JP2013205979A - Attribute information disclosure control system, information possession management server and attribute information disclosure control method - Google Patents

Abstract

PROBLEM TO BE SOLVED: To change a security level according to importance of disclosed attribute information.SOLUTION: An information possession management server 10 includes: a combination generation section 15 generating combinations of attribute items satisfying conditions of the attribute items requested by an information utilization server 30; an importance/authentication level determination section 16 calculating importance for each combination of the attribute items, determining an authentication level required when a user permits disclosure of attribute information according to the importance and generating an attribute item consent request screen according to the combinations of the attribute items and the authentication level; and a communication section 17 transmitting the attribute item consent request screen to a user terminal 40, receiving the attribute item permitted by the user from the user terminal 40, receiving the attribute information corresponding to the attribute item permitted by the user from an information possession server 20 and transmitting the received attribute information to the information utilization server 30.

Description

  The present invention relates to an attribute information disclosure control system, an information holding management server, and an attribute information disclosure control method for controlling disclosure of attribute information based on the importance of attribute information of a user.

  Currently, along with the spread of the Internet and broadband services, attribute information such as address, phone number, date of birth, etc. is disclosed on the user's will, and various financial services such as credit cards, EC (Electronic Commerce) ) Exists. In a conventional attribute information disclosure control system that provides attribute information based on the user's will, the information holding server that holds the attribute information follows the content of the disclosure control set by the user with respect to the information utilization server that provides the service. It was possible to provide user attribute information (see, for example, Patent Document 1).

JP 2009-199573 A

  However, the conventional technique has a problem that the importance of the attribute information of the user whose disclosure is controlled to the information utilization server cannot be determined. Here, the importance level is a numerical value representing the magnitude of the impact (for example, damage amount) on the user when the user's attribute information is handled illegally such as outflow, loss, or alteration. In addition, in an attribute information disclosure control system having a plurality of information holding servers, even if each information holding server manages the importance of the attribute information, the accurate importance of the attribute information disclosed to the information utilization server The degree cannot be determined. As described above, the prior art cannot determine the importance of the attribute information of the user whose disclosure is controlled to the information utilization server, and thus cannot change the security level according to the importance.

  The object of the present invention made in view of such circumstances is to determine the importance of all the distributed attribute information from the attribute information managed by a plurality of information holding servers, and according to the importance of the attribute information to be disclosed It is an object to provide an attribute information disclosure control system, an information holding management server, and an attribute information disclosure control method capable of changing a security level.

  In order to solve the above problems, an attribute information disclosure control system according to the present invention includes a plurality of information holding servers that hold attribute information of users of user terminals that use services provided from an information utilization server, and the use Attribute information comprising: an information possession management server that possesses attribute items of the attribute information of the person, acquires attribute information corresponding to the attribute items from the plurality of information possession servers, and transmits the attribute information to the information utilization server In the disclosure control system, the information holding management server calculates a degree of importance for each combination of the attribute items and a combination generation unit that generates a combination of attribute items that satisfy the condition of the attribute items requested by the information utilization server The authentication level required when the user permits the disclosure of the attribute information is determined according to the importance, and the combination of the attribute items and the previous In accordance with the authentication level, the importance / authentication level determination unit for generating an attribute item consent request screen for confirming whether or not the attribute item can be disclosed to the user, and the attribute item consent request screen to the user terminal Transmission, reception of attribute items permitted by the user from the user terminal, reception of attribute information corresponding to the attribute items permitted by the user from the information holding server, and utilization of the information of the received attribute information A communication unit that transmits to the server, and the information holding server includes a communication unit that transmits attribute information corresponding to the attribute item permitted by the user to the information holding management server. .

  Moreover, in order to solve the said subject, the information possession management server which concerns on this invention possesses the attribute item of a user's attribute information, and the attribute of the user of the user terminal which utilizes the service provided from an information utilization server An information possession management server that acquires attribute information corresponding to an attribute item from a plurality of information possessing servers that retain information and transmits the attribute information to the information utilization server, and the attribute item requested by the information utilization server A combination generation unit that generates a combination of attribute items that satisfy the condition, and calculates the importance for each combination of the attribute items, and is necessary when the user permits the disclosure of attribute information according to the importance Attribute item consent request screen for determining whether or not to allow the user to disclose the attribute item according to the combination of the attribute items and the authentication level. The importance / authentication level determination unit to be generated and the transmission of the attribute item consent request screen to the user terminal, the reception of the attribute item permitted by the user from the user terminal, the use from the information holding server A communication unit that receives attribute information corresponding to the attribute item permitted by the person and transmits the received attribute information to the information utilization server.

  In order to solve the above problem, the attribute information disclosure control method according to the present invention includes a plurality of information holding servers that hold attribute information of users of user terminals that use services provided from the information utilization server, An information holding management server that holds attribute items of the user attribute information, acquires attribute information corresponding to the attribute items from the plurality of information holding servers, and transmits the attribute information to the information utilization server. In an attribute information disclosure control system, there is an attribute information disclosure control method for controlling the disclosure of attribute information, and the information holding management server uses attribute items corresponding to attribute information held by the plurality of information holding servers, Generating a combination of attribute items that satisfy the condition of the attribute item requested by the information utilization server; and Calculating an importance level for each combination of eyes, and determining an authentication level required when a user permits disclosure of attribute information according to the importance level; and According to the combination of items and the authentication level, a step of generating an attribute item consent request screen for confirming whether or not the attribute item is disclosed to the user; and A step of transmitting to the user terminal; a step of receiving from the user terminal an attribute item permitted by the user by the information holding management server; and an attribute item permitted by the user by the information holding server. Transmitting corresponding attribute information to the information holding management server; and receiving the information from the information holding server by the information holding management server. Characterized in that it comprises a step of transmitting the attribute information to the information utilization server, the.

  According to the present invention, it is possible to determine the importance of all the distributed attribute information from the attribute information held in a plurality of information holding servers, and to change the security level according to the importance of the attribute information to be disclosed. become able to.

It is a block diagram which shows the structural example of the attribute information disclosure control system which concerns on one Embodiment of this invention. It is a figure which shows an example of the user attribute information memorize | stored in the user attribute information storage part in the attribute information disclosure control system which concerns on one Embodiment of this invention. It is a figure which shows an example of the service management information memorize | stored in the service management information storage part in the attribute information disclosure control system which concerns on one Embodiment of this invention. It is a figure showing an example of information possession server management information memorized by an information possession server management information storage part in an attribute information disclosure control system concerning one embodiment of the present invention. It is a figure which shows an example of the importance calculation information memorize | stored in the importance management information storage part in the attribute information disclosure control system which concerns on one Embodiment of this invention. It is a flowchart which shows the operation example of the attribute information disclosure control system which concerns on one Embodiment of this invention. It is a flowchart which shows the operation example of the attribute information disclosure control system which concerns on one Embodiment of this invention. It is a figure which shows an example of the attribute item consent request | requirement screen displayed on the utilization terminal in the attribute information disclosure control system which concerns on one Embodiment of this invention.

  Hereinafter, an embodiment of the present invention will be described in detail with reference to the drawings.

[Configuration of attribute information disclosure control system]
FIG. 1 is a block diagram showing a configuration example of an attribute information disclosure control system according to an embodiment of the present invention. As shown in FIG. 1, the attribute information disclosure control system 1 includes an information holding management server 10, a plurality of information holding servers 20, an information utilization server 30, and a user terminal 40. In FIG. 1, for convenience of explanation, only two information holding servers 20 (20-1 and 20-2) are shown. The information holding management server 10, the plurality of information holding servers 20, the information utilization server 30, and the user terminal 40 are connected to each other via a network 50 such as the Internet.

  The attribute information disclosure control system 1 calculates the importance of all the attribute information to be disclosed in the disclosure control from the plurality of information holding servers 20, and based on the calculated importance, the authentication level (requested from the user) Change the security level required when allowing users to disclose attribute information. A specific example of the attribute information disclosure control system is a public-private cooperation service in which a private person obtains personal information managed by a plurality of public authorities and provides a service to a user.

  The user terminal 40 is a terminal such as a PC or a mobile phone. As shown in FIG. 1, the user terminal 40 includes an input / output unit 41, a control unit 42, and a communication unit 43. The input / output unit 41 inputs / outputs various types of information, and the input unit includes a keyboard, a mouse, and the like, and receives input from a user on an attribute item consent request screen to the information holding management server 10 described later. The output unit is configured to include a display, and displays an attribute item consent request screen described later. The communication unit 43 transmits and receives various types of information between the information holding management server 10 and the information utilization server 30. The control unit 42 controls input / output processing of the input / output unit 41 and communication processing of the communication unit 43.

  The information utilization server 30 is a server that acquires desired attribute information managed by the plurality of information holding servers 20 from the information holding management server 10 and provides various services to the user terminal 40 that is a service request source. . As illustrated in FIG. 1, the information utilization server 30 includes a service information generation unit 31, a control unit 32, and a communication unit 33. The service information generation unit 31 generates various service information when the user attribute information can be acquired. The communication unit 33 transmits and receives various kinds of information between the information holding management server 10 and the user terminal 40. The control unit 32 controls service information generation processing of the service information generation unit 31 and communication processing of the communication unit 33.

  The information holding server 20 is a server that holds user attribute information. As illustrated in FIG. 1, the information holding server 20 includes a user attribute information storage unit 21, an attribute information acquisition unit 22, and a communication unit 23.

  The user attribute information storage unit 21 stores user attribute information. FIG. 2 is a diagram illustrating an example of user attribute information stored in the user attribute information storage unit 21. The user attribute information includes attribute information such as “user ID”, “name”, “address”, “birth date”, and can include arbitrary attribute information. Here, the “user ID” is an ID that uniquely indicates the user. This user attribute information is assumed to be registered in the user attribute information storage unit 21 in advance during system operation.

  The attribute information acquisition unit 22 acquires user attribute information corresponding to the attribute item from the user attribute information storage unit 21 using “user ID” and “attribute item” (attribute information item) as keys.

  The communication unit 23 receives an attribute information request from the information possession management server 10. Then, the communication unit 23 transmits user attribute information to the information holding management server 10 in response to an attribute information request from the information holding management server 10.

  The information possession management server 10 is a device that calculates the importance level of the attribute information of the user and manages the authentication level that is determined when the disclosure of the attribute information is permitted according to the importance level. As shown in FIG. 1, the information holding management server 10 includes a service management information storage unit 11, an information holding server management information storage unit 12, an importance management information storage unit 13, a resource management unit 14, and a combination generation unit. 15, an importance / authentication level determination unit 16, and a communication unit 17.

  The service management information storage unit 11 stores service management information that is information for managing the information holding server 20 in which attribute information is registered. FIG. 3 is a diagram illustrating an example of service management information stored in the service management information storage unit 11. The service management information includes “service ID”, “information holding server information”, and “necessary attribute items” requested by the information utilization server 30. Here, the “service ID” is an ID that uniquely indicates a service content provided by the information utilization server 30. The “information holding server ID” is an ID that uniquely indicates the information holding server 20. Here, the ID of the information holding server 20 that holds attribute information necessary for the service specified by the service ID is registered. The “necessary attribute item” is an attribute item name necessary for executing the service specified by the service ID. This service management information is assumed to be stored in advance in the service management information storage unit 11 during system operation.

  The information holding server management information storage unit 12 stores information holding server management information. FIG. 4 is a diagram illustrating an example of information holding server management information stored in the information holding server management information storage unit 12. The information holding server management information includes “user ID”, “information holding server ID”, and one or more “presence / absence of attribute items”. Here, the “attribute item” is an item of attribute information held by the information holding server 20 specified by the information holding server ID. That is, the information holding management server 10 does not store / manage attribute information itself, but stores / manages presence / absence of attribute items. It is assumed that the information holding server management information is stored in advance in the information holding server management information storage unit 12 during system operation. In the example of FIG. 4, the information holding server 20 whose information holding server ID is X001 has name, address, and date of birth as attribute information, but does not have a telephone number. Further, it means that the information holding server 20 having the information holding server ID X002 has the name, address, and telephone number as the attribute information, but does not have the date of birth.

  The importance management information storage unit 13 is importance calculation information that is information necessary for calculating the importance of a combination of a plurality of attribute information and importance authentication that is information indicating an authentication level corresponding to the importance. Store level information. FIG. 5 is a diagram illustrating an example of importance management information stored in the importance management information storage unit 13. FIG. 5A is an example of importance calculation information, and FIG. 5B is an example of importance authentication level information. This importance management information is stored in advance in the importance management information storage unit 13 during system operation.

  As the importance calculation information, in this embodiment, “2010 Survey Report on Information Security Incident-Personal Information Leakage Edition”, Version 1.4, http://www.jnsa.org/result/incident/data/ An example based on 2010incident_survey_PIL_v1.4.pdf will be described. The importance calculation information includes “attribute item”, “basic information value”, “mental distress level”, “economic loss level”, “identity ease”, and also includes “importance calculation condition”. But you can.

  Here, the “mental distress level” is shown in three stages of mental distress that the user receives when the attribute item is leaked, and the value increases as the mental distress increases. For example, if the attribute item is a medical condition or religion, the mental pain level is set to 3. The “economic loss level” indicates the economic loss experienced by the user when the attribute item is leaked in three stages, and the value increases as the economic loss increases. For example, when the attribute item is an account number or a credit card number, the economic loss level is set to 3. “Person identification ease” indicates the ease of identification from the leaked attribute information, and the value of the attribute item that facilitates identification is increased. The “importance calculation condition” is set when the importance calculation condition changes depending on the combination. The case where the importance calculation condition varies depending on the combination, for example, when the attribute item is “name” alone, the person identification ease is 3, but when the attribute item is combined with “address”, the person identification ease is 6 And so on.

  Further, the importance level authentication level information includes “importance level range” and “authentication level”. Here, the “importance level range” is a value indicating the range of the importance level for determining the authentication level. The “authentication level” is a level of an authentication method required when a user permits disclosure of attribute information from the use terminal 40. The authentication level is determined according to the importance range, and the higher the importance, the higher the authentication level. For example, when the importance is low, the authentication level is “ID and password”, and when the importance is high, the authentication level is “IC card”. If the authentication level is “IC card”, the user terminal 40 requires an IC card reader.

  The resource management unit 14 acquires “information holding server ID” and “necessary attribute item” from the service management information storage unit 11 using “service ID” as a key. Further, the resource management unit 14 acquires “attribute item” from the information holding server management information storage unit 12 using “information holding server ID” as a key. Further, the resource management unit 14 uses the “attribute item” included in the combination of the attribute items generated by the combination generation unit 15 as a key, from the importance management information storage unit 13 to “basic information value”, “mental distress level”. ”,“ Economic Loss Level ”,“ Principal Identification Ease ”.

  The combination generation unit 15 generates a combination of attribute items that satisfy the condition of the attribute item requested by the information utilization server 30 from the “necessary attribute item” and the “attribute item” acquired by the resource management unit 14, and the importance / authentication Output to the level determination unit 16.

  The importance / authentication level determination unit 16 calculates the importance from the “basic information value”, “mental distress level”, “economic loss level”, and “identity ease” acquired by the resource management unit 14. . The importance is expressed by, for example, the following equation (1), where “mental distress level” is x and “economic loss level” is y. When there are a plurality of “attribute items” in the combination of attribute items, the largest value among the “mental distress levels” is x, and the largest value among the “economic loss levels” is y.

Importance = basic information value × (10 ^x−1 +5 ^y−1 ) × person identification ease (1)

  The importance / authentication level determination unit 16 determines a combination of attribute items having the smallest importance among the combinations of attribute items. Then, the “authentication level” is acquired from the importance management information storage unit 13 using the smallest importance as a key. Then, the importance / authentication level determination unit 16 generates an attribute item agreement request screen according to the combination of attribute items having the lowest importance and the acquired “authentication level”, and outputs the attribute item consent request screen to the communication unit 17. Here, the attribute item consent request screen refers to a screen for confirming the consent of whether or not to disclose the acquired attribute item to the user.

  The communication unit 17 transmits and receives information to and from the information utilization server 30, the user terminal 40, and the information holding server 20 via the network 50. Specifically, transmission of the attribute item consent request screen generated by the importance / authentication level determination unit 16 to the user terminal 40, reception of the attribute item permitted by the user from the user terminal 40, the information holding server 20 The attribute information corresponding to the attribute item permitted by the user is transmitted to the information utilization server 30 from the received attribute information.

[Operation of attribute information disclosure control system]
Next, the operation of the attribute information disclosure control system will be described. FIG. 6 is a flowchart showing the operation of the attribute information disclosure control system 1.

  In step S <b> 101, the user terminal 40 transmits a service request to the information utilization server 30 via the network 50 in order to request a service that utilizes attribute information. The service request includes “user ID”.

  In step S102, the information utilization server 30 transmits “user ID” and “service ID” included in the service request received in step S101 to the communication unit 17 of the information holding management server 10 via the network 50.

  In step S <b> 103, the communication unit 17 of the information holding management server 10 receives “user ID” and “service ID” from the information utilization server 30 via the network 50.

  In step S104, the resource management unit 14 of the information holding management server 10 acquires the “information holding server ID” and the “necessary attribute item” from the service management information storage unit 11 using the “service ID” as a key.

  In step S105, the resource management unit 14 of the information holding management server 10 uses the user ID acquired in step S103 and the “information holding server ID” and “necessary attribute item” acquired in step S104 as keys. The “attribute item” registered as “present” is acquired from the management information storage unit 12.

  In step S106, the combination generation unit 15 of the information holding management server 10 generates a combination of attribute items that satisfy the condition of the “necessary attribute item” acquired in step S104 from the “attribute item” acquired in step S105.

  In step S107, the importance / authentication level determination unit 16 of the information holding management server 10 uses the combination of the attribute items generated in step S106 as a key to read the importance from the importance management information storage unit 13 via the resource management unit 14. Calculation information is acquired, and importance is calculated for each combination of attribute items. And the authentication level in this importance is acquired from the importance management information storage unit 13 using the lowest importance as a key. When acquiring the authentication level, the importance / authentication level determination unit 16 generates an attribute item agreement request screen corresponding to the authentication level.

  In step S <b> 108, the communication unit 17 of the information holding management server 10 transmits the attribute item agreement request screen generated in step S <b> 107 to the user terminal 40 via the network 50.

  In step S109, the communication unit 17 of the information holding management server 10 transmits the attribute item agreement that is the disclosure control content operated by the user from the attribute item agreement request screen generated in step S107 from the user terminal 40 via the network 50. The contents (the attribute item “disclosed”) are received.

  In step S <b> 110, the communication unit 17 of the information holding management server 10 transmits an attribute information request to the communication unit 23 of the information holding server 20 via the network 50. The attribute information request includes the “user ID” acquired in step S103 and the “attribute item” received in step S105.

  In step S <b> 111, the communication unit 23 of the information holding server 20 receives an attribute information request from the communication unit 17 of the information holding management server 10 via the network 50.

  In step S112, the attribute information acquisition unit 22 of the information holding server 20 uses the “user ID” and the “attribute item” included in the attribute information request received in step S111 as keys as attributes from the user attribute information storage unit 21. Get information.

  In step S <b> 113, the communication unit 23 of the information holding server 20 transmits the attribute information acquired in step S <b> 112 to the communication unit 17 of the information holding management server 10 via the network 50.

  In step S <b> 114, the communication unit 17 of the information holding management server 10 receives attribute information from the communication unit 23 of the information holding server 20 via the network 50.

  In step S <b> 115, the communication unit 17 of the information holding management server 10 transmits the attribute information acquired in step S <b> 114 to the information utilization server 30 via the network 50.

  In step S <b> 116, the information utilization server 30 receives attribute information from the communication unit 17 of the information holding management server 10 via the network 50.

  In step S <b> 117, the service information generation unit 31 of the information utilization server 30 generates service information and transmits it to the user terminal 40 via the network 50.

[Specific example of operation of attribute information disclosure control system]
Next, a specific example of the operation of the attribute information disclosure control system 1 will be described. FIG. 7 is a flowchart showing a specific example of the operation of the attribute information disclosure control system 1, and specific information is added to the flowchart shown in FIG.

  In this specific example, the user attribute information storage unit 21 of the information holding server 20-1 has “Taro Denden” as the name, “XX City XX City ○-○” as the address, and “ “2000/01/01” is stored. Further, it is assumed that “Taro Denden” is registered as the name and “03-1111-1111” as the telephone number in the user attribute information storage unit 21 of the information holding server 20-2. Note that any other attribute information may be registered in the user attribute information storage unit 21 of the information holding server 20-1 and the user attribute information storage unit 21 of the information holding server 20-2.

  In this specific example, the user specified by the user ID (A001) provides the information utilization server 30 with attribute information corresponding to the attribute items (name, date of birth, and address or telephone number). Assume the case. As an example, the importance of the attribute information is calculated from the leaked personal information value, and the authentication level is determined from an arbitrary determination rule.

  In step S <b> 201, the user terminal 40 transmits a service request to the information utilization server 30 via the network 50 in order to request a service that utilizes attribute information. The service request includes a user ID (A001).

  In step S202, the information utilization server 30 sends the user ID (A001) and service ID (S001) included in the service request received in step S101 to the communication unit 17 of the information holding management server 10 via the network 50. Send.

  In step S <b> 203, the communication unit 17 of the information holding management server 10 receives the user ID (A001) and service ID (S001) from the information utilization server 30 via the network 50.

  In step S204, the resource management unit 14 of the information holding management server 10 uses the service ID (S001) as a key, and from the service management information storage unit 11, the information holding server ID (X001, X002) and necessary attribute items (name, name, Date of birth and address or telephone number).

  In step S205, the resource management unit 14 of the information holding management server 10 acquires the user ID (A001) acquired in step S203, the information holding server ID (X001, X002) acquired in step S204, and necessary attribute items (name). , And the attribute item (name, date of birth, address, telephone number) registered as “present” is acquired from the information holding server management information storage unit 12 using the date of birth and address or telephone number) as a key. .

  In step S206, the combination generation unit 15 of the information holding management server 10 generates an attribute item combination that satisfies the condition of the necessary attribute item acquired in step S204, from the attribute item acquired in step S205. The attribute item acquired in step S205 is “name, date of birth, address, and phone number”, and the condition of the required attribute item acquired in step S204 is “name, date of birth, address, or phone number”. Therefore, the combination of attribute items is “name, date of birth, address” and “name, date of birth, phone number”.

In step S207, the importance / authentication level determination unit 16 of the information possession management server 10 combines the attribute items generated in step S206 ((name, date of birth, address), and (name, date of birth, phone number). )) As a key, importance calculation information (basic information value, mental distress level, economic loss level, person identification ease, importance calculation condition) is acquired from the importance management information storage unit 13 and the attribute Importance is calculated for each combination of items.
Referring to the importance management information and formula (1) shown in FIG. 5, when the combination of attribute items is “name, date of birth, address”, the importance is 500 × (10 ^1-1 +5 ^{1− 1} ) × 6 = 6000, and when the combination of attribute items is “name, date of birth, telephone number”, the importance is 500 × (10 ^1-1 +5 ^1-1 ) × 3 = 3000.

  Therefore, the combination having the lowest importance is “name, date of birth, telephone number”, and the importance level “3000” at that time is used as a key from the importance management information storage unit 13 for the authentication level ( ID / password). Then, an attribute item consent request screen corresponding to the acquired authentication level is generated.

  In step S <b> 208, the communication unit 17 of the information holding management server 10 transmits the attribute item agreement request screen generated in step S <b> 207 to the user terminal 40 via the network 50.

  FIG. 8 is a diagram illustrating an example of the attribute item agreement request screen displayed on the input / output unit 41 of the user terminal 40. Here, the attribute item consent request screen corresponding to the authentication level “ID / password” is shown. In the attribute item consent request screen 100, the attribute items (name, date of birth, and telephone number) of the least important combination acquired in step S207 are listed in the user input area 101, and the user discloses them. It is configured so that it can be selected. When the user clicks the “permit” button 102, a screen for inputting an ID and a password is displayed. If the “not permitted” button 103 is clicked, it is considered that the attribute item is not agreed, and the attribute information disclosure control system 1 ends the process.

  In step S209, the communication unit 17 of the information holding management server 10 transmits the attribute item consent that is the disclosure control content operated by the user from the attribute item consent request screen generated in step S207 from the user terminal 40 via the network 50. The contents (attribute items permitted to be disclosed) are received.

  In step S210, the communication unit 17 of the information holding management server 10 transmits an attribute information request to the communication unit 23 of the information holding server 20-1 identified by the information holding server ID (X001) via the network 50. The attribute information request includes the user ID (A001) acquired in step S203 and the attribute items (name, date of birth) of the information holding server ID (X001) received in step S205.

  In Step S210, communication part 17 of information possession management server 10 transmits an attribute information request to communication part 23 of information possession server 20-2 specified by information possession server ID (X002) via network 50. To do. The attribute information request includes the user ID (A001) acquired in step S203 and the attribute items (name, phone number) of the information holding server ID (X002) received in step S205.

  In step S211, the communication unit 23 of the information holding server 20-1 receives an attribute information request including the user ID (A001) and attribute items (name, date of birth) from the communication unit 17 of the information holding management server 10. To do. In addition, the communication unit 23 of the information holding server 20-2 receives an attribute information request including the user ID (A001) and attribute items (name, phone number) from the communication unit 17 of the information holding management server 10.

  In step S212, the attribute information acquisition unit 22 of the information holding server 20-1 uses the user ID (A001) and attribute items (name, date of birth) included in the attribute information request received in step S211 as keys. Attribute information (name: Denden Taro, date of birth: 2000/01/01) is acquired from the person attribute information storage unit 21. Further, the attribute information acquisition unit 22 of the information holding server 20-2 uses the user ID (A001) and the attribute items (name, phone number) included in the attribute information request received in step S211 as keys. Attribute information (name: Denden Taro, phone number: 03-1111-1111) is acquired from the storage unit 21.

  In step S213, the communication unit 23 of the information holding server 20-1 uses the attribute information acquired in step S212 (name: Denden Taro, date of birth: 2000/01/01) via the network 50 as the information holding management server. 10 communication units 17. Further, the communication unit 23 of the information holding server 20-2 communicates the attribute information (name: Denden Taro, phone number: 03-1111-1111) acquired in step S212 with the information holding management server 10 via the network 50. To the unit 17.

  In step S214, the communication unit 17 of the information holding management server 10 transmits the attribute information (name: Denden Taro, date of birth: 2000/01/01) from the communication unit 23 of the information holding server 20-1 via the network 50. Receive. In addition, the communication unit 17 of the information holding management server 10 receives attribute information (name: Denden Taro, phone number: 03-1111-1111) from the communication unit 23 of the information holding server 20-2 via the network 50. .

  In step S215, the communication unit 17 of the information holding management server 10 transmits the attribute information (name: Denden Taro, date of birth: 2000/01/01, telephone number: 03-1111-1111) acquired in step S214 to the network. 50 to the information utilization server 30.

  In step S216, the information utilization server 30 transmits the attribute information (name: Denden Taro, date of birth: 2000/01/01, telephone number: 03-1111) from the communication unit 17 of the information holding management server 10 via the network 50. -1111).

  In step S <b> 217, the service information generation unit 31 of the information utilization server 30 generates service information and transmits it to the user terminal 40 via the network 50.

  As described above, the attribute information disclosure control system 1 includes a plurality of information holding servers 20 that hold user attribute information of the user terminal 40 that uses the service provided from the information utilization server 30, and user attribute information. And the information possession management server 10 which acquires attribute information corresponding to the attribute item from the plurality of information possession servers 20 and transmits the attribute information to the information utilization server 30. Then, the information holding management server 10 calculates the importance for each combination of attribute items, and the combination generation unit 15 that generates a combination of attribute items that satisfy the condition of the attribute items requested by the information utilization server 30. The importance level / authentication level determination unit 16 that determines the authentication level in accordance with the attribute item and generates the attribute item consent request screen according to the combination of the attribute items and the authentication level, and the attribute item consent request screen to the user terminal 40 Transmission, reception of attribute items permitted by the user from the user terminal 40, reception of attribute information corresponding to the attribute items permitted by the user from the information holding server 20, and information utilization server 30 of the received attribute information And a communication unit 17 that performs transmission to the network. Therefore, according to the attribute information disclosure control system 1, the security level can be changed according to the importance calculated by the importance / authentication level determination unit 16.

  Further, the importance / authentication level determination unit 16 generates the attribute item consent request screen according to the combination of attribute items having the smallest calculated importance and the authentication level corresponding to the smallest importance, Disclosure of highly important attribute information can be avoided.

  Although the above embodiment has been described as a representative example, it will be apparent to those skilled in the art that many changes and substitutions can be made within the spirit and scope of the invention. Therefore, the present invention should not be construed as being limited by the above-described embodiments, and various modifications and changes can be made without departing from the scope of the claims.

DESCRIPTION OF SYMBOLS 1 Attribute information disclosure control system 10 Information holding management server 11 Service management information storage part 12 Information holding server management information storage part 13 Importance management information storage part 14 Resource management part 15 Combination generation part 16 Importance / authentication level determination part 17 Communication Units 20-1, 20-2 Information holding server 21 User attribute information storage unit 22 Attribute information acquisition unit 23 Communication unit 30 Information utilization server 31 Service information generation unit 32 Control unit 33 Communication unit 40 User terminal 41 Input / output unit 42 Control unit 43 Communication unit 50 Network

Claims (6)

A plurality of information holding servers that hold user attribute information of user terminals that use services provided by the information utilization server, and attribute items of the user attribute information, and the plurality of information holding servers An attribute information disclosure control system comprising: an information holding management server that acquires attribute information corresponding to an attribute item and transmits the attribute information to the information utilization server,
The information holding management server
A combination generation unit that generates a combination of attribute items that satisfy the condition of the attribute item requested by the information utilization server;
The importance is calculated for each combination of the attribute items, and the authentication level required when the user permits the disclosure of the attribute information is determined according to the importance, the combination of the attribute items and the authentication level The importance / authentication level determination unit that generates an attribute item consent request screen for confirming whether or not to disclose to the user whether or not the attribute item is disclosed,
Transmission of the attribute item consent request screen to the user terminal, reception of an attribute item permitted by the user from the user terminal, attribute information corresponding to the attribute item permitted by the user from the information holding server And a communication unit that transmits the received attribute information to the information utilization server,
The information holding server includes a communication unit that transmits attribute information corresponding to an attribute item permitted by the user to the information holding management server.   The importance / authentication level determination unit generates the attribute item consent request screen according to a combination of attribute items having the smallest calculated importance and an authentication level corresponding to the smallest importance. The attribute information disclosure control system according to claim 1, wherein the attribute information is disclosed. The information holding management server uniquely indicates a service ID uniquely indicating a service content provided by the information utilization server and an information holding server holding attribute information necessary for a service specified by the service ID. A service management information storage unit that stores service management information including an information holding server ID and necessary attribute items necessary for executing the service;
Information holding server management information including the information holding server ID, a user ID uniquely indicating the user, and attribute items of attribute information held in the information holding server specified by the information holding server ID An information holding server management information storage unit for storing
The combination generation unit acquires a required attribute item from the service management information storage unit using a service ID as a key, and combines the attribute items satisfying the necessary attribute item as an information holding server ID as the key. The attribute information disclosure control system according to claim 1 or 2, wherein the attribute information is generated using an attribute item acquired from the management information storage unit. The information holding management server includes importance calculation information which is information necessary for calculating importance of a combination of a plurality of attribute information, and importance authentication level information indicating an authentication level according to the importance. An importance management information storage unit is provided for storing,
The importance / authentication level determination unit calculates importance based on importance calculation information stored in the importance management information storage unit, and importance authentication level information stored in the importance management information storage unit The attribute information disclosure control system according to claim 1, wherein an authentication level corresponding to the calculated importance is determined. The attribute information corresponding to the attribute item is obtained from multiple information holding servers that hold the attribute information of the user attribute information and the user terminal user information that uses the service provided by the information utilization server. An information holding management server that acquires and transmits the attribute information to the information utilization server,
A combination generation unit that generates a combination of attribute items that satisfy the condition of the attribute item requested by the information utilization server;
The importance is calculated for each combination of the attribute items, and the authentication level required when the user permits the disclosure of the attribute information is determined according to the importance, the combination of the attribute items and the authentication level The importance / authentication level determination unit that generates an attribute item consent request screen for confirming whether or not to disclose to the user whether or not the attribute item is disclosed,
Transmission of the attribute item consent request screen to the user terminal, reception of an attribute item permitted by the user from the user terminal, attribute information corresponding to the attribute item permitted by the user from the information holding server And a communication unit that transmits the received attribute information to the information utilization server;
An information possession management server comprising: A plurality of information holding servers that hold user attribute information of user terminals that use services provided by the information utilization server, and attribute items of the user attribute information, and the plurality of information holding servers An attribute information disclosure control method for controlling the disclosure of attribute information in an attribute information disclosure control system comprising: an information possession management server that acquires attribute information corresponding to an attribute item and transmits the attribute information to the information utilization server. ,
A step of generating a combination of attribute items that satisfy the condition of the attribute item requested by the information utilization server by using the attribute item corresponding to the attribute information held by the plurality of information holding servers by the information holding management server; When,
Calculating an importance level for each combination of the attribute items by the information holding management server, and determining an authentication level required when a user permits disclosure of attribute information according to the importance level;
A step of generating an attribute item consent request screen for confirming consent of whether or not to disclose the attribute item to the user according to the combination of the attribute items and the authentication level by the information holding management server;
Sending the attribute item consent request screen to the user terminal by the information holding management server;
Receiving the attribute items permitted by the user from the user terminal by the information holding management server;
Sending the attribute information corresponding to the attribute item permitted by the user to the information holding management server by the information holding server;
Sending the attribute information received from the information holding server to the information utilization server by the information holding management server;
An attribute information disclosure control method comprising:

Images