SYSTEM, METHOD AND PROGRAM FOR INFORMATION PROCESSING

• US 20110218999A1
• Filed: 11/13/2009
• Published: 09/08/2011
• Est. Priority Date: 11/14/2008
• Status: Active Grant

• Current Assignee: NEC Corporation
• Original Assignee: NEC Corporation
• Inventors: Kan, Masaki, Kajiki, Yoshihiro
• Granted Patent: US 9,002,811 B2
• Time in Patent Office: Days
• US Class Current: 707/737
• CPC Class Codes: G06F 16/217 Database tuning G06F16/2282 takes precedence; database performance monitoring G06F11/3409
• CPC Class Codes: G06F 21/6227 where protection concerns the structure of data, e.g. records, types, queries

Abstract

The index update unit analyses the information stored in a document repository to create an index for search and stores the index in a time-series divisional index storage unit and creates, from an ACL repository, an access control entry ACE in association with the index for search, which is correlation of information to be searched with access right of at least a group to which the user belongs. The ACL cache generation unit creates ACL cache data that correlates the user with access right to the information to be searched, from the ACE, and registers the ACL cache data created in an ACL cache. A search processing unit searches for an index for search in response to a request for search from said user. In case the ACL cache data correlating the user with the index for search is registered in the ACL cache, the search processing unit_takes, from among the information searched, the information, reference to which is allowed for the user as a search result, based on information in the ACL cache.

Claims

1. An information processing system comprising:

a storage unit storing therein correspondence between a set of users and access right of said group of users to information to be searched; and

a search apparatus that makes reference to access right of said group of users to information to be searched, based on correspondence relation between a user and a group of users to which said user belongs, and derives access right of said user to said information to be searched,

said search apparatus, from among information searched in response to a request for search from said user, taking information, reference to which by said user is allowed, as a search result.

2. The information processing system according to claim 1, wherein said search apparatus comprises:

an analyzing unit that analyzes information from an information storage unit storing therein said information to be searched, and creates an index for search to store said index for search in a storage unit;

an index update unit that creates, from an access control information storage unit storing access control information therein, an access control entry in association with said index for search to store said access control entry in a storage unit, said access control entry correlating said information to be searched with access right of at least a group to which a user belong;

an ACL cache generation unit that creates access control cache data which correlates a user with access right to said information to be searched, from said access control entry, and registers said access control cache data created in a cache; and

a search processing unit that searches said index for search in response to a request for search from said user,

said search processing unit, in case said access control cache data correlated with said user and said index for search is registered in said cache, taking information, reference to which is allowed for said user, from among information searched, as a search result, based on said access control cache data registered in said cache.

3. The information processing system according to claim 2, wherein in case said access control cache data associated with said user and said index as an object for search is not registered in said cache, said search processing unit creates, from said access control entry, access control cache data that correlates said user with access right to said information to be searched,

said search processing unit registering said access control cache data in said cache, and

said search processing unit taking information, reference to which is allowed for said user, from among information searched, as a search result, based on said access control cache data created.

4. The information processing system according to claim 2, wherein said access control entry stores an information ID in association with a group ID, for each of reference not allowed (DENY) field and reference allowed (ALLOW) field,

said search processing unit taking, in case access control cache data of said cache is not used, a list of information not included in said reference not allowed (DENY) field and included in said reference allowed (ALLOW) field, out of a list of information searched in accordance with a search condition that is included said request for search, as a search result.

5. The information processing system according to claim 4, wherein said search processing unit registers a list of information not included in said reference not allowed (DENY) field and included in said reference allowed (ALLOW) field of said access control entry, in said cache, in association with said user.

6. The information processing system according to claim 2, wherein a plurality of divisional indices are provided in said storage unit as said indices for search,

said search processing unit selecting one out of said plurality of divisional indices, based on a condition specified in said request for search, said search processing unit executing search using said divisional index selected.

7. The information processing system according to claim 6, wherein said index update unit updates an index for search and an access control entry of a preset one of said plurality divisional indices.

8. The information processing system according to claim 6, wherein said index update unit generates said divisional indices by partitioning indices in time-series.

9. The information processing system according to claim 2, further comprising:

an authentication unit that performs authentication, when a user logs in, and acquires right information to supply said right information acquired to said search processing means and to said ACL cache generation means.

10. The information processing system according to claim 2, further comprising

a search condition input unit that inputs time or trigger information, as a base point of search, as said search condition.

11. The information processing system according to claim 1, comprising a cache holding access right to said information to be searched, said access right being derived for said user.

12. The information processing system according to claim 11, wherein said access right of said user to said information to be searched is derived when a request for search is issued by said user or when said user logs in.

13. A information processing method comprising:

storing correspondence between a group of users and access right of a group of users to said information to be searched in a storage unit; and

referencing to access right to said information to be searched by said a group of users to which belongs said user and deriving access right of said user to said information to be searched, based on correspondence relation of said user and said group of users; and

taking information, reference to which by said user is allowed, from among information searched in response to a request for search from said user, as a search result.

14. The information processing method according to claim 13, further comprising:

analyzing information from information storage means in which said information to be searched is stored, and generating an index for search to store said index for search generated in said storage unit;

creating, from an access control information storage unit in which access control information is stored, an access control entry in association with said index for search, and storing said access control entry in a storage unit, said access control entry being correlation of said information to be searched with access right of at least a group to which said user belongs;

creating access control cache data that correlates said user with access right to said information to be searched, from said access control entry, and registering said access control cache data created in a cache; and

searching said index for search in response to a request for search from said user and taking, in case said access control cache data correlated with said user and said index for search is registered in said cache, information, reference to which is allowed for said user, from among information searched, as a search result, based on said access control cache data in said cache.

15. The information processing method according to claim 14, further comprising:

creating access control cache data that correlates said user with access rights to said information to be searched, from said access control entry, in case said access control cache data associated with said user and said index for search of interest is not registered in said cache;

registering said access control cache data in said cache; and

taking information, reference to which is allowed for said user, from among information searched, as a search result, based on said access control cache data created.

16. The information processing method according to claim 13, wherein said access control entry stores an information ID in association with a group ID, for each of a reference not allowed (DENY) field and a reference allowed (ALLOW) field;

said information processing method comprising

taking, in case access control cache data of said cache is not used, a list of said information not included in said reference not allowed (DENY) field and included in said reference allowed (ALLOW) field, out of a list of said information searched in accordance with said search condition included said request for search, as a search result.

17. The information processing method according to claim 16, further comprising:

registering, in said cache, in association with said user, a list of information not included in said reference not allowed (DENY) field and not included in said reference allowed (ALLOW) field of said access control entry, as a search result.

18. The information processing method according to claim 14, wherein a plurality of divisional indices are provided in said storage unit as said indices for search;

said information processing method further comprising

selecting one out of said plurality of divisional indices, based on a condition specified in said request for search, and performing said search using said divisional index selected.

19. The information processing method according to claim 18, further comprising

updating indices for search and an access control entry of a preset one of said plurality of divisional indices.

20. The information processing method according to claim 18, wherein said divisional indices are obtained on partitioning in time-series.

21. The information processing method according to claim 14, further comprising:

performing authentication when a user logs in to acquire said right information to supply said right information acquired to said search processing step and to said creating access control cache data step.

22. The information processing method according to claim 14, further comprising

inputting time or trigger information as a base point of search as said search condition.

23. The information processing method according to claim 13, wherein a result derived of access right of said user to said information to be searched is held in said cache.

24. The information processing method according to claim 23, wherein a result of access right of said user to said information to be searched is derived when a request for search is issued by said user or when said user logs in.

25. A computer-readable recording medium storing a program causing a computer, capable of referencing to a storage unit storing therein correspondence between a set of users and information to be searched, to execute

referencing to access right to said information to be searched of said set of users to which belongs said user and deriving access right of said user to said information to be searched, based on correspondence relation of said user and said set of users;

and

taking information, reference to which by said user is allowed, from among information searched in response to a request for search from said user, as a search result.

26. The computer-readable recording medium according to claim 25, storing the program causing said computer to execute:

analyzing information from information storage means storing said information to be searched therein, and creating an index for search to store said index generated in said storage unit, with said user being a user and with said set of users being managed as a group;

index update processing that creates, from access control information storage means storing access control information therein, an access control entry in association with said index for search, and stores said access control entry in said storage unit, said access control entry being correlation of said information to be searched with access right of at least a group to which said user belongs;

ALC cache creating processing that creates access control cache data which correlates said user with access right to information to be searched, from said access control entry, and that registers said access control cache data created in a cache; and

search processing that searches said index for search in response to said request for search from said user and that takes, in case said access control cache data associated with said user and said index for search is registered in said cache, information, reference to which is allowed for said user, from among information searched, as a search result, based on said access control cache data in said cache.

27. The computer-readable recording medium storing the program according to claim 26, causing said computer to execute:

creating access control cache data that correlates said user with access right to said information to be searched, from said access control entry, in case said access control cache data associated with said user and said index for search of interest is not registered in said cache;

registering said access control cache data in said cache; and

taking information, reference to which is allowed for said user, from among information searched, as a search result, based on said access control cache data created.

28. The computer-readable recording medium storing the program according to claim 26, wherein said access control entry stores an information ID in association with a group ID, for each of a reference not allowed (DENY) field and a reference allowed (ALLOW) field,

said information processing taking, in case access control cache data of said cache is not used, a list of information not included in said reference not allowed (DENY) field and included in said reference allowed (ALLOW) field, out of a list of information searched in accordance with the search condition included said request for search, as a search result.

29. The computer-readable recording medium storing the program according to claim 28, wherein said search processing registers a list of the information not included in said reference not allowed (DENY) field and not included in said reference allowed (ALLOW) field of said access control entry in said cache, in association with said user.

30. The computer-readable recording medium storing the program according to claim 26, wherein a plurality of divisional indices are provided in said storage unit as said indices for search,

said information processing comprising

selecting one out of said plurality of divisional indices, based on a condition specified in said request for search, and performing search using said divisional index selected.

31. The computer-readable recording medium storing the program according to claim 30, wherein said index update processing updates an access control entry and the indices for search of a preset one of said plurality of divisional indices.

32. The computer-readable recording medium storing the program according to claim 31, wherein said divisional index is obtained on partitioning in time-series.

33. The computer-readable recording medium storing the program according to claim 26, causing said computer to execute

authentication when a user logs in to acquire right information to supply said right information acquired to said search processing and to said ACL cache generation processing.

34. The computer-readable recording medium storing t The program according to claim 26, causing said computer to execute

inputting time or trigger information as a base point of search as said search condition.

35. The computer-readable recording medium storing the program according to claim 25, causing said computer to execute

storing a result derived of access right of said user to said 1.0 information to be searched in said cache.

36. The computer-readable recording medium storing the program according to claim 35, wherein a result of access right of said user to said information to be searched is derived when a request for search is issued by said user or when said user logs in.

37. A search apparatus comprising

a storage unit that stores, as information for managing access right to a document, an access control entry including an information structure that correlates a document ID with a group ID on a per group basis, said group including a plurality of users, wherein

a search unit that executes matching of access right to a document, searched in response to a request for search by a user, in terms of a group to which belongs said user as a unit, or

in terms of a user as a unit, based on correlation between said user ID and said document ID, derived from information of said access control entry, and that extracts a document that meets with access right of said user from among documents which meet with a condition for search.

38. The search apparatus according to claim 37, wherein said access control entry includes, as said access right for at least a group ID, correlation of a document ID, reference to which is allowed for said group ID and a document, reference to which is denied for said group ID, and wherein

said search unit, out of documents that meet with said search condition, generates a list of documents, reference to which is allowed for said user and reference to which is not denied for said user.

39. The search apparatus according to claim 37, wherein said search unit derives correlation between said user ID and group ID beforehand from information in said access control entry or said correlation in response to a request for search from said user.

40. The search apparatus according to claim 39, comprising:

a unit that derives correlation between said user ID and said document ID from information in said access control entry, and that stores, in a cache, correlation of a key including said user ID with a document ID, reference to which is allowed for said user ID, wherein said search unit generates

a list of documents that meet with said search condition and also with access right of said user by referencing to said cache.