned the relationship between words and the importance of the words in the body of the file, and set it as the file contents.

[0045] Furthermore, the file management unit 13 may set a summary of the text of the file as the file contents. Specifically, the file management unit 13 may perform known natural language analysis such as morphological analysis, contextual analysis, and syntactic analysis on the text of the file, and set a summary of the text of the file as the file contents.

[0046] On the other hand, if the operation request received from the user terminal 2 is an operation request other than a registration request, the file management unit 13 refers to the file name of the file specified as the target of the operation in the operation request, identifies the specified file, and performs the requested operation on the identified file in accordance with the instructions of the control unit 12.

[0047] The calculation unit 14 acquires at least one of user information of a user who has made an operation request to a file and file information of a file designated as a target of the operation request from the control unit 12. Then, the calculation unit 14 acquires, from the conditional expression DB 17, a conditional expression in which security points are associated with at least one of a user condition that is predetermined as a condition related to the user information and a file condition that is predetermined as a condition related to the file information.

[0048] Fig. 5 is a diagram showing an example of the data structure of the conditional expression DB 17. As shown in Fig. 5, in the conditional expression DB 17, a conditional expression ID, an item, a value, a condition, and a point are associated with each conditional expression.

[0049] The conditional expression ID is an identifier for uniquely identifying a conditional expression stored in the conditional expression DB 17 .

[0050] The item represents a target to be judged to determine whether or not the conditional expression represented by the conditional expression ID is satisfied.

[0051] The value is a string to be compared with the item, and there is no restriction on the type of string that can be set as the value, and for example, alphabets, numbers, symbols, kanji, hiragana, katakana, etc. can be used as strings. If no string is set as the value, a reserved character such as "NULL" is set, but the value can also be left blank instead of "NULL".

[0052] When a character string is set in the value, a condition for determining the relationship between the target of the conditional expression specified in the item and the character string set in the value is set in the condition of the conditional expression DB 17. When a character string is not set in the value, a comparison item to be compared with the target of the conditional expression specified in the item is set in the condition of the conditional expression DB 17.

[0053] The points represent the security points that are awarded when the conditions expressed by each conditional expression are met. The larger the security point value, the more restrictions must be placed on the requested operation.

[0054] For example, if the operation request is a request to acquire a file, since the acquisition of the file is restricted, the security point represents the security level of the file for which the acquisition request was made, i.e., the degree of confidentiality of the file. Also, if the operation request is a request to delete a file, since the deletion of the file is restricted, the security point represents the degree of importance of the file for which the deletion request was made. Note that a file with a higher degree of confidentiality can also be considered to be a file with a higher degree of importance, and therefore the degree of confidentiality of a file and the degree of importance of a file have an equivalent relationship. In this way, the security point according to this embodiment is an example of a "confidentiality value." Note that, for ease of explanation, security points will hereinafter be referred to as "points."

[0055] As described above, the conditional expression with the conditional expression ID "Cond001" in Fig. 5 indicates that 5 points will be assigned if the file name of the file to be operated on contains the character string "Important." The conditional expression with the conditional expression ID "Cond002" in Fig. 5 indicates that 3 points will be assigned if the file content of the file to be operated on contains the character string "Confidential." Furthermore, the conditional expression with the conditional expression ID "Cond003" in Fig. 5 indicates that -9999 points will be assigned if the registered user who registered the file to be operated on in the file management device 10 is the same user as the user attempting to operate the file (referred to as the "operating user").

[0056] A negative point value is assigned to the conditional expression with the conditional expression ID "Cond003." This is because, if the user who registered the file in the file management device 10 is the same as the user attempting to operate the file, the user attempting to operate the file is presumed to be a user with administrative authority over the file, such as the file creator. In such a case, the need to restrict the requested operation is considered relatively low, so a negative point value is assigned. Naturally, the points associated with each conditional expression in FIG. 5 are merely examples, and the administrator will set the points taking into account the degree of restriction to be imposed on the operation.

[0057] The conditional expressions represented by the conditional expression IDs "Cond001" and "Cond002" in Fig. 5 are conditions related to the file information of the file to be operated, i.e., conditional expressions in which points are associated with the file conditions of the file to be operated. On the other hand, the conditional expression represented by the conditional expression ID "Cond003" in Fig. 5 is a condition related to the user information of the user who made the operation request, i.e., a conditional expression in which points are associated with the user conditions of the user who made the operation request.

[0058] Specifically, the file condition of the conditional expression with the conditional expression ID "Cond001" in Fig. 5 is a condition that specifies the character string used in the file name of the file for which an operation request has been made, and the file condition of the conditional expression with the conditional expression ID "Cond002" in Fig. 5 is a condition that specifies the character string used in the content of the file for which an operation request has been made. Also, the user condition of the conditional expression with the conditional expression ID "Cond003" in Fig. 5 is a condition that specifies the relationship between the user who registered the file to be operated and the user who made the file operation request.

[0059] The conditional expressions stored in the conditional expression DB 17 are created in advance by the administrator of the file management system 1 via a conditional expression setting screen 6, for example, as shown in Fig. 6. As shown in Fig. 6, the conditional expression setting screen 6 is provided with an add conditional expression button 6A, so the administrator can add a new line to the conditional expression setting screen 6 for creating a conditional expression. In addition, the conditional expression setting screen 6 is provided with a check box 6D for deleting a conditional expression, so the administrator can delete the conditional expression for which the check box 6D is checked by checking the check box 6D and selecting the clear button 6B. In other words, the administrator can increase or decrease the number of conditional expressions stored in the conditional expression DB 17.

[0060] On the conditional expression setting screen 6, the items and conditions of the conditional expression can be selected from a pull-down menu 6E, and the administrator directly inputs the character strings for the value and points of the conditional expression. After creating a conditional expression, the administrator selects the update button 6C, and the created conditional expression is stored in the conditional expression DB 17. There are no restrictions on the method of inputting a conditional expression on the conditional expression setting screen 6, and the above input method is merely one example.

[0061] Naturally, the conditional expression is not limited to the example shown in Fig. 5. For example, by setting the item as "registration date and time," the value as "12 months," the condition as "elapsed," and the points as "2," a conditional expression may be created that gives 2 points if 12 months have passed since the registration date and time of the file to be operated on in the file management device 10. In other words, the conditional expression DB 17 may include a conditional expression related to the registration date and time of the file.

[0062] Also, by setting the item to "storage location," the value to "NULL," the condition to "folder 1," and the points to "1," a conditional expression may be created that gives 1 point if the storage location of the file to be operated on in the file DB 16 is Folder 1. In other words, the conditional expression DB 17 may include a conditional expression related to the storage location of the file.

[0063] Also, by setting the item to "Last file acquisition date and time," the value to "1 hour," the condition to "before lapse," and the point to "1," a condition formula may be created that will give 1 point if the same user makes another acquisition request within less than 1 hour since acquiring the file to be operated on. In other words, the condition formula DB 17 may include a condition formula related to the frequency of file operations.

[0064] The calculation unit 14 sequentially acquires each conditional expression stored in the conditional expression DB 17, determines whether the condition for each conditional expression is satisfied, and calculates the total value of points associated with each conditional expression that satisfies the condition.

[0065] In response to this, the control unit 12 executes processing corresponding to the points calculated by the calculation unit 14 on the file for which the operation request has been made, in accordance with rules previously stored in the rule DB 18 that associate points with processing on the file.

[0066] Fig. 7 is a diagram showing an example of the data structure of the rule DB 18. As shown in Fig. 7, in the rule DB 18, a rule ID, a user ID, a threshold value, and a processing content are associated with each rule.

[0067] The rule ID is an identifier for uniquely identifying a rule stored in the rule DB 18 .

[0068] The user ID indicates the user ID of the user to whom the rule indicated by the rule ID applies.

[0069] The threshold value indicates the lower limit of points required to execute the processing content associated with the rule indicated by the rule ID.

[0070] The processing content indicates the content of processing to be executed when the total value of points calculated by the calculation unit 14 for the file to be operated on becomes equal to or greater than the threshold value.

[0071] That is, a rule represented by a rule ID is defined for each user who requests a file operation. Also, multiple rules may be defined for the same user. Each rule represented by a rule ID is an example of a "predetermined rule" according to this embodiment.

[0072] The rules stored in the rule DB 18 exist for each type of operation, but as an example, FIG. 7 shows rules corresponding to acquisition processing.

[0073] In FIG. 7, the rule with the rule ID "Rule001" is for a user with the user ID "User001", and indicates that only the cover of the file will be disclosed if the total number of points for the file acquisition request is 5 points or more. The rule with the rule ID "Rule002" is for a user with the user ID "User002", and indicates that the file will not be disclosed if the total number of points for the file acquisition request is 3 points or more. The rule with the rule ID "Rule003" is for a user with the user ID "User001", and indicates that the file will not be disclosed if the total number of points for the file acquisition request is 10 points or more.

[0074] When the points for an operation request are equal to or greater than the threshold value defined in the rule, the rule is said to be "established."

[0075] In addition, if multiple rules are established for a user who has made a file operation request, the control unit 12 executes the processing specified in the rule according to the rule that specifies the processing associated with the highest threshold value among the established rules.

[0076] The rules stored in the rule DB 18 are created by the administrator of the file management system 1 via a rule setting screen 8 as shown in Fig. 8, for example. As shown in Fig. 8, the rule setting screen 8 is provided with an add rule button 8A, which allows the administrator to add a new row for creating a rule to the rule setting screen 8. The rule setting screen 8 is also provided with a check box 8D for deleting a rule, so the administrator can delete the rule for which the check box 8D is checked by checking the check box 8D and selecting the clear button 8B. In other words, the administrator can increase or decrease the number of rules stored in the rule DB 18.

[0077] Meanwhile, the user name and processing details for a rule can be selected from a pull-down menu 8E, and the administrator directly inputs values ​​for the threshold values ​​for the rule. After creating a rule, the administrator selects the update button 8C, and the created rule is stored in the rule DB 18. There are no restrictions on the method for inputting rules on the rule setting screen 8, and the above input method is merely one example.

[0078] Next, an example of the configuration of the main parts of the electrical system of the file management device 10 will be described with reference to Fig. 9. The file management device 10 is configured using a computer 20, for example.

[0079] The computer 20 includes a CPU (Central Processing Unit) 21, a ROM (Read Only Memory) 22, a RAM (Random Access Memory) 23, a non-volatile memory 24, and an input / output interface (I / O) 25, and the CPU 21, ROM 22, RAM 23, non-volatile memory 24, and I / O 25 are each connected via a bus 26.

[0080] The CPU 21 is an example of a processor that handles the processing of each functional unit of the file management device 10 shown in Fig. 2. The ROM 22 is an example of a storage medium that stores an information processing program executed by the CPU 21. The RAM 23 is an example of a storage medium used as a temporary work area for the CPU 21.

[0081] The nonvolatile memory 24 is an example of a storage medium that maintains stored information even if the power supplied to the nonvolatile memory 24 is cut off, and is, for example, a semiconductor memory, but a hard disk may also be used. The user DB 15, file DB 16, conditional expression DB 17, and rule DB 18 according to the present embodiment will be described as being constructed in the nonvolatile memory 24, but they may also be constructed in an external device (not shown) such as a data server connected to the communication line 4. In this case, the CPU 21 transmits and receives various data, including files, to and from the external device via the communication unit 27.

[0082] The nonvolatile memory 24 does not necessarily have to be built into the computer 20, but may be a storage medium that is detachable from the computer 20, such as a memory card or a USB (Universal Serial Bus) memory.

[0083] To the I / O 25, for example, a communication unit 27, an input unit 28, and a display unit 29 are connected.

[0084] The communication unit 27 is connected to the communication line 4 and has a communication protocol for transmitting and receiving data to and from the user terminal 2 and external devices connected to the communication line 4.

[0085] The input unit 28 is a device that receives instructions from the administrator and notifies the CPU 21, and includes, for example, a button, a touch panel, a mouse, a keyboard, and a pointing device. The administrator can set conditional expressions and rules through the input unit 28.

[0086] The display unit 29 is an example of a display device that displays information processed by the CPU 21 as an image, and includes, for example, a liquid crystal display, an organic EL (Electro Luminescence) display, etc. The conditional expression setting screen 6 shown in FIG. 6 and the rule setting screen 8 shown in FIG. 8 are displayed on the display unit 29.

[0087] The administrator can also set conditional expressions and rules from a remote location using an external device. In this case, the conditional expression setting screen 6 shown in FIG. 6 and the rule setting screen 8 shown in FIG. 8 are displayed on the external device, and the administrator sets the conditional expressions and rules from the external device. Therefore, the input unit 28 and the display unit 29 are not necessarily essential units for the file management device 10. Other units may be connected to the I / O 25 as needed. For example, an image forming unit such as a printer may be connected to the I / O 25 to print various data stored in the user DB 15, file DB 16, conditional expression DB 17, and rule DB 18 on paper.

[0088] Next, the operation of the file management device 10 will be described. Fig. 10 is a flowchart showing an example of the flow of registration processing executed by the CPU 21 when a file registration request is received from the user terminal 2. An information processing program that defines the registration processing is stored in advance in the ROM 22 of the file management device 10, for example. The CPU 21 of the file management device 10 reads the information processing program stored in the ROM 22 and executes the registration processing.

[0089] For the sake of convenience, it is assumed that the file registration request received from the user terminal 2 includes the user name of the registering user as user information, along with the file to be registered.

[0090] In step S10 of FIG. 10, the CPU 21 acquires the file received together with the registration request and stores it in the RAM 23.

[0091] In step S20, the CPU 21 acquires the user information of the registered user added to the registration request and stores it in the RAM 23.

[0092] In step S30, CPU 21 acquires a user ID corresponding to the user name included in the user information acquired in step S20, by referring to user DB 15. In the example of user DB 15 shown in Fig. 3, if the user name included in the user information is "User A", CPU 21 acquires "User001" as the user ID.

[0093] In addition, CPU21 extracts file information of the file acquired in step S10, and stores in file DB16 a new file ID that does not overlap with the file IDs of other files already registered in file DB16, the file information extracted from the file to be registered, and the user ID of the registered user, in association with the file to be registered.

[0094] 4, the CPU 21 extracts the file name and file contents as file information. That is, the file information extracted from the file to be registered conforms to the file information items specified to be stored in the file DB 16.

[0095] This completes the registration process shown in Fig. 10. The CPU 21 may also send a registration completion notification to the user terminal 2 that requested the file to be registered, informing the user that the file registration has been completed. The file ID and file name of the file registered in the file management device 10 are made public to each user terminal 2, for example, via a Web page.

[0096] Next, a file acquisition process when a file acquisition request is received from the user terminal 2 as an example of a request for operating a file will be described.

[0097] Fig. 11 is a flowchart showing an example of the flow of an acquisition process executed by the CPU 21 when a file acquisition request is received from the user terminal 2. As with the registration process shown in Fig. 10, the process content of the acquisition process is defined by an information processing program, and the CPU 21 reads the information processing program stored in the ROM 22 and executes the acquisition process.

[0098] In step S100 of FIG. 11, CPU 21 acquires the file name of the file to be acquired (referred to as the "acquired file") requested by the acquisition request, and also acquires user information of the user who made the acquisition request (referred to as the "acquired user") from the acquisition request and stores it in RAM 23.

[0099] In step S110, CPU 21 acquires a user ID corresponding to the user name of the acquired user included in the user information acquired in step S100, by referring to user DB 15. CPU 21 also acquires file information of the acquired file from file DB 16 based on the file name acquired in step S100.

[0100] The acquisition user may include the file ID of the acquired file in the acquisition request instead of the file name of the acquired file. In this case, the CPU 21 acquires the file information of the acquired file from the file DB 16 based on the file ID.

[0101] In step S120, the CPU 21 acquires all conditional expressions stored in the conditional expression DB 17. The CPU 21 determines, for each conditional expression, whether the condition expressed by the conditional expression is satisfied, using the user information of the acquired user and the file information of the acquired file. Then, the CPU 21 calculates the total number of points associated with each conditional expression that satisfies the condition.

[0102] For example, assume that three conditional expressions represented by the conditional expression IDs "Cond001," "Cond002," and "Cond003" shown in Fig. 5 are stored in the conditional expression DB 17. In this case, consider the points when User A, as the acquiring user, makes an acquisition request for "Important Documents.docx" whose file ID is "File001" (referred to as "Case 1").

[0103] The file name of "Important Documents.docx" contains the character string "important." Therefore, it satisfies the condition expressed by the conditional expression "Cond001."

[0104] Furthermore, as shown in Figure 4, the file contents of "Important Documents.docx" do not contain the string "Confidential." Therefore, the condition expressed by the conditional expression "Cond002" is not satisfied.

[0105] Also, as shown in Figure 4, the user ID of the registered user of "Important Documents.docx" is "User002." On the other hand, the user ID of the acquiring user is "User001" when referring to the user DB 15 shown in Figure 3, so the registered user of "Important Documents.docx" is different from the acquiring user. Therefore, the condition expressed by the conditional expression "Cond003" is not satisfied.

[0106] From the above results, the CPU 21 calculates 5 points associated with the conditional expression "Cond001" that satisfies the condition as points for the acquisition request.

[0107] Furthermore, the points in the case where User B, as an acquisition user, makes an acquisition request for "examination materials.txt" represented by the file ID "File003" (referred to as "Case 2") will be considered.

[0108] The file name of "Examination Materials.txt" does not contain the character string "Important." Therefore, the condition expressed by the conditional expression "Cond001" is not satisfied.

[0109] Furthermore, as shown in Figure 4, the file contents of "Examination Materials.txt" contain the string "Confidential." Therefore, the condition expressed by the conditional expression "Cond002" is met.

[0110] As shown in Figure 4, the user ID of the registered user of "examination materials.txt" is "User002." On the other hand, the user ID of the acquiring user is also "User002" when referring to the user DB 15 shown in Figure 3, so the registered user of "examination materials.txt" is the same user as the acquiring user. Therefore, the condition expressed by the conditional expression "Cond003" is satisfied.

[0111] From the above results, the CPU 21 calculates the points for the acquisition request as -9996, which is the sum of the 3 points and -9999 points respectively associated with the conditional expressions "Cond002" and "Cond003" that satisfy the conditions.

[0112] If there is no conditional expression that satisfies the condition, the CPU 21 sets the point as indefinite.

[0113] After calculating the points for the acquisition request in this way, in step S130 of FIG. 11, the CPU 21 executes a process corresponding to the points for the acquisition request.

[0114] For this purpose, the CPU 21 refers to the rules for the acquisition request stored in the rule DB 18, and acquires, from among the rules associated with the user ID of the acquiring user, rules for which the points for the acquisition request are equal to or greater than the threshold, i.e., rules that have been fulfilled. As already described, if there are multiple fulfilled rules, the CPU 21 selects the rule associated with the highest threshold among the fulfilled rules.

[0115] Then, the CPU 21 executes the process content associated with the acquired rule.

[0116] For example, it is assumed that the rule DB 18 stores three rules represented by the rule IDs "Rule001", "Rule002", and "Rule003" shown in FIG.

[0117] In the case of Case 1 described above, since the user ID of the acquiring user is “User001” and the points for the acquisition request are 5 points, CPU21 discloses only the processing content associated with the rule with rule ID “Rule001”, i.e., the cover page of the file to be acquired (in this case, “Important Documents.docx”).

[0118] In addition, in the case of Case 2 described above, the user ID of the acquiring user is “User002” and the points for the acquisition request are −9996 points, so there is no rule that holds true in the rule DB 18. In such a case, the CPU 21 discloses the entire file to be acquired (in this case, “examination material.txt”).

[0119] Note that if the points for a file operation request are indefinite, none of the conditions expressed by the conditional expressions are satisfied, and therefore, it is possible that there is a problem with the settings of the conditional expressions. Therefore, when the points are indefinite, the CPU 21 imposes the strictest restrictions on file operations (in this case, file acquisition) based on the fail-safe concept. Furthermore, if the user ID of the acquiring user does not match any of the user IDs defined in the rule DB 18, there is a possibility of unauthorized access. Therefore, even if the user ID does not match any of the user IDs defined in the rule DB 18, the CPU 21 imposes the strictest restrictions on file operations. In other words, if the file operation request is a file acquisition request, the CPU 21 executes processing to prohibit the disclosure of the file in either case.

[0120] The method of disclosing files may be either a method of sending files within the range permitted for disclosure according to the rules to the user terminal 2 that sent the acquisition request, or a method of controlling the display of only the range permitted for disclosure for each acquiring user when disclosing the file requested by the user terminal 2 to the acquiring user by, for example, displaying it on a web page.

[0121] This completes the acquisition process shown in FIG.

[0122] For other types of operations such as deleting, editing, moving, and copying files, the administrator can set the processing content and threshold value corresponding to each operation in rule DB18, such as prohibiting deletion if the points are 8 or more, thereby restricting file operations in response to various operation requests.

[0123] 7 shows an example in which rules are defined for each user, but each user may be classified into groups in advance and rules may be defined for each group. In this case, the CPU 21 executes the processing content associated with the group to which the acquired user belongs according to the points.

[0124] In this way, the administrator may set rules for groups in the rule DB 18 instead of rules for users, or may set rules for both users and groups.

[0125] 12 is a diagram showing an example of the rule DB 18 in which rules for both users and groups are set. A rule in which "GrpNNN" (N is a number) is set as the user ID is the rule that applies to users belonging to group NNN.

[0126] In the rule DB 18 shown in FIG. 12, for example, if a user represented by a user ID "User001" belongs to a group represented by "Grp001" and has 6 points for the acquisition request, both the rule represented by the rule ID "Rule001" and defined for the user and the rule represented by the rule ID "Rule010" and defined for the group will be satisfied. Even in such a case, the CPU 21 selects the rule associated with the highest threshold value among the satisfied rules. That is, the CPU 21 selects the rule represented by the rule ID "Rule001".

[0127] While one aspect of an information processing device has been described above using an embodiment, the disclosed information processing device is merely an example, and the information processing device is not limited to the scope of the embodiment. Various modifications or improvements can be made to the embodiment without departing from the spirit of the present disclosure, and such modifications or improvements are also included in the technical scope of the disclosure. For example, the order of the registration process and acquisition process shown in Figures 10 and 11 may be changed without departing from the spirit of the present disclosure.

[0128] In the above embodiment, the registration process and acquisition process are implemented by software. However, the same processes as those shown in Figures 10 and 11 may be implemented by hardware. In this case, the processing speed can be increased compared to when the registration process and acquisition process are implemented by software.

[0129] In the above embodiment, the term "processor" refers to a processor in a broad sense, and includes general-purpose processors (e.g., CPU 21) and dedicated processors (e.g., GPU: Graphics Processing Unit, ASIC: Application Specific Integrated Circuit, FPGA: Field Programmable Gate Array, programmable logic device, etc.).

[0130] Furthermore, the operations of the processors in the above embodiments may not only be performed by a single processor, but may also be performed by multiple processors located at physically separate locations working together. Furthermore, the order of the operations of the processors is not limited to the order described in the above embodiments, and may be changed as appropriate.

[0131] In the above embodiment, an example in which the information processing program is stored in ROM 22 has been described, but the storage destination of the information processing program is not limited to ROM 22. The information processing program of the present disclosure can also be provided in a form recorded on a storage medium readable by computer 20. For example, the information processing program may be provided in a form recorded on an optical disc such as a CD-ROM (Compact Disk Read Only Memory) or a DVD-ROM (Digital Versatile Disk Read Only Memory). Furthermore, the information processing program may be provided in a form recorded on a portable semiconductor memory such as a USB memory or a memory card.

[0132] ROM 22, non-volatile memory 24, CD-ROM, DVD-ROM, USB, and memory cards are examples of non-transitory storage media.

[0133] Furthermore, the information processing device may download an information processing program from an external device connected to the communication unit 27 via the communication line 4, and store the downloaded information processing program in a non-transitory storage medium. In this case, the CPU 21 of the information processing device reads the information processing program downloaded from the external device from the non-transitory storage medium and executes the notification process. [Explanation of symbols]

[0134] 1. File Management System 2. User terminal 4. Communication lines 6 Conditional expression setting screen 6A Add button on the conditional expression setting screen 6B Clear button on the conditional expression setting screen 6C Update button on the conditional expression setting screen 6D Checkboxes on the Condition Expression Settings Screen 6E Pull-down menu on the conditional expression setting screen 8. Rule setting screen 8A Add button on the rule settings screen 8B Clear button on the rule setting screen 8C Update button on the rule setting screen Checkboxes on the 8D rule settings screen 8E Pull-down menu on the rule setting screen 10 File management device 11 Communications Department 12 Control Unit 13 File Management Section 14 Calculation section 15 User DB 16 File DB 17 Conditional expression DB 18 Rule DB 20 Computer 21 CPU 22 ROM 23 RAM 24 Non-volatile memory 26 Bus 27 Communication Unit 28 Input Units 29 Display Unit

Claims

1. a processor; The processor: obtaining a confidentiality value representing a confidentiality level of the file for which the operation request has been made, using at least one of the attributes of the user who has made the file operation request and the file information of the file for which the operation request has been made; When a process corresponding to the confidential value is executed on the file for which an operation request has been made in accordance with a predetermined rule that associates the confidential value with a process for the file, obtaining a conditional expression in which the confidential value is associated with at least one of a user condition relating to a user attribute and a file condition relating to file information; Execute a process corresponding to the sum of the secret values ​​associated with each of the conditional expressions that satisfy the condition. Information processing device.

2. The user condition includes a condition that defines a relationship between a user who registered a file that has made an operation request and a user who has made an operation request for the file; The file conditions include at least one of a condition that specifies a character string used in the file name of the file for which the operation request is made and a condition that specifies a character string used in the content of the file for which the operation request is made. The information processing device according to claim 1 .

3. The content of the file on which the operation request was made is represented by at least one keyword extracted from the body of the file. The information processing device according to claim 2 .

4. the predetermined rule is defined for each user, The processor executes a process corresponding to the confidential value on the file for which an operation request has been made, in accordance with the predetermined rule defined for the user who has made the file operation request.

4. The information processing device according to claim 1.

5. The predetermined rule is also defined for each group to which a user belongs, and when the confidentiality value corresponds to both the predetermined rule defined for the user who has made the file operation request and the predetermined rule defined for the group to which the user who has made the file operation request belongs, the processing corresponding to the confidentiality value is performed on the file for which the operation request has been made in accordance with the predetermined rule that provides a higher level of confidentiality for the file. The information processing device according to claim 4 .

6. On the computer, obtaining a confidentiality value representing a confidentiality level of the file for which the operation request has been made, using at least one of the attributes of the user who has made the file operation request and the file information of the file for which the operation request has been made; When a process corresponding to the confidential value is executed on a file for which an operation request has been made in accordance with a predetermined rule that associates the confidential value with a process for the file, obtaining a conditional expression in which the confidential value is associated with at least one of a user condition relating to a user attribute and a file condition relating to file information; Execute a process corresponding to the sum of the secret values ​​associated with each of the conditional expressions that satisfy the condition. An information processing program for executing processing.

Images