JP6707499B2 - Information processing apparatus, information processing system, program, recording medium, and information processing method - Google Patents

Description

The present invention relates to an information processing device, an information processing system, a program, a recording medium, and an information processing method for giving control information to a folder.

It has been conventionally known to add encryption to electronic files and folders in order to ensure security. However, when encryption is given to an electronic file or folder, browsing of the electronic file or folder is simply restricted.

In Patent Document 1, paying attention to sending by electronic mail, by copying an electronic file to be sent to a shared folder, an electronic mail having the electronic file as an attached file is sent to a mail destination set in the folder. Is proposed. However, Patent Document 1 only proposes to encrypt an electronic file or the like and prevent erroneous transmission.

JP 2012-133427 A

INDUSTRIAL APPLICABILITY The present invention controls a folder or information in the folder, and is different from an information processing apparatus, an information processing system, and a program, which are different from those that have been conventionally proposed only to restrict browsing by encrypting a folder A recording medium and an information processing method are provided.

The information processing apparatus according to the present invention is
A target identification part that identifies a folder,
A control information addition unit that adds control information for controlling the operation of the folder, or the operation of an electronic file or a subordinate folder in the folder;
A user selection unit that selects user information related to a user to whom control based on the control information is applied;
May be provided.

In the information processing device according to the present invention,
The control information may include information that controls the electronic file or the subordinate folder in the folder so that the electronic file cannot be extracted from the folder.

In the information processing device according to the present invention,
The control information may include information controlled such that a new electronic file or a lower folder cannot be created in the folder, or a new electronic file or a lower folder cannot be added.

In the information processing device according to the present invention,
The control information may include information that the electronic file or the subordinate folder in the folder is controlled so that its name cannot be changed.

In the information processing device according to the present invention,
The control information may include information controlled such that the electronic file or the subordinate folder in the folder cannot be deleted, or the electronic file or the subordinate folder in the folder cannot be copied.

In the information processing device according to the present invention,
The control information may include information for controlling to transfer the management authority for the folder, the electronic file in the folder, or the subordinate folder to a person who receives the folder.

In the information processing device according to the present invention,
The control information may include information for controlling to display the electronic file or the subordinate folder in the folder only on the display unit associated with the user information selected by the user selection unit.

In the information processing device according to the present invention,
The control information assigning unit may individually assign control information to the electronic file or the subordinate folder in the folder.

In the information processing device according to the present invention,
The control information giving unit may give control information to an electronic file or the subordinate folder taken out from the folder.

In the information processing device according to the present invention,
The control information addition unit may add new control information to the electronic file or the subordinate folder extracted from the folder.

The information processing apparatus according to the present invention is
An encryption unit that creates an encryption key that encrypts the folder, the electronic file in the folder, or the lower folder;
A decryption unit that creates a decryption key for decrypting the folder, the electronic file in the folder, or the subordinate folder encrypted by the encryption key;
Further equipped with,
The electronic file contained in the folder is encrypted with a common encryption key,
The electronic file encrypted by the encryption key contained in the folder may be decrypted by a common decryption key.

In the information processing device according to the present invention,
When the executable file is included in the folder or when the electronic file in the folder includes macro information, the control information addition unit is configured to execute the executable file or the electronic file including the macro information. It may be possible to select whether or not to add the control information.

In the information processing device according to the present invention,
The folder may be an archived folder.

The information processing system according to the present invention is
The information processing device described above,
A central processing unit capable of communicating with the information processing apparatus;
Equipped with
The central processing unit may identify the user using the user identification information input from the information processing apparatus.

The program according to the present invention is
A program installed on an information processing device,
The information processing device installed with the program
To identify the folder,
Adding control information for controlling the operation of the folder, or the operation of an electronic file or a subordinate folder in the folder,
Selecting user information about a user to whom control based on said control information is applied;
May be executable.

The recording medium according to the present invention is
A recording medium recording a program to be installed in an information processing device,
The information processing device installed with the program
To identify the folder,
Adding control information for controlling the operation of the folder, or the operation of an electronic file or a subordinate folder in the folder,
Selecting user information about a user to whom control based on said control information is applied;
May be executable.

The information processing method according to the present invention is
An information processing method executed by an information processing device, comprising:
To identify the folder,
Adding control information for controlling the operation of the folder, or the operation of an electronic file or a subordinate folder in the folder,
Selecting user information about a user to whom control based on said control information is applied;
May be provided.

In the present invention, in the case of adopting a mode in which the control information for controlling the operation of the target folder or the operation of the electronic file or the subordinate folder in the folder and the user information corresponding to the control information are added, Control information can be collectively attached to each user for operations on folders and operations on information such as electronic files and subordinate folders contained in the folders.

The block diagram of the information processing system by the 1st Embodiment of this invention. The figure which showed the control object folder which can be used in the 1st Embodiment of this invention, the electronic file in a control object folder, and a subordinate folder. The figure which showed the folder for encryption which can be used by the 1st Embodiment of this invention, the control target folder, the electronic file in a control target folder, and a subordinate folder. The figure which showed an example of the flow of the information by the information processing apparatus by the 1st Embodiment of this invention. The figure which showed an example of the control information used by the 1st Embodiment of this invention. The figure which showed an example of the flow of the information by the information processing apparatus by the 3rd Embodiment of this invention. The block diagram of the information processing system by the 4th Embodiment of this invention.

First embodiment <<configuration>>
Embodiments of an information processing device, an information processing system, a program, a recording medium, and an information processing method according to the present invention will be described below with reference to the drawings. In this embodiment, “or” and “or” also include the meanings of “and” and “and”. That is, for example, “A or B” in the present embodiment means any of “A, B and A and B”.

The information processing apparatus according to the present embodiment is generated by installing a program such as a user program. This program may be delivered by electronic mail, may be obtained by logging in after accessing a predetermined URL, or may be recorded in a recording medium. The program according to the present embodiment is used to generate the information processing device described below, and the recording medium according to the present embodiment is used to record the program. Further, the information processing method of the present embodiment is implemented by an information processing device in which the above program is installed. The information processing device may execute the information processing method of the present embodiment by executing an application installed in the information processing device.

The information processing device according to the present embodiment may be configured by one device, but may be configured by a plurality of devices. When the information processing device is composed of a plurality of devices, the devices forming the information processing device may be installed in different rooms or different places, and a part of the information processing device and the rest of the information processing device are located in a remote area. May be located at. In the present embodiment, the words "information processing device" and "information processing system" will be used for description, but when the information is surely divided into two or more devices, the word "information processing system" will be used and The term "information processing apparatus" is used when the information processing apparatus is configured by the above-mentioned apparatus or is configured by a plurality of apparatuses.

The information processing device is, for example, a user terminal 100 such as a personal computer, and in the present embodiment, an example in which the information processing device is the user terminal 100 will be described below.

As shown in FIG. 1, the user terminal 100 receives an input from a target identification unit 20 for identifying a folder and an operation unit 90 such as a personal computer and operates the folder, or an electronic file 510 or a subordinate folder 520 in the folder. (In the present embodiment, a folder in a control target folder 500, which will be described later, is also referred to as a “subordinate folder 520”.) A control information adding unit 10 that adds control information for controlling an operation, and control based on the control information. And a user selection unit 30 for selecting user information such as an electronic mail address and an ID of a user terminal regarding a user to which the above applies.

The target identifying unit 20 is used to identify a folder, an electronic file, or the like to which the control information is added by the control information adding unit 10. The user selection unit 30 is used to select user information regarding a user used in the control information of the control information addition unit 10. The user selection by the user selection unit 30 may be associated with the content of the control information, and the user selection unit 30 selects the first user information to which the first control information is applied and the second control information is applied. The second user information may be selected, and the nth user information (“n” is an integer of 3 or more) to which the nth control information is applied may be selected. As an example, the first control information is applied to the employee of the department to which the user who created the control target folder 500 belongs, and the second control information, which is more restrictive than the first control information, of the user who created the control target folder 500. An employee of the company to which the user who created the control target folder 500 is the employee of the company to which the third control information, which is applied to employees other than the department to which the user belongs and which is more restrictive than the second control information, is created. It may be applied to persons other than. Examples of the first control information include control information that enables browsing, editing, and printing of the electronic file 510 and the like in the control target folder 500, and examples of the second control information include, for example, control information in the control target folder 500. The control information that allows only browsing of the electronic file 510 or the like can be cited, and the third control information can include control information such that the electronic file 510 or the like in the control target folder 500 cannot be browsed. ..

FIG. 5 also shows a mode in which the second control information is more restrictive than the first control information, and the third control information is more restrictive than the second control information. However, FIG. 5 shows a mode in which the first control information, the second control information, and the third control information having contents different from the above-described mode are set. In FIG. 5, “***” means that arbitrary information is included, and “not” means that information that follows is excluded. That is, although the second user information in FIG. 5 includes the email address "@example.com", the email addresses "abc@example.com", "bcd@example.com" and "cde@example.com" are included. Means that those having a mail address of "@example.com" are excluded from the third user information.

The contents of the first control information, the second control information,..., The nth control information, etc. are set in advance, and the applied control information may be appropriately changed by the user selecting a category. Good. For example, when the category “editor” is set as the second control information, the creating user (the user who creates the control target folder 500 is also referred to as “creating user” below) is the receiving user (control target). A user who receives the folder 500 is hereinafter also referred to as a “recipient user”.) By selecting “editor”, the recipient user can edit, copy, print, etc. the electronic file 510 in the control target folder 500. Will be allowed. In addition, when the category “viewer” is set as the nth control information, the creating user selects “viewer” for the receiving user, and the receiving user receives the electronic contents in the control target folder 500. Only the file 510 and the subordinate folder 520 are allowed to be browsed.

The target identification unit 20, the control information addition unit 10, and the user selection unit 30 may be included in the control unit 50 of the user terminal 100 (see FIG. 1).

As illustrated in FIG. 1, the user terminal 100 may include a device storage unit 60 that stores various types of information, and a device display unit 80 that displays information and the like stored in the device storage unit 60.

In the following, a description will be given focusing on an aspect in which control information is added to a folder such as encryption for a folder, but the user terminal 100 according to the present embodiment can perform similar processing for electronic files that are not included in the folder. it can. That is, the target identifying unit 20 can identify electronic files that are not included in the folder, and the control information addition unit 10 can add control information to electronic files that are not included in the folder.

One or more electronic files 510 in a folder to which control information is added by the control information adding unit 10 (hereinafter also referred to as “control target folder 500”) or one or more lower folders in the control target folder 500. Various restrictions may be given to 520 (see FIG. 2) by giving control information. For example, the electronic file 510 in the controlled folder 500 or the subordinate folder 520 in the controlled folder 500 may be controlled so that it cannot be taken out from the controlled folder 500. The electronic file 510 in the controlled folder 500 or the subordinate folder 520 in the controlled folder 500 may be controlled so that its name cannot be changed. The electronic file 510 in the control target folder 500 or the subordinate folder 520 in the control target folder 500 may be controlled so as not to be deleted.

The control information adding unit 10 may be able to perform control by adding control information to a folder (lower folder 520) that is already protected by a password or the like.

Further, the control information adding unit 10 may add the control information so that the control target folder 500 itself can be controlled. For example, a new electronic file 510 or a subordinate folder 520 may not be created in the controlled folder 500. Further, it may be controlled so that a new electronic file 510 or a lower folder 520 cannot be added to the control target folder 500. The electronic file 510 or the subordinate folder 520 in the controlled folder 500 may be controlled so that they cannot be moved (positional change). The concept of “addition” in the present embodiment includes adding an existing electronic file 510 or folder (lower folder 520) to the control target folder 500.

The control of the electronic file 510 or the subordinate folder 520 in the control target folder 500 or the control of the control target folder 500 itself may be performed by opening the folder to be controlled by the control application 590. In this way, when the folder to be controlled by the control application 590 is opened, the folder to be controlled may be dragged and dropped onto the icon of the control application 590 such as the encryption application (see FIG. 2). When a folder to be controlled by the control application 590 is opened, the control content to be applied to the folder and the receiving user (including the group) to which the control content is applied asks the creating user via the device display unit 80. Will be seen. The creating user adds the selected control information to the folder by selecting the control content to be performed on the folder and the user to whom the control content is applied (see FIG. 5). ). In addition, as described later, when it is desired to individually add control information to the electronic file 510 or the lower folder 520 in the folder, the individual electronic file 510 or the lower folder 520 is selected and the selected individual file is selected. The control information may be added by selecting the control content to be performed on the electronic file 510 or the subordinate folder 520 and the receiving user to which the control content is applied.

As shown in FIG. 1, the user terminal 100 uses the encryption unit 40 that creates an encryption key that encrypts the control target folder 500 or the electronic file 510 or the subordinate folder 520 in the control target folder 500, and the encryption key. It may have a decryption unit 45 that creates a decryption key for decrypting the encrypted control target folder 500 or the electronic file 510 or the subordinate folder 520 in the control target folder 500.

The information including the control information and the user information corresponding to the control information is the authority information (see FIG. 4), and this authority information is transmitted to the central processing unit 200 described later together with the decryption key.

The control information may be added to the folder not only by dragging and dropping it on the icon of the control application 590 such as the encryption application, but also by inserting the folder to which the control information is to be added in the encryption folder 550 ( (See FIG. 3). When the mode in which the encryption folder 550 is put in the shared folder is adopted, the creating user puts the folder in the encryption folder 550 so that the folder is encrypted by the encryption key. Will be. Then, each receiving user can decrypt the encrypted folder by receiving the decryption key from the central processing unit 200. Since control information is given to the decrypted folder, each user can browse the subordinate folder 520 and the electronic file 510 in the folder (control target folder 500) based on the control information. You will be able to edit it. When a plurality of folders are put in the encryption folder 550, the same encryption key and the decryption key corresponding to the encryption key may be created for each folder, or each folder may be created. Alternatively, a different encryption key and a decryption key corresponding to the encryption key may be created.

The electronic file 510 in the controlled folder 500 may be able to be browsed, changed, printed, etc. under the control of the control application 590. That is, the user terminal 100 in which the control application 590 is not installed may not be able to see the information in the control target folder 500, or may be unable to recognize the existence of the control target folder 500 itself. A viewer-only control application that cannot be edited as long as the information in the controlled folder 500 is only viewed may be used.

The control information adding unit 10 may add control information that can set a viewable time limit to information such as the electronic file 510 and the subordinate folder 520 in the control target folder 500, or limit the number of times the file can be viewed. Control information may be added.

When the unauthorized person (an unauthorized terminal) accesses the electronic file 510, the subordinate folder 520, and the like in the controlled folder 500, the control information adding unit 10 controls the controlled folder 500. Control information may be added to delete all of the information in the file or the accessed electronic file 510 or the subordinate folder 520.

The control information adding unit 10 may add the control information such that the electronic file 510, the subordinate folder 520, and the like in the control target folder 500 cannot be overwritten. The control information addition unit 10 may limit the number of times that the information in the control target folder 500 can be copied, or may add control information that cannot be copied. The concept of “copy” in the present embodiment includes copying the electronic file 510 itself and copying a part of the information in the electronic file 510.

The control information addition unit 10 may add control information for limiting the number of times capture or printing is possible or prohibiting capture or printing for information such as the electronic file 510 and the subordinate folder 520 in the control target folder 500. Good. The control information adding unit 10 may add control information such that the user name, the opening date and time, the printed user terminal 100 and the like are watermark-printed when printing. Further, when the electronic file 510 in the controlled folder 500 is displayed on the display unit such as the device display unit 80, the user name, the opening date and time, and the control information such that the printed user terminal 100 is displayed as a watermark are controlled. It may be provided by the information providing unit 10.

The operation history to the control target folder 500 and the operation history to the information of the electronic file 510, the subordinate folder 520 and the like in the control target folder 500 may be recorded by the device storage unit 60 or a central storage unit 260 described later, The results thus recorded may be output in any format such as LEEF format and CEF format. Various operation histories that can be recorded can be listed, for example, the operation content of the control target folder 500, browsing of the electronic file 510 or the lower folder 520, editing of the electronic file 510 or the lower folder 520, printing of the electronic file 510. The electronic file 510 can be newly created, the electronic file 510 can be copied or captured, and the like. Further, the operation history may include the date and time when the operation was performed, and may include the user who performed the operation. The operation history may be sorted by date and time or by user.

As shown in FIG. 1, a central processing unit 200 that can communicate with a number of information processing devices such as user terminals 100 may be provided. The central processing unit 200 may include a central storage unit 260 that records various information including an operation history in an information processing device such as each user terminal 100, and a central control unit 250 that controls the central processing unit 200. ..

The encryption key may be stored in the central storage unit 260 of the central processing unit 200 together with the control information and the user information corresponding to the control information (see FIG. 4). Further, the receiving user who has received the control target folder 500 accesses the central processing unit 200, and the user ID such as the user terminal information or the e-mail address is collated with the user information. The control target folder 500 may be decrypted by using the decryption key given to the terminal 100.

The central processing unit 200 may be composed of one device, but may be composed of a plurality of devices. When the central processing unit 200 is composed of a plurality of devices, the devices forming the central processing unit 200 may be installed in different rooms or different places, and a part of the central processing unit 200 and the central processing unit 200 may be installed. The balance may be located in a remote location.

All information in the controlled folder 500 may be managed by the central processing unit 200. When performing an operation in the controlled folder 500, the operation may be possible based on the information managed by the central processing unit 200.

When the operation in the control target folder 500 is performed based on the information managed by the central processing unit 200, the control target folder 500 can be remotely managed or operated. May be. For example, even when the control target folder 500 is sent to a third party by e-mail, the control of the control target folder 500 and the control of the electronic file 510 and the subordinate folder 520 in the control target folder 500 are performed by the central controller 200. You may be able to. As an example, after the creation user confirms by phone or the like that the control target folder 500 sent by e-mail has reached the legitimate target person (recipient user), the content of the control information is changed. The information in the control-target folder 500 may be browsed by changing the view-disabled to the viewable. Further, when the control target folder 500 reaches an unexpected third party, the control target folder 500 or information in the control target folder 500 may be deleted (remote deletion). Further, such remote deletion may be performed when a third party accesses the central processing unit 200. That is, even if a third party uses the folder ID of the control target folder 500 to access the central processing unit 200, the user information associated with the folder ID stored in the central storage unit 260 of the central processing unit 200 , The control target folder 500 in the user terminal 100 of a third party or the information in the control target folder 500 is deleted when the user ID of the user terminal that tried to access or the user ID such as the e-mail address does not match (remote It may be deleted) (see FIG. 4). The communication between the central processing unit 200 and the user terminal 100 may be performed via a server (not shown).

When operating the user terminal 100, it is not always necessary to be online, and it may be possible to operate in an offline state. Various operations such as selection/change of user information in the offline environment, selection/change of control information, and editing of the electronic file 510 are accepted by the central processing unit 200 when returning to the online state, and the central control unit 250 controls. It may be appropriately processed. In the mode in which the encryption unit 40 has the encryption key, it is possible to add the control information to the folder and encrypt with the encryption key even in the offline state. It is also possible to create a decryption key corresponding to. Further, when the user terminal 100 of the receiving user continues to hold the decryption key, the electronic file 510 and the like in the control target folder 500 can be decrypted and viewed even in the offline state. Note that whether or not such an off-line operation is possible may be added as control information. That is, it may be possible to browse and edit the electronic file 510 and the like in the control target folder 500 offline only by the user terminal 100 that is permitted to be used offline as control information for the control target folder 500.

The control information assigning unit 10 may be able to individually assign control information to the electronic file 510 or the subordinate folder 520 in the controlled folder 500. As the control information, any information as described in the specification of the present application may be settable. When the higher-level control information is added to the control target folder 500 and the lower-level control information is added to the electronic file 510 or the lower-level folder 520 in the control-target folder 500, the lower-level control information has priority over the higher-level control information. May be applied. Adopting such a mode is advantageous in that individual settings can be prioritized. However, conversely, the upper control information may be applied in preference to the lower control information. The selection of these priorities may be performed by input from the operation unit 90 or may be determined by default.

The control information addition unit 10 may display the electronic file 510 in the control target folder 500 only on the display unit such as the device display unit 80 associated with the user information selected by the user selection unit 30. When this mode is adopted, even if the same control target folder 500 is received, it is possible to control the displayed information to be different depending on the opened terminal or the like. It should be noted that it may be possible to set whether or not to display each piece of information such as the electronic file 510 and the subordinate folder 520 in the controlled folder 500.

The control information adding unit 10 may add the control information to the electronic file 510 or the subordinate folder 520 extracted from the control target folder 500. For example, when the receiving user who receives the control target folder 500 extracts the electronic file 510 or the subordinate folder 520 from the control target folder 500, the control information for the control target folder 500 is inherited by the electronic file 510 or the subordinate folder 520. May be done.

The control information addition unit 10 permits the control information input from the operation unit 90 to be input when the electronic file 510 or the subordinate folder 520 is taken out from the control target folder 500, and the control information input from the operation unit 90 is transferred to the control target folder 500. Control information may be added to the electronic file 510 retrieved from the inside. In this case, for example, when the receiving user who receives the control-target folder 500 extracts the electronic file 510 or the subordinate folder 520 from the control-target folder 500, the control information and the user to whom the control information is applied are newly set. You will be able to choose. The control information that can be selected at this time may be any mode, but may be limited to the processing that the receiving user can perform. For example, when the receiving user who has received the controlled folder 500 can only browse, print, and copy the information in the controlled folder 500, the receiving user can retrieve the electronic information from the controlled folder 500. The file 510 or the subordinate folder 520 may be provided with control information that enables one or more of browsing, printing, and copying, and the other control information may not be selected.

Common as an encryption key for encrypting information such as the electronic file 510 and the subordinate folder 520 in the control target folder 500 and a decryption key for decrypting the electronic file 510 and the subordinate folder 520 encrypted in this way. The encryption key and the decryption key may be used. There may be one common encryption key and one common decryption key.

When the control target folder 500 includes an executable file or when the electronic file 510 in the control target folder 500 includes macro information, the control information adding unit 10 changes the executable file or the electronic file 510 including macro information. Alternatively, it may be possible to select whether to add control information. In this case, the device display unit 80 of the user terminal 100 displays whether or not the control information is added to the executable file or the electronic file including the macro information included in the folder, and the operation unit 90 displays the control information. It may be selected whether to give control information to an executable file or an electronic file containing macro information contained in the folder. Examples of executable files include files with extensions such as ".exe", ".dll", and ".bin".

When the control target folder 500 includes an executable file or when the electronic file 510 in the control target folder 500 includes macro information, the control information addition unit 10 determines the executable file based on the information registered in advance. Alternatively, the electronic file 510 including macro information may be controlled. For example, the control information adding unit 10 may add, by default, control information such that an executable file or an electronic file including macro information cannot be opened. In addition, the control information addition unit 10 includes information regarding an executable file that can be opened or an electronic file including macro information (white information) or information regarding an executable file that cannot be opened or an electronic file including macro information (black information). Even if the control information is added to the electronic file 510 including the executable file in the control target folder 500 or the macro information in the control target folder 500 based on these information, Good. When these modes are adopted, even if the electronic file 510 including the executable file and the macro information is included in the control target folder 500, it is advantageous in that it can be controlled by the predetermined control content. ..

Further, the control information adding unit 10 does not control what kind of control the electronic file 510 including the executable file or the macro information that does not correspond to the information registered in advance, that is, does not correspond to the white information or the black information. The information may be given or the user (including the administrator) may be inquired. In this case, the control information may be added to the executable file or the electronic file 510 including the macro information in response to the input from the user including the administrator. The information thus input may be stored as white information or black information in the device storage unit 60 or the central storage unit 260, and may be used when creating the controlled folder 500 thereafter.

"Method"
In the information processing method according to the present embodiment, all aspects of the “configuration” described above can be used, but an example of the information processing method will be described below. Note that any configuration described in “method” can be used as the configuration of this embodiment.

The creator user opens a folder that he wants to control by a control application 590 such as an encryption application. At this time, the folder to be controlled may be dragged and dropped on the icon of the control application 590 (see FIG. 2). When the control application 590 opens the folder to be controlled in this way, the target folder is identified by the target identification unit 20. When the target identifying unit 20 identifies a folder in this way, the target identifying unit 20 creates a folder ID for the folder.

When the folder ID is given to the target folder, the control content desired to be applied to the folder and the user (including the group) to which the applied control content is applied are created users via the device display unit 80. Will be asked. When the control information composed of a plurality of categories is added, different users may be selected for each control information of different categories (see FIG. 5). It should be noted that the above-described first control information, second control information,..., Nth control information can be given as examples of the control information composed of a plurality of categories. As the control information to be given, all the control information described in “Configuration” can be mentioned.

When the control target folder 500 to which the control information is added is generated, the control target folder 500 is encrypted by the encryption key provided from the encryption unit 40. At this time, the electronic file 510 or the subordinate folder 520 in the control target folder 500 is also encrypted, but it is used when the control target folder 500, the electronic file 510 and the subordinate folder 520 in the control target folder 500 are encrypted. The encryption key is common. At this time, the decryption unit 45 creates a decryption key corresponding to the encryption key.

Next, the control information, the user information corresponding to the control information, the management information including the file ID and the decryption key are transmitted from the information processing apparatus such as the user terminal 100 to the central processing unit 200 (see FIG. 4). Then, the control information, the user information corresponding to the control information, the file ID, and the decryption key are stored in the central storage unit 260 of the central processing unit 200.

When the control target folder 500 to which the control information is added is generated, for example, the control target folder 500 is attached to an e-mail, and the e-mail is transmitted from the creating user to the receiving user (see FIG. 4). ). Note that the control target folder 500 may be delivered to the receiving user via USB, cloud, or the like in addition to electronic mail.

The receiving user who receives the e-mail opens the control target folder 500 by the control application 590. At this time, when the control target folder 500 is opened, the folder ID is read by the user terminal 100 of the receiving user, and the user terminal 100 of the receiving user accesses the central processing unit 200.

When the receiving user accesses the central processing unit 200, the user information associated with the folder ID is collated with the user ID such as the user terminal information or the email address, and if they match, the decryption is performed. The key is given to the user terminal 100 of the receiving user (see FIG. 4). Then, in the user terminal 100, the control target folder 500 is decrypted using the decryption key. The control target folder 500 and the electronic file 510 or the subordinate folder 520 in the control target folder 500 use the same decryption key.

The decrypted control target folder 500 is restricted based on the control information, and based on the control information corresponding to the receiving user, the receiving user controls the control target folder 500 and the electronic file 510 in the control target folder 500. Processing such as browsing and editing can be performed on the subordinate folder 520.

The control information can be freely changed by the creating user. For example, when the editing process by the receiving user who has been given the editing authority is completed, the control information is changed at the time when the editing of the electronic file 510 by the receiving user is completed. It is also possible to stop granting the editing authority to the receiving user and allow only the browsing.

《Action/effect》
Next, the actions and effects obtained by the above-described configuration or method, which have not been described, will be mainly described. It should be noted that any configuration described in “Operation/Effect” can be used as the configuration of the present embodiment.

When a mode in which control information for controlling the operation of the target folder or the operation of the electronic file 510 or the subordinate folder 520 in the folder and the user information corresponding to the control information is adopted is adopted, Regarding the operation and the operation on the information such as the electronic file 510 and the subordinate folder 520 contained in the folder, it is advantageous in that the control information can be collectively given to each user (including the group).

Further, in this aspect, control information and user information corresponding to the control information can be added to the already archived folders such as ZIP, TAR, and CAB. It is also possible to encrypt the already archived folder using the encryption key.

In the case of adopting the mode in which the control information such that the electronic file 510 or the subordinate folder 520 cannot be extracted from the control target folder 500 is adopted, the information such as the electronic file 510 and the subordinate folder 520 is extracted from the control target folder 500. It is useful in that it can be prevented.

If a mode is adopted in which control information such that a new electronic file 510 or a subordinate folder 520 cannot be created or a new electronic file 510 or a subordinate folder 520 cannot be added in the control target folder 500 is adopted, This is advantageous in that control can be performed to prevent new information from being added to the folder 500.

When the electronic file 510 or the subordinate folder 520 in the controlled folder 500 adopts a mode in which control information whose name cannot be changed is adopted, the electronic file 510 or the subordinate folder in the controlled folder 500 is adopted. This is useful in that control can be performed to prevent the name such as 520 from being changed.

When the electronic file 510 or the subordinate folder 520 in the controlled folder 500 is provided with the control information that cannot be deleted, the information such as the electronic file 510 and the subordinate folder 520 is deleted from the controlled folder 500. This is useful in that it can be controlled to prevent this.

In the case of adopting a mode in which control information that cannot copy the electronic file 510 or the subordinate folder 520 in the control target folder 500 is adopted, it is advantageous in that the information in the control target folder 500 can be controlled not to be copied. ..

When the control information adding unit 10 adopts a mode in which the control information can be individually added to the electronic file 510 or the subordinate folder 520 in the control target folder 500, it is the information in the same control target folder 500. However, it is advantageous in that the control mode can be appropriately changed according to the content. When this mode is adopted, the electronic file 510 or the subordinate folder 520 in the control target folder 500 is selected, and the control information for the selected electronic file 510 or the subordinate folder 520 and the user corresponding to the control information are selected. The creating user may input the information via the operation unit 90.

A mode is adopted in which control information for displaying the electronic file 510 or the subordinate folder 520 in the control target folder 500 can be added only by the display unit such as the device display unit 80 associated with the user selected by the user selection unit 30. In this case, it is useful in that the information itself in the controlled folder 500 can be restricted to a certain person. As described above, when the mode in which control information can be individually added to the electronic file 510 or the subordinate folder 520 in the control target folder 500 is adopted, even if the information in the same control target folder 500, More strictly, it is also useful in that different contents can be displayed for each user terminal 100.

The electronic file 510 or the subordinate folder 520 in the controlled folder 500 may be moved by taking over the control information attached to the controlled folder 500. That is, even if the electronic file 510 or the subordinate folder 520 is extracted from the control target folder 500, the control information given to the control target folder 500 may be inherited to the electronic file 510 or the subordinate folder 520. When such a mode in which control information is added is adopted, even if the electronic file 510 or the subordinate folder 520 is extracted from the control target folder 500, the electronic file 510 existing in the control target folder 500 or This is useful in that the subordinate folder 520 can be controlled.

Unlike such a mode, control information that allows new control information to be added to the electronic file 510 or the subordinate folder 520 extracted from the control target folder 500 may be added. When this mode is adopted, it is advantageous in that new control information can be added to the information extracted from the controlled folder 500. It should be noted that such control information is set for the receiving user who has the authority to retrieve information such as the electronic file 510 and the subordinate folder 520 from the control target folder 500.

In the above-described aspect, when the electronic file 510 or the subordinate folder 520 is taken out from the control target folder 500, input of new control information by the operation unit 90 or the like is permitted, and the fact is displayed on the display unit such as the device display unit 80. When such a mode is adopted, it is advantageous in that the operator such as the user can recognize that the control information can be added at the timing of taking out from the control target folder 500.

When the electronic file 510 or the subordinate folder 520 in the control target folder 500 is controlled using a common encryption key and decryption key, the electronic files 510 in the control target folder 500 are It is useful in that it can realize a data link such as an external reference. That is, when the electronic files 510 are individually encrypted, even if a data link is provided in the electronic file 510, the electronic file 510 of the data link destination is encrypted because the data link destination is encrypted. It cannot be opened and the data link cannot be realized. On the other hand, as described above, by controlling the electronic files 510 in the control target folder 500 using the common encryption key and decryption key, the electronic files 510 in the control target folder 500 are encrypted. Also, since the decryption keys can be used to open each other, the data link can be realized. As an example of this aspect, link setting in Excel (registered trademark) put in the same control target folder 500 can be mentioned. Further, by using the common encryption key and decryption key in this way, mutual reference can be made between component information in CAD (registered trademark) placed in the same control target folder 500.

Whether control information is given to the executable file or the electronic file containing macro information when the control target folder 500 contains an executable file or when the electronic file in the control target folder 500 contains macro information In the case of adopting the mode in which whether or not to select can be adopted, it is useful in that the creation user can appropriately select whether or not to add the control information.

Second Embodiment Next, a second embodiment of the present invention will be described.

In this embodiment, the management authority for the control target folder 500 or the electronic file 510 or the subordinate folder 520 in the control target folder 500 can be controlled so as to be transferred to the person who receives the control target folder 500. In this embodiment, all aspects described in the first embodiment can be adopted in this embodiment. The same components as those in the first embodiment will be described with the same reference numerals.

The person who has received the controlled folder 500 can be, for example, a receiving user who has received the controlled folder 500 via e-mail, USB, cloud or the like. When this mode is adopted, the receiving user who receives the control target folder 500 opens the control target folder 500 by the control application 590, so that the receiving user receives the control target folder 500 or the electronic files in the control target folder 500. The file 510 or the subordinate folder 520 can be freely processed in the same manner as the creating user, and new control information can be freely set.

As in the present embodiment, the control information assigning unit 10 transfers the management authority to the control target folder 500 or the information such as the electronic file 510 and the subordinate folder 520 in the control target folder 500 to the person who receives the control target folder 500. By adopting a mode in which the control target folder 500 can be controlled, it is advantageous in that the person who receives the control target folder 500 can behave as a new administrative authority for the control target folder 500.

The number of receiving users (user terminals 100) to which the management authority is transferred may be limited to one, or the management authority can be transferred to a predetermined number of receiving users (user terminals 100). Good.

Further, whether to transfer the management authority in this way may be included in the control information. In this case, when the receiving user to whom the management authority is transferred decrypts the encrypted control target folder 500, the management authority for the control target folder 500 may be transferred from the creating user to the receiving user. .. Also in this case, the management authority by the creating user does not have to be lost, and both the creating user and the receiving user may have the management authority for the control target folder 500. Of course, unlike this mode, the management authority may be completely transferred from the creating user to the receiving user.

Third Embodiment Next, a third embodiment of the present invention will be described.

The first embodiment and the second embodiment have been described using the mode in which the user ID such as the address of the e-mail or the user terminal information is compared with the user information stored in the central storage unit 260. In the present embodiment, the central processing unit 200 identifies the user based on the user identification information such as the password input from the operation unit 90 or the like (see FIG. 6). In this embodiment, all aspects described in the first embodiment and the second embodiment can be adopted in this embodiment. The same components as those in the first and second embodiments will be described with the same reference numerals.

In the present embodiment, the accessing receiving user may be prompted to input the user identification information, and when the appropriate user identification information is input, it may be determined that the receiving user is an appropriate receiving user. By adopting such a mode, even if the user terminal (information processing apparatus) 100 of the receiving user is opened by a third party, the third party in the control target folder 500 will not know the user identification information. This is useful in that it can increase security by preventing access to the information in. Note that biometric authentication information such as a fingerprint or a retina may be used as the user identification information. When this mode is adopted, only the person who has the biometric authentication information registered in advance can obtain the decryption key, so that higher security can be realized.

In the present embodiment, the recipient user may be identified by using the user identification information while collating with the user information stored in the central storage unit 260 by the e-mail address or the user terminal information. .. If such a mode is adopted, it is advantageous in that the security can be further enhanced.

Fourth Embodiment Next, a fourth embodiment of the present invention will be described.

In each of the above-described embodiments, the user terminal 100 is described as an information processing apparatus, but in the present embodiment, the file sharing server 300 is an information processing apparatus. In this embodiment, all aspects described in each of the above embodiments can be adopted in this embodiment. The same components as those in the above-described respective embodiments will be described with the same reference numerals.

As shown in FIG. 7, the file sharing server 300 according to the present embodiment receives an input from the target identification unit 20 that identifies a folder and the operation unit 90 of the user terminal 100 of the creating user, and operates the folder, or A control information addition unit 10 that adds control information for controlling the operation of the electronic file 510 in the folder or the subordinate folder 520, and a user selection unit 30 that selects user information regarding a user to whom control based on the control information is applied. , May be included.

The file sharing server 300 includes an encryption unit 40 that creates an encryption key that encrypts an electronic file 510 or a subordinate folder 520 in the control target folder 500 or the control target folder 500, and a control target that is encrypted by the encryption key. The folder 500 or the electronic file 510 in the control target folder 500 or the decryption unit 45 for producing a decryption key for decrypting the subordinate folder 520 may be included.

The file sharing server 300 may include a shared server storage unit 360 that stores various information and a shared server control unit 350 that controls the file sharing server 300. As shown in FIG. 7, the shared server control unit 350 may include the above-described target identification unit 20, control information addition unit 10, user selection unit 30, encryption unit 40, and decryption unit 45.

In the present embodiment, only part of the processing performed in the user terminal 100 is performed in the file sharing server 300, and it is possible to employ all the aspects described in each of the above-described embodiments, and the operation thereof. You can also get the effect.

The file sharing server 300 is used not only in the same company as the company to which the creator user belongs or in the affiliated company but also in the company to which the creator user belongs without any capital relationship. May be

The above description of each embodiment and the disclosure of the drawings are merely examples for explaining the invention described in the claims, and the scope of the claims is defined by the description of the above embodiments or the disclosure of the drawings. The described invention is not limited. The description of the claims at the beginning of the application may be appropriately modified within the scope of the present patent specification, and the scope may be expanded.

Each component including the target identification unit 20, the control information addition unit 10, the user selection unit 30, the encryption unit 40, the decryption unit 45, and the like of each of the above-described embodiments is formed in an integrated circuit such as an IC chip or an LSI. It may be realized by a dedicated logic circuit (hardware) or a dedicated circuit, or may be realized by software using a CPU, a memory and the like. Further, each constituent element may be realized by one or a plurality of integrated circuits, or a plurality of constituent elements may be realized by a single integrated circuit.

10 Control Information Addition Unit 20 Target Identification Unit 30 User Selection Unit 40 Encryption Unit 45 Decryption Unit 100 User Terminal (Information Processing Device)
300 file sharing server (information processing device)
500 Control target folder 510 Electronic file 520 Subordinate folder

Claims (17)

A target identification part that identifies a folder,
A control information addition unit that adds control information for controlling the operation of the folder, or the operation of an electronic file or a subordinate folder in the folder;
A user selection unit that selects user information related to a user to whom control based on the control information is applied;
Equipped with
An information processing apparatus capable of controlling an operation of the folder by the receiving user based on control information corresponding to user information of a receiving user who received the folder . The information processing apparatus according to claim 1, wherein the control information includes information that controls the electronic file or the subordinate folder in the folder so that the electronic file or the subordinate folder cannot be taken out from the folder. 2. The control information includes information controlled so that a new electronic file or a lower folder cannot be created in the folder, or a new electronic file or a lower folder cannot be added. Or the information processing device according to any one of 2). 4. The control information includes information for controlling the electronic file or the subordinate folder in the folder so that its name cannot be changed. The information processing device described in 1. The control information includes information controlled so that the electronic file or the subordinate folder in the folder cannot be deleted, or the electronic file or the subordinate folder in the folder cannot be copied. The information processing apparatus according to any one of claims 1 to 4. 2. The control information includes information for controlling management authority for the folder, the electronic file in the folder, or the subordinate folder to be transferred to a recipient of the folder. The information processing apparatus according to any one of items 1 to 5. The control information includes information for controlling to display the electronic file or the subordinate folder in the folder only on the display unit associated with the user information selected by the user selection unit. The information processing apparatus according to claim 1, wherein the information processing apparatus includes: 8. The information processing apparatus according to claim 1, wherein the control information addition unit individually adds control information to the electronic file or the lower folder in the folder. 9. The information processing apparatus according to claim 1, wherein the control information adding unit adds control information to an electronic file extracted from the folder or the subordinate folder. The information processing apparatus according to claim 9, wherein the control information addition unit adds new control information to the electronic file or the subordinate folder extracted from the folder. An encryption unit that creates an encryption key that encrypts the folder, the electronic file in the folder, or the lower folder;
A decryption unit that creates a decryption key for decrypting the folder, the electronic file in the folder, or the subordinate folder encrypted by the encryption key;
Further equipped with,
The electronic file contained in the folder is encrypted with a common encryption key,
11. The information processing apparatus according to claim 1, wherein the electronic file encrypted by the encryption key contained in the folder is decrypted by a common decryption key. .. When the executable file is included in the folder or when the electronic file in the folder includes macro information, the control information adding unit is configured to perform the control information addition unit for the executable file or the electronic file including the macro information. The information processing apparatus according to claim 1, wherein it is possible to select whether or not to add the control information. The information processing apparatus according to any one of claims 1 to 12, wherein the folder is an archived folder. An information processing apparatus according to any one of claims 1 to 13,
A central processing unit capable of communicating with the information processing apparatus;
Equipped with
The information processing system, wherein the central processing unit identifies a user using user identification information input from the information processing device. A program installed on an information processing device,
The information processing device installed with the program
To identify the folder,
Adding control information for controlling the operation of the folder, or the operation of an electronic file or a subordinate folder in the folder,
Selecting user information about a user to whom control based on said control information is applied;
It possible to run,
A program that enables the operation of the folder by the receiving user to be controlled based on the control information corresponding to the user information of the receiving user who received the folder . A recording medium recording a program to be installed in an information processing device,
The information processing device installed with the program
To identify the folder,
Adding control information for controlling the operation of the folder, or the operation of an electronic file or a subordinate folder in the folder,
Selecting user information about a user to whom control based on said control information is applied;
It possible to run,
A recording medium capable of controlling an operation of the folder by the receiving user based on control information corresponding to user information of a receiving user who received the folder . An information processing method executed by an information processing device, comprising:
To identify the folder,
Adding control information for controlling the operation of the folder, or the operation of an electronic file or a subordinate folder in the folder,
Selecting user information about a user to whom control based on said control information is applied;
Equipped with
An information processing method, wherein the operation of the folder by the receiving user can be controlled based on control information corresponding to user information of a receiving user who received the folder .