JP2000306026A - Electronic form processing method - Google Patents

Abstract

(57) [Summary] [Problem] To prevent unauthorized transactions by a user in electronic commerce using an electronic form. In a server, an electronic form template is divided into server-defined parameters and user-defined parameters for access control parameters for controlling reading and updating of input items of a form and records of a business database.
101), obtains a hash value of each parameter, adds an encrypted signature (1103), transmits a template according to the request of the client (1104 1201), and when the parameter is updated on the client (1202), the same as 1103 (120
3), input the data (1204), perform the same process on the data as in 1103 (1205), obtain the hash value of the parameter, and confirm the falsification of the parameter based on the composite of this and the signature ( 1206) and sends the template to the server (1206
7) The server confirms tampering as in 1206, performs processing on the template, and returns the result to the client.

Description

DETAILED DESCRIPTION OF THE INVENTION

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to an electronic form processing method, and more particularly, to an electronic form processing method capable of checking a user for input errors and illegal inputs, and for preventing unauthorized alteration of data. About the method.

[0002]

2. Description of the Related Art As an electronic form processing method via a communication network, an electronic form processing method using the Internet has attracted attention. This is a method in which data input on the client side is sent to the server side, the server performs processing in cooperation with a database or the like, and outputs the result to the client side. To link the server with the database,
A device using a CGI (Common Gateway Interface) is generally used. The CGI defines an interface between a server and an external program, and a CGI program using the CGI enables cooperation between the server and an external system such as a database.

According to pages 141 to 184 of "Object-Oriented Database Technology for Intranet" (published by Soft Research Center, Kazuhiro Oiso et al.), The specific procedure is as follows. A request for starting a CGI program from a web browser to a web server A web server starts a CGI program and passes parameters A CGI program accesses a database system A search or update result or action is returned from the database system to the CGI program from the database system. Return the result to HTML and return it to the standard output of the Web server. The Web server transfers the output of the CGI program to the Web browser. Here, in order to guarantee the confidentiality and integrity of the data and system from the user's request, the CGI program By removing unauthorized requests from users and managing access to Web servers and database systems, unauthorized access and tampering with Web servers and database systems are prevented. There is also a method in which a download program is installed on a client from a server, thereby preventing an unauthorized request from a user on the client side.

[0004]

SUMMARY OF THE INVENTION However, CGI
In the program, the user's input is processed on the server side, so a simple input error or input omission is sent to the server side once, the error is detected for the first time, it is sent back to the client again, and the input is accepted. Therefore, communication overhead increases. In addition, since a form for activating the CGI program can be created and transmitted by the user without permission, filtering must be performed on the CGI program side in anticipation of all possible unauthorized accesses by the user. Regarding how to install the download program on the client side and prevent user's unauthorized input on the client side,
It is costly to create and manage programs for different types of forms. Also in this method, the user can create a program without permission and transmit the data to the server. Furthermore, the method using the CGI program, the method using the download program,
Basically, since the management is performed on a program basis, the management cost increases when a change is made to the processing method.

SUMMARY OF THE INVENTION An object of the present invention is to solve the problems of the prior art, reduce the number of applications required for processing an electronic form, and flexibly cope with a change in processing procedure. It is an object of the present invention to provide an electronic document processing method capable of preventing an unauthorized transaction of a user while reducing an overhead of communication between a server and a client due to an input error of the electronic form.

[0006]

In order to achieve the above object, the present invention provides an electronic form processing system having a server and a client, wherein input / output items in an electronic form and displayed or input to the input / output items are provided. A business database corresponding to the input / output items of the electronic form in accordance with the data displayed or input in the input / output items of the electronic form according to the electronic form template storing the correspondence with the records of the business database storing the data. An electronic form processing method for reading or updating a record of an electronic form, wherein parameter information (access control parameter information) for controlling reading and updating of a data record of a business database corresponding to an input / output item to the electronic form is stored in the electronic form. Stored in the template, reference to the access control parameter information, New of the authority, one or more of the management level according to the security policy (access control level)
And an identification code indicating the access control level is added as a tag code (security tag code) to the access control parameter, and a specific access control parameter value or a set of parameter values to which the security tag code is added is To generate a hash value using a one-way hash function.

Further, after storing the generated hash value, the server sends the electronic form template to the client in response to a request from the client, and the client generates the electronic form template based on the transmitted electronic form template. After recording a data input request for an input / output item or a data display request (also referred to as a data access request) in the electronic form template, the electronic form template is sent to the server, and the server receives the received electronic form template. Generates a hash value of an access control parameter value or a set of parameter values to which a specific security tag code stored in the electronic form template is compared, and compares it with the hash value of the electronic form template stored in advance in the server. Specific memory After confirming that the access control parameter value to which the security tag code has been added or the content of the parameter value has not been tampered with, based on the access request stored in the electronic form template, The data record of the corresponding business database is read or updated.

Further, in an electronic form processing system having a server and a client, an electronic form storing an association between input / output items in an electronic form and a record in a business database storing data displayed or input in the input / output items. An electronic form processing method for reading or updating a record of a business database corresponding to an input / output item of an electronic form in accordance with data displayed or input in an input / output item of the electronic form according to a form template. Parameter information (access control parameter information) for controlling reading and updating of a business database data record corresponding to an input / output item to / from an electronic form is stored in the electronic form template, and authority to refer to and update the access control parameter information is stored. According to security policy Management level (access control level)
, And an identification code indicating the access control level is added to the access control parameter as a tag code (security tag code), and an access control parameter value to which a specific security tag code is added to a specific user of the client Alternatively, the server gives the right to change the parameter value, and stores the ID of the user who has been given the right to change and the public encryption key provided by the user, and then sends the electronic form template to the client in response to a request from the client. The client side refers to the security tag code of the electronic form template, updates the access control parameter value or the set of parameter values with the specific security tag code, and uses the secret key of the updater. Specific tagged actions Generates an electronic signature for a control parameter value or a set of parameter values, adds the generated electronic signature to the electronic form template, sets a data access request for the electronic form template, and sends the electronic form template to the server. Then, the server decrypts the electronic signature of the electronic form template using the public encryption key provided by the client-side user who sent the electronic form template, thereby updating the access control parameter with the specific tag. An updater on the client side is identified on the server side, and a falsification check is omitted for the value of the access control parameter tagged with the specific security tag.

Further, in an electronic form processing system having a server and a client, an electronic form storing an association between input / output items in an electronic form and a record of a business database storing data displayed or inputted in the input / output items. An electronic form processing method for reading or updating a record in a business database corresponding to an input / output item of the electronic form in connection with data displayed or input to the input / output item of the electronic form according to the form template, The server adds tag information for identifying a set of each input / output item of the electronic form defined in the electronic form template to the electronic form template, and stores a business database corresponding to the input / output item to the electronic form. Tagged access control parameters that control reading and updating of data records Reference to other information, the update authority,
According to the security policy, it is classified into one or more access control levels, and an attribute indicating the access control level is
A security tag code is defined in the electronic form template, and a digital signature is added to the electronic form template on the server side for a specific tagged electronic form input / output data or access control parameter using the security tag code. Then, after granting a specific user of the client with the right to change the electronic tag input / output data or access control parameters with a specific tag, the electronic template is sent to the client in response to a request from the client, and the client On the side,
By referring to the security tag code, the access control parameter with a specific tag is updated or the content of the electronic form input / output data is updated, the electronic signature of the updater is added to the electronic form template, and the updater's electronic signature is added. Signature and
Based on the electronic form template input / output data or the electronic signature for the access control parameter of the electronic form template performed on the server side, check whether the contents of the specific tagged electronic form definition data have been tampered with,
Before sending the electronic form template to the server, the client can identify the updater.

The access control parameters include a server definition parameter that cannot be changed by the client-side user and a user that can be freely changed by the client-side user who has been given change authority from the server. It has defined parameters.

[0011]

Embodiments of the present invention will be described below in detail with reference to the drawings. FIG. 1 is a processing flowchart showing an embodiment of the present invention. FIG. 2 is an overall configuration diagram of an electronic form processing system including a device configuration for implementing the present embodiment. FIG. 3 is a module configuration of a server device for implementing the present embodiment. FIG. 4 shows a module of the client device for implementing the present embodiment.

First, an overall configuration diagram of the electronic form processing system shown in FIG. 2 will be described.

The electronic form processing system according to the present embodiment is a system in which a server 11 for managing electronic form processing and a client 12 for inputting electronic forms are connected by a communication network 13. The device configuration of the server 11 is as follows.
3. The communication cable 114 is connected. The configuration of the client 12 is such that the input device 1
21, a display device 123, a storage device 124, and a communication cable 125 are connected.

FIG. 3 shows a module configuration of the server 11. The computer 111 includes a communication mechanism 21, a processing mechanism 22, an analysis mechanism 23, and a database management mechanism 24. Note that illustration of an input device, an output device (display device), and the like attached to the server is omitted in the drawings. The communication mechanism 21
This is for communicating with the client 12. The analysis mechanism 23 analyzes a form template describing a processing procedure of an electronic form. The processing mechanism 22 executes processing on the form template analyzed by the analysis mechanism 23. The database processing mechanism 24 reads and updates data in the business database 113 based on a form template processed by the processing mechanism 22. The storage device 112 stores a form template, stores an encryption / decryption library used in form processing, and stores a hash value of an access control parameter.

FIG. 4 shows a module configuration of the client 12. The computer 122 includes the communication mechanism 31 and the processing mechanism 3
2. It is composed of an analysis mechanism 33. The communication mechanism 31
It is for communicating with the electronic form processing server 11. The analysis mechanism 33 analyzes a form template describing a processing procedure of an electronic form. Processing mechanism 32
Executes processing on the form template analyzed by the analysis mechanism 33. The storage device 124 stores and displays the encryption / decryption library used in the form processing and the display mechanism 12.
GUI (Graphica) for displaying the form input screen in
l User Interface) Saves the library.

FIG. 5 is a configuration diagram of the form template 41. First, the configuration diagram of the form template 41 shown in FIG. 5 will be described. The form template 41 is described by tagged character data. The first line <form template> is a start tag of the form template, which indicates the start of information of the form template 41. The </ form template> on the 18th line, which is the last line, is an end tag of the form template, and indicates the end of the information of the form template 41. That is, the second to seventeenth lines between the start tag and the end tag of the form template are the values of the form template tag, and are the contents of the form template 41. The form template 41 includes a data area 411, access control parameters 412, and document protection information 413.

The data area 411 is an area for storing the input contents of the user for each input item of the form. In the example of FIG. 5, a data area start tag <data area> on the second line and a data area end tag </ data area> on the sixth line are sandwiched.
The third to fifth lines are the contents of the data area. In the data area 411, a tag corresponding to each input item in the form is allocated, and data input by the user is stored as a value of the corresponding tag. In FIG. 5, the input items of this form are
There are no tags, because there are no product name, quantity, and delivery destination, and the user has not yet entered anything. For example, if the user inputs a product name as display, the third line is <product name> display < / Product name>.

The access control parameters 412 are composed of server-defined parameters 414 and user-defined parameters 415. The access control parameter 412 is a parameter that controls the association between the input item of the data area 411 and the data record of the business database 113, and the reading and updating of the data record of the business database 113 corresponding to the input item data of the data area 411. It describes information (access control information). The server definition parameter 414 includes the access control parameter 412
Of the access control parameters defined by the electronic form processing server 11 and the electronic form processing client 1
The second user defines an access control parameter that cannot be changed. The user-defined parameter 415 defines, out of the access control parameters defined by the access control parameter 412, an access control parameter that can be freely changed by the user of the electronic form processing client 12 to which the server has been given change authority. .

The document protection information 413 includes access parameter protection information 416 and data protection information 417. The document protection information 413 includes the access control parameter 4
12 and the data area 411 to prevent unauthorized tampering.
It stores the signature of the definer or modifier of this.

Access control parameter protection information 416
Saves the signature of the definer or modifier of the access control parameter 412 in order to prevent unauthorized tampering of the access control parameter 412. The access control parameter protection information 416 contains the server definition parameter protection information 4
18. User-defined parameter protection information 419. The server definition parameter protection information 418 stores the signature of the form processing server so that the server definition parameter 414 is not falsified by the user of the form processing client 12. When the user-defined parameter 415 is changed by the user of the form processing client 12, the user-defined parameter protection information 419 stores the signature of the user who made the change in order to identify the user who made the change. Data protection information 417
When the data area 411 is changed by the user of the form processing client 12, the input item changed by the same user and the user's signature for the content are stored.

FIG. 6 shows the access control parameters 412 of the document template 41 created according to the present embodiment. FIG. 7 shows the document protection information 413 of the document template 41 created according to the present embodiment. FIG. 8 shows the access control parameters 412 created according to the present embodiment.
3 is a table configuration diagram. Access control parameters 41
Reference numeral 2 denotes a data type 512 indicating an input data type, an input DB 513 for specifying a database in which information of data valid at the time of input is stored, and information of data valid at the time of input, for each input item name 511. An input record 514 that specifies a record of the database being used, an output DB 515 that specifies a database name of the business database 113 that stores data input by the user, and a record of the business database that stores data information of data input by the user. It consists of an output record 516.

Next, referring to FIG. 2, FIG. 3, FIG. 4, FIG. 5, FIG. 6, FIG. 7, and FIG. Step 110
First, the processing mechanism 2 of the computer 111 of the server 11
In step 2, a new form template 41 is created. The reference and update authority for the access control parameter 412 shown in FIG. 8 is classified into one or more access control levels according to the security policy, and the user of the client 12 corresponding to one of the access control levels is designated by the user. Information that cannot be changed is stored in the server definition parameter 414,
Information that can be changed by the user of the client corresponding to another one of the access control levels is defined in the user-defined parameter 415. The access control parameter 41 of FIG.
In line 2, server definition parameters for the product name are defined in the third to fourth lines, server definition parameters for the quantity are defined in the fifth line, and server definition parameters for the delivery destination are defined in the sixth line. The tenth line defines a user-defined parameter for a product name, the eleventh line defines a user-defined parameter for a quantity, and the fourteenth line defines a user-defined parameter for a delivery destination. In the user-defined parameters 415, new tags such as product input and delivery destination input are added to categorize each input item. That is, in the category of product input, two input items of a product name and a quantity are defined, and Hanako Yamada is defined as an attribute of a product input tag as a person in charge of inputting the two input items. Similarly, an input item called a delivery destination is defined in a category called a delivery destination input.

In step 1102, a security tag code is added to the user-defined parameter 415, an authorized person for modifying the user-defined parameter 415 is defined, and added as an attribute of the user-defined parameter tag. In FIG. 6, the security tag code is “Change charge =“ Ichiro Sato ”” described in the eighth line.

In step 1103, in the access control parameter 412, the server definition parameter 414
And a hash value is calculated for each of the user-defined parameters 415 and stored in the storage device 112. Further, an electronic signature is created for each of the hash values, and each of the hash values is stored in the server-defined protection information 418 and the user-defined protection information 41.
9 is added. Specifically, the processing mechanism 22 calculates and calculates a hash value for the server definition parameter 414 using a one-way function, and stores the value in the storage device 112. Further, the hash value is encrypted with the secret key of the server 11 stored in the storage device 112 to create a signature. This is added to the server definition protection information 418.
Similarly, in the processing mechanism 22, the user-defined parameter 415
, A hash value is calculated using a one-way function, and the value is stored in the storage device 112. The server 11 stored in the storage device 112 for the hash value
Creates an electronic signature by encrypting with the private key. This is added to the user-defined protection information 419. One or more form templates are created in advance by the processing of steps 1101 to 1103 and stored in the storage device 112 in advance.

In steps 1201 and 1104, the user of the client 12 transmits search conditions for searching the form template input from the input device 121 in the server to the communication mechanism 21 of the server 11 through the communication mechanism 31. The processing mechanism 22 of the server 11
Based on the search condition of the form template sent from the client 12, the form template is searched from the storage device 112, and the corresponding form template 41 is transmitted to the communication mechanism 31 of the client through the communication mechanism 21. The processing mechanism 32 of the client acquires the form template 41 received by the communication mechanism 31.

In step 1202, if there is a request from the user to change the user-defined parameter 415, the processing mechanism 32 of the computer 122 of the client 12
The user analyzes the form template 41 and compares the change right holder defined in the user-defined parameter 415 of the form template 41 with the user information about the user input from the input device 121 by the user. It is confirmed whether or not the user has the change right at 415, and if the user does not have the change right, the process goes to step 1204 without accepting the change. If the user has the change right, the change of the user-defined parameter 415 is accepted.
At this time, the processing mechanism 32 monitors whether the changed user-defined parameter 415 is inconsistent with the server-defined parameter 414 and whether it has been changed to access the server database. Discard changes.

FIG. 9 shows the access control parameters 412 changed according to the present embodiment. In the ninth line, the person in charge of the product input category is selected by Ichiro Sato, in the thirteenth line, the person in charge of the input destination category is selected by Taro Suzuki, and in the fourteenth line, the data type 512 of the destination is selected. The input record 514 has been changed to the delivery destination for the material. As described above, the database on the server 11 cannot be specified as the data reference destination, but the client 1
The second local database can be specified in a user-defined parameter 415.

In step 1203, the processing mechanism 32
A hash value is calculated for the updated user-defined parameter 415 by a one-way function, and the calculated value is stored in the storage device 1.
Then, an electronic signature is created by encrypting with the private key of the person who changed the user-defined parameter 415 stored in the storage 24. This is written in the user-defined protection information 419.

In step 1204, if there is a request for data input (update) from the user, the processing mechanism 32 analyzes the form template 41 through the analysis mechanism 33 and defines it in the user-defined parameter 415 of the form template 41. The user in charge is compared with the user information on the user input from the input device 121 by the input person, and it is confirmed whether the user has the input right (update right) to the data area 411, and the user does not have the input right. In this case, the process goes to Step 1206 without accepting the change. If the user has the input right, the analyzing mechanism 33 analyzes the data type of each input item defined in the form template 41 and the processing mechanism 32
Stores an input form corresponding to each input item in the storage device 1.
24, the input screen is acquired from the GUI library of the input screen, and the input screen is created and displayed on the display device 123.
The input to the data area 411 having the input right is accepted.

FIG. 10 shows an input screen 61 created on the display device 123 according to the present embodiment.
Looking at the latest access control parameters 412 in FIG.
The data type of the product name is selected from the third line, and the data type of the quantity is a numeric value from the fifth line.
2. A numerical form 63 is created on the screen. Regarding the delivery destination, since the current user is not given the input authority from the 13th line, an input form is not created so that the input cannot be made. Based on the input screen created in this way, the user performs an input for the input item to which the input authority is given, and the processing mechanism 32 passes the user's input data through the analysis mechanism 33 to the form template 41. The value is stored as the value of the corresponding tag in the data area 411. At this time, the processing mechanism 32 compares the access control parameter 412 with the input data of the user through the analysis mechanism 33 to determine whether the user has made an invalid input, and does not accept the invalid input of the user. . In the present embodiment, it is described that an input right can be set for a user-defined parameter, but a reference right can be set in addition to the input right. In this case, data without reference right is not displayed on the screen.

When the user finishes the input and presses the registration button 65, the input is terminated and the process proceeds to step 1205.
Further, the third line of the access control parameter in FIG. 9 defines that the product name is selected from the record of the product name in the catalog database. Assuming that the catalog database is located on the server, the client 12 needs to request the server 11 to access the database. As described above, even when the update with the server is required during the processing, the input processing is stopped and the process proceeds to step 1205.

In step 1205, the processing unit 32 calculates a hash value for the form input data updated by the user using a one-way function, and changes the input value in the data area 411 stored in the storage unit 124 for the calculated hash value. Creates an electronic signature by encrypting with the private key of the person. This is written in the data protection information 417.

In step 1206, the processing mechanism 32 uses the public key of the server 11 stored in the storage device 124
The electronic signature of the server definition parameter 414 defined in the server definition protection information 418 is decrypted and compared with the calculated hash value of the server definition parameter 414,
Check whether the server definition parameters have been tampered with.

Next, the processing mechanism 32 uses the public key of the change right holder of the user-defined parameter 415 stored in the storage device 124 to copy the electronic signature of the user-defined parameter 415 defined in the user-defined protection information 419. The decryption is performed, and the hash value of the user-defined parameter 415 is compared with the calculated hash value to check whether the user-defined parameter is falsified. Further, the processing mechanism 32 is configured to
3, it is confirmed whether the data in the data area 411 is valid as compared with the parameters defined in the access control parameters 412. Server definition parameter 414
If all the non-tampering properties of the user, the non-tampering property of the user-defined parameter 415, and the validity of the data area 411 are confirmed, the process proceeds to step 1207. The public key and the secret key in the above description are the same as the public key and the secret key which are already publicly known, and therefore, the description of the public key and the secret key will be omitted.

In steps 1207 and 1105, the processing mechanism 32 transmits the form template 41 to the server 11 through the communication mechanism 31, and the processing mechanism 22 of the server 11 acquires the form template through the communication mechanism 21.

In step 1106, the processing mechanism 22 uses the public key of the server 11 stored in the storage device 112,
The electronic signature of the server definition parameter 414 defined in the server definition protection information 418 is decrypted, and step 11
In step 02, the hash value is compared with the hash value stored in the storage device 112 to check whether the server definition parameter has been falsified. Next, the processing mechanism 22 decrypts the electronic signature of the user-defined parameter 415 defined in the user-defined protection information 419 with the public key of the change right holder of the user-defined parameter 415 stored in the storage device 112,
The hash value of the user-defined parameter 415 is compared with the calculated hash value to check whether the user-defined parameter has been tampered. Further, the processing mechanism 22 checks through the analysis mechanism 23 whether the data in the data area 411 is valid as compared with the parameters defined in the access control parameters 412. Non-tampering property of the server-defined parameter 414, non-tampering property of the user-defined parameter 415,
If all the validity of the data area 411 is confirmed, the process proceeds to step 1107. Steps 1206 and 1106 perform the same processing, so that either one of them can be omitted.

In step 1107, the processing mechanism 22 sends the electronic signature of the data area 411 defined in the document protection information 417 to each input person defined by the user-defined parameter 415 stored in the storage device 112. Is decrypted with the public key of the data area 411, and the hash value of the input data in the data area 411 is compared with the calculated value.
It is confirmed whether or not 11 has been input by the input operator defined by the access control parameter 412.

In step 1108, the processing mechanism 22 updates the contents of the business database 113 based on the updated contents of the data area 411 using the access control parameter 412 through the database management mechanism 24, and updates the data from the business database 113. Is read. The process of reading data from the business database 113 includes, for example,
In step 1204, in response to a request from the client 12 to read a choice of a product name from a product name record in the catalog database, data is read from the corresponding database.

In steps 1109 and 1208, the processing result in step 1108 is transmitted to the client 12 through the communication mechanism 21, and the processing mechanism 32 receives the processing result through the communication mechanism 31.

In step 1209, step 1203
If the registration button 55 has been pressed, the processing is terminated. Otherwise, that is, communication with the server is required during the processing of step 1204, and if the result of the communication with the server is received, the process returns to step 1204.
When the result of communication with the server is received, for example, when data obtained by reading the option of the product name in step 1204 from the business database of the server 11 is received, the processing mechanism 32 displays based on the received data. The device 123 displays the option of the product name. This screen display is shown in FIG. According to the server definition parameter 414,
If the options of the product name read from the product name in the catalog database are a notebook computer, an air conditioner, and a microwave oven, the screen display is as shown in 67.

[0041]

As described above, according to the present invention, the access control parameters for controlling the reading and updating of the input data of the form and the records of the business database are changed on the server side and on the client side. By dividing the parameters into possible parameters and adding a signature to each, it is possible to prevent the access control parameters from being tampered with illegally and accessing the database. Further, since the parameters can be changed on the client side, more flexible electronic form processing can be performed.

[Brief description of the drawings]

FIG. 1 is a flowchart showing a processing procedure of an embodiment of an electronic form processing method according to the present invention.

FIG. 2 is a diagram showing an overall configuration of an electronic form processing system to which the present invention is applied.

FIG. 3 is a diagram showing a module configuration of a server.

FIG. 4 is a diagram showing a module configuration of a client.

FIG. 5 is a diagram showing a configuration of an electronic form template.

FIG. 6 is a diagram showing a configuration of an access control parameter.

FIG. 7 is a diagram showing a configuration of document protection information.

FIG. 8 is a table configuration diagram of access control parameters.

FIG. 9 is a diagram illustrating a configuration of an access control parameter after a user of a client changes a user-defined parameter.

FIG. 10 is a diagram showing an initial form input screen.

FIG. 11 is a diagram showing a form input screen after reading options of input items from a server.

[Explanation of symbols]

 11 server 12 client 13 communication network 111, 122 computer 112, 124 storage device 113 business database 121 input device 123 display device

Continuation of the front page (51) Int.Cl. ⁷ Identification symbol FI Theme coat II (reference) G06F 17/30 G06F 15/40 310F 320B 370Z 15/401 340A (72) Inventor Katsuya Yokomura 1099 Ozenji, Aso-ku, Kawasaki-shi, Kanagawa Prefecture Address F-term in Hitachi, Ltd. System Development Laboratory (Reference) JB22 KA07 KA10 KA17 KB10 KC58 KH30

Claims (5)

[Claims] In an electronic form processing system having a server and a client, an electronic form storing an association between an input / output item in an electronic form and a record of a business database storing data displayed or input in the input / output item. An electronic form processing method for reading or updating a record of a business database corresponding to an input / output item of an electronic form in connection with data displayed or input to the input / output item of the electronic form according to a form template, The parameter information (access control parameter information) for controlling the reading and updating of the data record of the business database corresponding to the input / output item to / from the electronic form is stored in the electronic form template, and the access control parameter information is referenced and updated. Authority can be assigned to one or more Access control parameter, and an identification code indicating the access control level is added to the access control parameter as a tag code (security tag code), and the access control parameter value to which the specific security tag code is added Alternatively, an electronic form processing method characterized by generating a hash value using a one-way hash function for a set of parameter values. 2. The electronic form processing method according to claim 1, wherein the server stores the generated hash value, and then sends the electronic form template to the client in response to a request from the client. A data input request or a data display request (also referred to as a data access request) for the input / output items of the electronic form template is recorded in the electronic form template based on the electronic form template, and the electronic form template is transmitted to the server. The server generates an access control parameter value or a hash value of a set of parameter values to which the specific security tag code stored in the received electronic form template is added, and the electronic form template stored in the server in advance. Of the electronic form After confirming that the access control parameter value to which the specific security tag code is added or the content of the parameter value stored in the template has not been tampered with, based on the access request stored in the electronic form template, An electronic form processing method characterized by reading or updating a data record of a business database corresponding to an input / output item to a form. 3. An electronic form processing system having a server and a client, wherein an electronic form storing an association between an input / output item in an electronic form and a record in a business database storing data displayed or input in the input / output item. An electronic form processing method for reading or updating a record of a business database corresponding to an input / output item of an electronic form in connection with data displayed or input to the input / output item of the electronic form according to a form template, The parameter information (access control parameter information) for controlling the reading and updating of the data record of the business database corresponding to the input / output item to / from the electronic form is stored in the electronic form template, and the access control parameter information is referenced and updated. Authority can be assigned to one or more Control level (access control level), an identification code indicating the access control level is added to the access control parameter as a tag code (security tag code), and a specific security tag code is provided to a specific user of the client. The server grants the added access control parameter value or the authority to change the parameter value, and stores the ID of the user to whom the authority has been granted and the public encryption key provided by the user. The client side refers to the security tag code of the relevant electronic form template, updates the access control parameter value or a set of parameter values with a specific security tag code, and updates the client. Private key possessed by the person Generating an electronic signature for a particular tagged access control parameter value or set of parameter values using
Attach the generated electronic signature to the electronic form template, further set a data access request for the electronic form template and send the electronic form template to the server, and the server sends the electronic form template to the client-side user. By decrypting the electronic signature of the electronic form template using the public encryption key provided by the server, the server side identifies the updater on the client side regarding the update of the access control parameter with the specific tag, and the specific security An electronic form processing method characterized in that a tampering check is omitted for the value of a tagged access control parameter. 4. In an electronic form processing system having a server and a client, an electronic form storing an association between input / output items in an electronic form and a record of a business database storing data displayed or input in the input / output items. An electronic form processing method for reading or updating a record of a business database corresponding to an input / output item of an electronic form in connection with data displayed or input to the input / output item of the electronic form according to a form template, The server adds tag information for identifying a set of input / output items of the electronic form defined in the electronic form template to the electronic form template, and a business database corresponding to the input / output items to the electronic form. Access control parameters with tags to control the reading and updating of Reference to information, update authority, according to the security policy, classified into one or more access control levels, the attribute indicating the access control level is defined as a security tag code in the electronic form template, using the security tag code The server adds an electronic signature to the electronic form template with respect to a specific tagged electronic form input / output data or access control parameter, so that a specific tagged electronic form input / output data or access control parameter is added. After granting the change authority to the specific user of the client, the electronic form template is sent to the client at the request of the client side, and the client side refers to the security tag code, and the specific tagged access is performed. Update of control parameters To update the contents of the electronic document input and output data,
An electronic signature of an updater is added to an electronic form template, and based on the electronic signature of the updater and an electronic signature for a specific tagged electronic form input / output data or an access control parameter of the electronic form template performed on the server side. Electronic form processing characterized in that the contents of the specific electronic form definition data with a tag have been tampered with, and that the updater can be identified on the client side before sending the electronic form template to the server. Method. 5. The electronic form processing method according to claim 1, wherein the access control parameter is a server definition parameter which cannot be changed by a user on the client side, and An electronic form processing method characterized by having a user-defined parameter that can be freely changed by the client-side user who has been given a change right from the client.