DOCUMENT MANAGEMENT SYSTEM AND DOCUMENT MANAGEMENT METHOD

• US 20080098455A1
• Filed: 10/02/2007
• Published: 04/24/2008
• Est. Priority Date: 10/20/2006
• Status: Active Grant

• Current Assignee: Canon Kabushiki Kaisha (Canon Inc.)
• Original Assignee: Canon Kabushiki Kaisha (Canon Inc.)
• Inventors: Hirahara, Akiko
• Granted Patent: US 8,561,128 B2
• Time in Patent Office: Days
• US Class Current: 726/1
• CPC Class Codes: G06F 21/602 Providing cryptographic facilities or services
• CPC Class Codes: G06F 21/608 Secure printing
• CPC Class Codes: G06F 21/6209 to a single file or object, e.g. in a secure envelope, encrypted and accessed using a key, or with access control rules appended to the object itself
• CPC Class Codes: G06F 2221/2141 Access rights, e.g. capability lists, access control lists, access tables, access matrices

Abstract

A document management system configured to manage an access to a file includes a selection unit configured to select a virtual security policy for setting on the file, which is previously provided for each device, an acquisition unit configured to acquire access authority information for defining an authority for accessing the file based on the virtual security policy selected by the selection unit and authentication information about a user who has set the virtual security policy, a conversion unit configured to convert the virtual security policy into a real security policy that can be commonly interpreted by the document management system based on the access authority information acquired by the acquisition unit, and a management unit configured to set the real security policy converted by the conversion unit on the file to manage an access to the file.

Claims

1. A document management system configured to manage an access to a file, the document management system comprising:

a selection unit configured to select a virtual security policy for setting on the file, which is previously provided for each device;

an acquisition unit configured to acquire access authority information for defining an authority for accessing the file based on the virtual security policy selected by the selection unit and authentication information about a user who has set the virtual security policy;

a conversion unit configured to convert the virtual security policy into a real security policy that can be commonly interpreted by the document management system based on the access authority information acquired by the acquisition unit; and

a management unit configured to set the real security policy converted by the conversion unit on the file to manage an access to the file.

2. The document management system according to claim 1, further comprising an access authority determination unit configured to determine whether a user requesting an access to the file has an access authority for accessing the file having the real security policy based on authentication information about the user requesting the access to the file.

3. The document management system according to claim 2, wherein the management unit controls an access to the file based on a result of determination by the access authority determination unit.

4. The document management system according to claim 1, wherein the access authority information acquired by the acquisition unit includes information for defining a type of an access to the file and information about a user group whose access to the file is controlled.

5. The document management system according to claim 4, further comprising a user group information storage unit configured to store information about the user group,

wherein the acquisition unit acquires the information about the user group from the user group information storage unit based on the authentication information about the user who has set the virtual security policy, and

wherein the conversion unit converts the virtual security policy into the real security policy based on the information about the user group acquired by the acquisition unit.

6. The document management system according to claim 1, further comprising:

a file storage unit configured to set the virtual security policy selected by the selection unit on the file and then to store the file;

an access request determination unit configured to determine whether an access to the file stored in the file storage unit has been requested; and

a sending unit configured send a policy conversion request to the acquisition unit when the access request determination unit determines that an access to the file has been requested,

wherein the acquisition unit acquires the access authority information based on the policy conversion request sent from the sending unit, and

wherein the conversion unit converts the virtual security policy into the real security policy based on the access authority information acquired by the acquisition unit based on the policy conversion request.

7. The document management system according to claim 1, wherein the selection unit, the acquisition unit, and the conversion unit are provided on a same network device included in the document management system.

8. A method for a document management system configured to manage an access to a file, the method comprising:

selecting a virtual security policy for setting on the file, which is previously provided for each device;

acquiring access authority information for defining an authority for accessing the file based on the selected virtual security policy and authentication information about a user who has set the virtual security policy;

converting the virtual security policy into a real security policy that can be commonly interpreted by the document management system based on the acquired access authority information; and

setting the converted real security policy on the file to manage an access to the file.

9. The method according to claim 8, further comprising determining whether a user requesting an access to the file has an access authority for accessing the file having the real security policy based on authentication information about the user requesting the access to the file.

10. The method according to claim 9, further comprising controlling an access to the file based on a result of the determination as to whether the user accessing the file has an access authority for accessing the file having the real security policy.

11. The method according to claim 8, wherein the acquired access authority information includes information for defining a type of an access to the file and information about a user group whose access to the file is controlled.

12. The method according to claim 11, further comprising:

storing information about the user group in a user group information storage unit;

acquiring the information about the user group from the user group information storage unit based on the authentication information about the user who has set the virtual security policy; and

converting the virtual security policy into the real security policy based on the acquired information about the user group.

13. The method according to claim 8, further comprising:

setting the selected virtual security policy on the file and then storing the file in a file storage unit;

determining whether an access to the file stored in the file storage unit has been requested;

sending a policy conversion request when it is determined that an access to the file has been requested;

acquiring the access authority information based on the sent policy conversion request; and

converting the virtual security policy into the real security policy based on the access authority information acquired based on the policy conversion request.

14. The method according to claim 8, wherein selecting a virtual security policy, acquiring access authority information, and converting the virtual security policy into a real security policy are performed by a same network device included in the document management system.

15. A computer-readable storage medium storing instructions which, when executed by a document management system configured to manage an access to a file, cause the document management system to perform the method according to claim 8.