JP2011034264A - Personal information masking system - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To convert personal information into a character string from which any individual can not be specified while holding the pattern and features of the personal information. <P>SOLUTION: All the character strings of mask object personal information registered in a DB are acquired, and the patterns or features of the personal information are extracted. A character string is replaced on the basis of the patterns or features of the personal information so that following five conditions can be established. (1) Any character string from which an individual is specified does not exist in a post-mask DB. (2) All characters as the elements of the character string from which the individual is specified exist in post-mask DB. (3) When several character strings from which the individual is specified exist in the DB, only the same number of corresponding masked character strings exist in the post-mask DB. (4) When such a character as a symbol or space from which any individual is not specified and the character string or a portion of the character string exist, the same number of the masked character strings exist at the same place in the post-mask DB. (5) When the characters as the elements of the character string from which the individual is specified exist at the start position of the same character string as the masked character string in the post-mask DB. <P>COPYRIGHT: (C)2011,JPO&INPIT

Description

  The present invention relates to a masking system that retains patterns and features of personal information registered in a database and prevents an individual from being identified.

  In recent years, there is a concern about leakage of personal information, and it is necessary for companies to pay close attention to personal information and handle it carefully. On the other hand, in-house computer systems are often outsourced to system development companies. In system development work such as replacing an existing system, a system development company temporarily proceeds with system development by temporarily storing data of an existing system masked by personal information from a company that is a customer.

  Generally, the personal information masking method asks the customer (the company that is the user of the in-house computer system) to confirm where the personal information is, and deletes characters including personal information manually or by using a tool. * "XXX" or replacement with meaningless character strings such as "XXX", or if it is a name, it is not possible to refer to personal information by batch replacement in a fixed format such as "Taro Yamada 1, Taro Yamada 2" To. To implement these masks, a method or tool that extracts where personal information exists from a large amount of character information such as a database or text file and recognizes that the personal information is a character representing a name or address Has been studied, developed and used. Patent Document 1 can be cited as a known technical document regarding such masking processing and character recognition.

JP 2004-94542 A

  The purpose of the mask is to hide characters so that personal information cannot be specified. Therefore, it is often not considered how to change personal information after masking. Therefore, the system development company needs to recognize the data within the range of the character string replaced by the customer (the user of the computer system in the company) and the interview with the customer. Therefore, the system development proceeds without considering the patterns and features hidden in the data that the customer is not able to recognize, and as a result, the data patterns that are latent until the data migration or the subsequent process such as the operation test process by the customer. The feature cannot be detected. As a result, the following problems occur.

For example, assume that customer-recognized data registered in the database has the following six characteristics.
(1) All kanji names are registered in full-width kanji (first and second levels).
(2) Kanji names are not registered with the same name.
(3) A full-pitch empty character is registered between the surname and first name for the name of the kanji.
(4) All Kana names are registered in double-byte Kana.
(5) For Kana's first name, there is no single-byte empty character registered between the last name and first name.
(6) All kanji addresses are registered with “Tokyo” omitted.

  For example, 10,000 Kanji names are replaced with “Taro Yamada 1 to Taro Yamada 10000”, and Kana names are all replaced with “Yamada Taro 1 to Yamada Taro 10000”. Are all replaced with “XXXX”.

Here, it is assumed that the data registered in the database actually operated by the customer has the following problems.
(1) Some Kanji characters have been registered.
(2) The same name was partly registered for Kanji names.
(3) Kanji names that had no last name and a surname, and some empty characters with two or more full-width characters were registered.
(4) Kana's name was partly registered with a mixture of half-width kana.
(5) In Kana's name, one or more single-byte empty characters were registered between the last name and the first name.
(6) Kanji addresses were partly registered from “Tokyo”.

Thereby, for example, the following system influence occurs in the operation test process.
(1) Since the external characters were registered in the name of kanji, the name was not correctly output on the form.
(2) A form was output with the kanji name as the page break condition, but the page was not paged because the same name was registered.
(3) Kanji names were divided into surnames and surnames, and the output position of the form was assigned according to the number of characters of the surname and surname (example is shown in FIG. 8), but could not be correctly assigned and output.
(4) Since half-width kana was mixed and registered in the name of Kana, it ended abnormally in the process of converting full-width kana to half-width kana and outputting the form.
(5) Kana's name was output until the first blank appears in the character string registered in the database, but since there were more than one empty character between the last name and first name, Only the last name was output.
(6) Since Kanji addresses are registered in the database with Tokyo omitted, the specifications are such that when the address is output on a form, “Tokyo” is given by the program. However, since some kanji addresses were registered from “Tokyo”, the address output on the form was output as “Tokyo Metropolitan ...”.

  In order to prevent the above problems in advance, the conventional method of masking personal information by simply crushing it so that system development can be promoted from the early stages of design and coding in consideration of patterns and features of customer data Instead, it is necessary to consider a method that can mask personal information while retaining patterns and features hidden in the data.

  An object of the present invention is to provide a system for converting a character string that cannot identify an individual while retaining the pattern and characteristics of information registered on a database.

  In order to solve the above-described problems, the masking method of the present invention is realized by acquiring all personal information to be masked registered in the table and replacing it with a different character string while retaining the pattern and features. This is realized by replacing all personal information extracted from the database so that the following five conditions are satisfied.

(Condition 1) “Character string” specifying one individual existing before masking is not present in the database after masking.
(Condition 2) All “characters” that are elements of a “character string” that identifies one individual existing before masking are in a state where they exist in the database after masking.
(Condition 3) When there are a plurality of “character strings” specifying one individual existing before masking in the database, the same number of corresponding “character strings” after masking exist in the database after masking To.
(Condition 4) If there is a “character” and a part of “character string” or “character string” such as a symbol (shown in FIG. 7) or a space that cannot identify an individual existing before masking, and after masking In the same location and the same number in the database.
(Condition 5) “Character” that is an element of “Character string” that identifies one individual existing before masking exists at the start position of the same character string as the masked “Character string” in the database after masking Put it in a state.

The reason why the personal information pattern and characteristics can be retained when the above five conditions are satisfied is shown below for each of the five conditions.
(Condition 1) If a “character string” specifying one individual existing before masking exists in the database after masking, this is directly related to the fact that masking is not performed. Therefore, it is necessary to completely prevent the character string that identifies the individual from being present after the masking.
(Condition 2) What “characters” are used by making all the “characters” that are elements of “character strings” that identify one individual existing before the mask exist in the database after masking This is because all character features can be saved. This solves the problems (1) and (4) of the specific examples shown in the problem to be solved by the invention.
(Condition 3) It is possible to store the presence / absence and appearance frequency of information specifying the same individual by having the same number of post-mask “character strings” corresponding to the post-mask database. . This solves the problem (2) of the specific example shown in the problem to be solved by the invention.
(Condition 4) This is because a pattern or feature represented by a character string can be stored by having the same place and the same number of symbols or spaces that cannot identify one individual in the database after masking. This solves the problems (3) and (5) of the specific example shown in the problem to be solved by the invention.
(Condition 5) This is because the data pattern of the mask item can be saved by making it exist at the start position of the same character string as the masked “character string” in the database after masking. This solves the problem (6) of the specific example shown in the problem to be solved by the invention.

The masking method of the present invention has the following effects.
(1) When replacing an existing system, it is possible to recognize the pattern and characteristics of the data without referring to the personal information in the production data of the existing system, so there is a need for design consideration and data cleaning at an early stage of system development. This makes it possible to efficiently examine the data migration method.
(2) It is possible to easily create test data close to the actual personal information without disclosing the personal information.

1 is a system configuration diagram showing an embodiment of a masking system according to the present invention. It is the example which masked the character string of personal information. It is a block diagram of the various management tables utilized for a masking process. It is a flowchart which shows the outline | summary of a masking process. It is a flowchart of a character string analysis process. It is a flowchart of a character string replacement process. It is a character indicating a symbol that cannot identify an individual. It is a specific example showing allocation of a name. This is a specific example of the input file 108 and the parameter 109.

    Hereinafter, embodiments of an auto masking tool (masking apparatus) to which the present invention is applied will be described.

  FIG. 1 is a system configuration diagram showing an embodiment of a masking apparatus according to the present invention. Mask processing is performed by operating mask processing software 102 by a mask processing terminal 101. The mask processing software 102 includes a data reading module 103, a data analysis module 104, a data replacement module 105, a data verification module 106, and a data output module 107. The data reading module 103 reads the input file 108 and parameters 109 and passes them to the data analysis module 104. Here, all the character strings to be masked are read, and patterns and features are extracted. Based on the analysis result of the data analysis module 104, the data replacement module 105 performs character string replacement so that personal information cannot be specified, and the masked character string is passed to the data verification module 106. The data verification module 106 checks whether the personal information is replaced with a character string that cannot be completely specified. Finally, the masked output file 110 is output from the data output module 107. The utility 111 is a tool that is already installed in the DBMS that converts the contents of the database 112 into a text file, and the data in the database 112 is converted into a text file by comma separation.

  The mask processing terminal 101 in FIG. 1 is a computer that reads a computer program called mask processing software 102 and executes the processing as described above. The five modules from the data reading module 103 to the data output module 107 can be said to be computer program parts. However, if the CPU reads and processes each computer program as a device, each module in FIG. Or it can also be regarded as a device. Accordingly, the configuration of FIG. 1 corresponds to the claims.

  FIG. 2 is a specific example in which a character string of personal information is subjected to masking processing. When a character string 201 specifying an individual before mask processing is input to mask processing software, a character string such as a character string 202 after mask processing is obtained. It is replaced and the personal information is masked. This masking process satisfies the five conditions defined by the means for solving the problem. Comparing the character string that identifies an individual before mask processing in FIG. 2A with the character string after mask processing in FIG. 2B, the position of a blank and the position of a symbol that cannot identify an individual are the same. Therefore, it can be seen at a glance that the condition solving means (condition 4) is satisfied. Mask processing that satisfies the other conditions (condition 1), (condition 2), (condition 3), and (condition 5) is also performed.

  FIG. 3 is a configuration diagram of various management tables used for the masking process. The character string data table 301 is created from the input file 108 by the data reading module 103. This is a table having the maximum length of the character string to be masked in the column width. The first character 302 holds the first character of the character string, and the second character 303 holds the second character from the beginning of the character string. ing. Similarly, when there are three or more character strings, the third and subsequent characters from the beginning of the character string are retained.

  The replacement management table 304 and the duplication management table 307 are created by the data analysis module 104. The first character 305 of the replacement management table 304 corresponds to the first character 302 of the character string data table 301, and the second character 306 corresponds to the second character 302 of the character string data table 301. Similarly, when there are three or more character strings, this corresponds to the third and subsequent characters in the character string data table 301.

  The row 308 of the duplication management table 307 corresponds to the number of rows of the character string data table 301, and the duplicate row 309 is configured to store duplicate row numbers of the character string data table 301. The character string data table 301 holds all the data of the parameter 109 indicating the mask target item of the input file 108 and the existing position of the character string. The replacement management table 304 stores “1” when a character in the character string data table 301 is to be replaced in a format corresponding to the character location held in the character string data table 301 on a one-to-one basis. “0” is held when is not a replacement target. The duplication management table 307 holds the number of lines in which character strings that identify individuals corresponding to the respective lines of the character string data table 301 are duplicated. In FIG. 3, the first line indicates that the character string data table 301 holds information about the person who identifies the same individual in the third line and the fifth line and the 19th line.

  FIG. 4 is a flowchart showing an outline of the masking process. First, the input file 108 is read (step 401). Next, the parameter 109 is read (step 402). Based on these contents, character string analysis processing is performed (step 403). Details of the character string analysis processing are shown in FIG. A character string replacement process is performed based on the analysis result (step 404). Details of the character string replacement process are shown in FIG. After all the replacement of the character string is completed, check whether the same character string exists in the converted character string, and if it exists, it is not possible to specify all personal information. Implement (steps 405 and 406). If the same character string does not exist in the converted character string as a result of this check, it is determined that all personal information has been masked, the masked file is output, and the process ends (step 407).

  FIG. 5 is a flowchart of the character string analysis process (step 403 in FIG. 4). Based on the information (input file, parameter) obtained from steps 401 and 402 in FIG. 4, all the character strings of the items to be masked are read, the number of input cases and the maximum character length of the character string are calculated, and the character string A data table 301 is created (step 501). Then, the character strings of the items to be masked are all decomposed for each character and stored in the corresponding positions in the character string data table 301 (step 502).

  Next, based on the contents of the character string data table 301, “1” is assigned to the designated location of the target character to be replaced, and “0” is substituted to the designated location that is not the target character to be replaced. Create Judgment that is not a target character to be replaced is a character corresponding to the symbol or space shown in FIG. 7 or a row held in a duplicate row of the duplicate management table 307. The target character to be replaced is determined (steps 503, 504, 505, 506, 507).

  Next, based on the contents of the character string data table 301, if there is a duplicate character string, the corresponding duplicate row is additionally stored in the duplicate management table 307 (steps 508, 509, 510, 511, 512). For example, when the same character string as the first line of the character string data table 301 exists in the third line, the fifth line, and the 19th line, the line 308 of the duplication management table 307 corresponds to the value “1”. Thus, the numerical values “3, 5, 19” are stored in the duplicate row 309. If there is no duplicate character string, “0” is stored in the duplicate row 309 of the duplicate management table 307 corresponding to the row of the character string data table 301 (step 513).

  FIG. 6 is a flowchart of the character string replacement process (step 404 in FIG. 4). When the value is read from the replacement management table 304 and is “1”, it is a replacement target, and therefore the cell of the corresponding character string data table 301 and the cell of the character string data table 301 corresponding to the randomly acquired row are replaced. If “1” exists in the first row of the replacement management table 304 and all the second and subsequent rows are “0”, the replacement target does not exist, and the process is terminated (step 601). 602, 603).

  The randomly acquired rows are numerical values different from the number of rows in the replacement management table 304, and numerical values from “1” to “maximum rows in the replacement management table 304” are acquired by random numbers. If the cell value in the replacement management table 304 for the number of rows calculated in this way is “0”, it is a character string that is not subject to replacement. Therefore, the cell value in the duplication management table 307 calculated by re-acquiring random numbers is obtained. If “1”, replace.

  Next, “0” is substituted into the value of the replacement management table 304 corresponding to the replaced cell (step 604). This is to indicate that the replacement has already been completed. If the value is read from the replacement management table 304 and is “0”, the next data is read from the replacement management table 304 because it is not a replacement target (step 605). When all the values in the replacement management table 304 become “0”, the values in the character string data table 301 are assigned to the rows held in all the duplicate rows 309 in the rows corresponding to the values in the duplicate management table 307 (step 607). If all the values in the replacement management table 304 are not “0”, the process returns to step 602 to continue the processing.

  FIG. 7 shows characters indicating symbols that cannot identify an individual. If characters corresponding to these symbols exist in the mask target, they are not replaced.

  FIG. 8 is a specific example showing the assignment of names. For example, if the last name on the first line is 1 character and the name is 1 character, then it is output on a form with 6 blanks in between as shown in “assignment”. To do. As a result, the start position and end position of the name of the Chinese character are arranged in order.

  FIG. 9 is a specific example of the input file 108 and the parameter 109. The input file 108 is a text file in which the contents of the database 112 are separated by commas. The parameter 109 designates numerically the position at which the item in the comma-delimited text file is to be masked. In this example, two items are designated as mask targets.

  It has high utility value as test data when it is converted to a character string that cannot identify an individual while retaining the pattern and characteristics of information registered in the database, and is stored in a system development company for system development.

DESCRIPTION OF SYMBOLS 101 Mask processing terminal 102 Mask processing software 103 Data reading module 104 Data analysis module 105 Data replacement module 106 Data verification module 107 Data output module 108 Input file 109 Parameter 110 Output file 111 Utility 112 Database 201 Character which specifies the individual before mask processing Column 202 Character string 301 after mask processing Character string data table 302 First character of character string data table 303 Second character of character string data table 304 Replacement management table 305 First character of replacement management table 306 Two characters of replacement management table Item 307 Duplicate management table 308 Duplicate management table row 309 Duplicate management table duplicate row

Claims (2)

A masking system that converts a character string including personal information registered in a database of an existing system into a character string that has the same value as test data used for system development but cannot identify an individual,
A data reading device for reading parameters indicating input files and mask target items;
A character string analysis device that analyzes a character string to be masked read by the data reading device and extracts patterns and features;
A character string replacing device that replaces the character string to be masked with a character string whose personal information cannot be identified based on an analysis result by the character string analyzing device;
A data verification device that verifies whether or not the character string after masking replaced by the character string replacement device is completely replaced with information that cannot identify personal information;
A data output device that outputs data of a character string after masking verified by the data verification device as an output file. A masking system according to claim 1,
The character string analyzer is
The number of input information read by the data reading device, the maximum character length is calculated, a character string data table creating means for creating a character string data table to store the input information,
Input information storage means for storing the input information in the character string data table created by the character string data table creation means;
A replacement management table creating means for creating a replacement management table for managing which character is replaced and which is not replaced;
A duplicate management table creation means for creating a duplicate management table for holding and managing the number of duplicate rows, and
The character string replacement device includes:
Value reading means for reading values from the replacement management table created by the replacement management table creating means;
Replacement means for replacing a cell of the character string data table corresponding to the replacement management table with a cell of the character string data table corresponding to a randomly acquired row when the value read by the value reading means is 1 When,
0 substitution means for assigning 0 to the replacement management table corresponding to the cell replaced by the replacement means;
Duplicate row replacement means for referring to the duplicate management table when the values of the replacement management table all become 0 and substituting the value of the character string data table into the row corresponding to the value. Masking system to do.

Images