JP2014238642A - Personal information protection apparatus, personal information protection system, personal information protection method, and program - Google Patents

Abstract

PROBLEM TO BE SOLVED: To make it possible to make selection as to whether to individually encrypt a plurality of pieces personal information included in image data.SOLUTION: A personal information protection apparatus 1 protecting a plurality of pieces of personal information included in image data, comprises: an image processing unit 21 dividing the image data into regions including the personal information, respectively; a protection pattern request unit (screen data generation unit 22) causing a user to enter selection of a protection pattern as to whether to encrypt personal information region data (divided image data, OCR data) related to the divided image data; and a personal information processing unit (registration processing unit 24) encrypting the personal information region data if the enter of selection is the protection pattern for encrypting.

Description

  The present invention relates to a personal information protection device, a personal information protection system, a personal information protection method, and a program, and more particularly to a personal information protection device, a personal information protection system, a personal information protection method, and a personal information protection system for managing personal information provided by a user. Regarding the program.

Conventionally, a user is required to confirm the identity of a user at a financial institution to open a new account or make a large transaction. At this time, the user was requested by the administrator (the person in charge at the window) to present an identification card such as a driver's license, passport or health insurance card. Then, the user provided personal information included in the identification card as requested, and left the administrator to manage the personal information.
However, even if the administrator has a system for strictly managing this personal information, not only the outside person who has taken a fault in the system but also the inside of the personal information by a malicious person (intentional) It may leak out. In this case, there was no means for users to defend themselves.
Then, even if personal information leaked, the apparatus which a user can defend himself / herself so that an external person may not know personal information was proposed (patent documents 1-4).

  Patent Document 1 describes a technique for displaying a masked part of a form according to a security level. In this technology, a user (general user) who provides personal information performs a masking process by enclosing a portion of the form image where the personal information is described with a rectangular area, and sets a security level in the masking area. To do. Then, the client PC transmits the form data including the masking area and provides it to the administrator.

  Patent Document 2 describes a technique for controlling the disclosure level according to the type of personal information when registering personal information. In this technology, for example, the user (information provider) sets the disclosure level (usable level) for personal information such as name, address, age, gender, telephone number, final education, family structure, workplace, and annual income. To do. As a result, the manager (information provider) can browse only the personal information of the disclosure level permitted by the manager ([0041]-[0044]).

  Patent Document 3 describes a technique for masking and storing image data such as a driver's license. This technique is capable of automatically performing masking image processing in which a region at a corresponding position in an image file is painted black in a rectangle based on corrected masking position information in a database ([0035], [0037). ]).

  Patent Document 4 describes a technique for allowing a user to select whether or not to mask the personal information portion of image data. In this technology, when masking image data such as a driver's license and storing it, it is possible to select whether or not to mask the personal information item included in the image data, The personal information masked is managed ([0039]).

JP 2006-189933 A JP 2002-297598 A JP 2009-223716 A Japanese Patent Laid-Open No. 2007-074088

  Thus, the personal information provided by the user includes personal information that is necessary only at the time of identity verification. For example, when opening a bank account, among the personal information provided by the user, the name, date of birth, etc. are personal information necessary to identify the person each time a transaction is made and correspond to mandatory registration information To do. On the other hand, an address, a photograph, and the like are personal information that is necessary only at the time of identity verification, and correspond to arbitrary registration information.

After the identity verification, the administrator processes these optional registration information so that it cannot be read by masking (Patent Documents 3 and 4), or deletes it. Can be avoided. The administrator can reduce the risk of managing personal information.
However, when it is necessary to verify the identity again, the administrator has to request the user to re-present the identification card. For this reason, there are cases where it is better to store the information without deleting it even if it is voluntary registration information that is only needed at the time of identity verification. As long as the information is acquired and stored, the administrator must strictly manage it. did not become.
As described above, among the personal information provided by the user, the optional registration information that is necessary only at the time of identity verification has a problem that it is difficult for an administrator to handle.

  The present invention has been made to solve the above-described problems, and protects personal information that can be selected as to whether or not to individually encrypt a plurality of personal information included in image data. It is an object to provide an apparatus, a personal information protection system, a personal information protection method, and a program.

  In order to solve the above problems, a personal information protection device according to the present invention is a personal information protection device (1) for protecting a plurality of personal information included in image data, wherein the image data is stored in each of the personal information. And a protection pattern for selecting whether or not to encrypt personal information area data (divided image data, OCR data) related to each divided image data. A configuration comprising a protection pattern request unit (screen data generation unit 22) and a personal information processing unit (registration processing unit 24) that encrypts the personal information area data when the selection input is a protection pattern to be encrypted. It was. In addition, the code | symbol and character in () are illustrations.

  According to this, image data of a medium on which a plurality of personal information is written is input, and whether or not to individually encrypt a plurality of personal information included in the image data is selected. Can do. That is, the encrypted personal information can be saved or deleted according to the user's request. In addition, a password can be selectively set according to the user's request.

  According to the present invention, it is possible to select whether or not to individually encrypt a plurality of personal information included in image data.

It is a lineblock diagram of the personal information management system concerning a 1st embodiment. It is a figure which shows an example of the personal information acquisition area | region table of a driver's license. It is a figure of a driver's license. It is a block diagram of the personal information protection apparatus of 1st Embodiment. It is a figure which shows an example of the intention confirmation screen about the personal information of a driver's license. It is a figure which shows an example of the driver's license image after a cut-out process, (b) the cut-out image of d3 (address), and (c) the cut-out image of d5 (face photograph). It is a flowchart which shows the process sequence performed with the personal information management system which concerns on 1st Embodiment. It is a flowchart which shows the process sequence performed with the personal information management system which concerns on 1st Embodiment. (Continued from FIG. 7). It is a block diagram of the personal information management system which concerns on 2nd Embodiment. It is a block diagram of the personal information protection apparatus of 2nd Embodiment. It is a flowchart which shows the process sequence performed with the personal information management system which concerns on 2nd Embodiment. It is a flowchart which shows the process sequence performed with the personal information management system which concerns on 2nd Embodiment (continuation of FIG. 11). It is a block diagram of the personal information management system which concerns on 3rd Embodiment. It is a block diagram of the personal information protection apparatus of 3rd Embodiment. It is a flowchart which shows the process sequence performed with the personal information management system which concerns on 3rd Embodiment.

  Hereinafter, an embodiment of the present invention (hereinafter referred to as “the present embodiment”) will be described in detail with reference to the drawings. Each figure is only schematically showing the present invention. Therefore, the present invention is not limited to the illustrated example. Moreover, in each figure, the same code | symbol is attached | subjected about the common component and the same component, and those overlapping description is abbreviate | omitted.

<< First Embodiment >>
A personal information management system according to the first embodiment shown in FIG. 1 will be described.
In the personal information management system 10 according to the first embodiment, at a store such as a bank, the user submits an identification card necessary for verifying the identity and documents filled in a predetermined description item to the window. It is configured. The person in charge of the window confirms the identity of the user by using the identification card and documents, and then accesses the personal information protection device 1 using the PC 5 to perform the registration process of the user as personal information as a server. It is to let the protective device 1 do it.

  The personal information management system 10 includes a personal information protection device 1, an image reading unit 2, a display unit 3, an input unit 4, a PC 5 (information processing device), a network N, a personal information DB server 61, and an encryption. The image data management server 62 and the identification certificate DB server 63 are provided. The personal information protection device 1, personal information DB server 61, encrypted image management server 62, and ID card DB server 63 are connected via a network N so that they can communicate with each other.

Here, the PC 5, the image reading unit 2, the display unit 3, the input unit 4, and the personal information protection device 1 are installed in a store such as a bank, and an identification DB server 63 and a personal information DB server. 61 and the encrypted image management server 62 are installed in a data center where a bank collectively manages data.
The personal information of the user obtained by the registration process of the user that the PC 5 accesses the personal information protection device 1 via a wired / wireless LAN (Local Area Network) and causes the personal information protection device 1 to perform Managed by the DB server 61 and the encrypted image management server 62.

(Personal information DB server 61)
In the personal information DB server 61, the personal information protection apparatus 1 performs the user registration process, and the personal information related to the user obtained by the process is recorded.

(Encrypted image management server 62)
The encrypted image management server 62 records the encrypted image data obtained by encrypting the image data relating to the user obtained by the personal information protection apparatus 1 performing the user registration process. . The encrypted image data recorded at this time is recorded in association with the personal information of the same person recorded in the personal information DB server 61. Also, a decryption key (password) for decrypting the encrypted image data is recorded in association with it.

(ID card DB server 63)
The identification DB server 63 includes a personal information acquisition area table 31 shown in FIG.
This identification DB server 63 supports not only driver's licenses but also identification cards such as passports, basic resident register cards, health insurance insured cards, alien registration certificates, and copies of resident cards. A personal information acquisition area table 31 is prepared in advance.

  The personal information management system 10 can also include the personal information acquisition area table 31 in the personal information protection device 1 without having the identification DB server 63. However, for example, the health insurance insured card and the resident's card issued by the municipalities are different for each municipality, so a very large number of personal information acquisition area tables 31 are required. For this reason, it is preferable to centrally manage the personal information acquisition area table 31 using the identification DB server 63 commonly used for the personal information protection apparatus 1 installed at each branch.

  Further, the identification DB server 63 stores images and fixed phrases displayed on the intention confirmation screen (FIG. 5). Further, the identification DB server 63 stores information on the personal information to be acquired included in the identification certificate, as in the personal information acquisition area table 31 described later, for each type of identification certificate. For example, as shown on the intention confirmation screen (FIG. 5), the acquisition target personal information included in the identification card is required registration information or optional registration information (intention confirmation target information). Character information of “use purpose” and “when necessary” is stored.

(Personal information acquisition area table 31)
The personal information acquisition area table 31 of the driver's license will be described with reference to FIGS.
In the case of the driver's license shown in FIG. 3, the personal information acquisition area table 31 acquires the name (d1), date of birth (d2), address (d3), license number (d4), and face photo (d5). It is set as the target personal information.
For example, as shown in FIG. 2, the personal information acquisition area table 31 describes extraction areas of personal information to be acquired. The form ID indicates the type of identification card, and “1234” corresponds to the driver's license. The area data ID indicates the extraction area of personal information to be acquired. “01” is the name (d1), “02” is the date of birth (d2), “03” is the address (d3), “04” "Corresponds to the license number (d4), and" 05 "corresponds to the face photograph (d5). The X coordinate and the Y coordinate are relative coordinates from a predetermined position (origin) in the driver's license. The horizontal width and the vertical width are distances from points indicated by the X coordinate and the Y coordinate. The range of the extraction region is uniquely determined by these X coordinate, Y coordinate, horizontal width, and vertical width.

(Network N)
The network N is a computer network that is interconnected using an Internet Protocol technology via, for example, a wired / wireless LAN (Local Area Network) or a WAN (Wide Area Network). In addition to the LAN, ZigBee (registered trademark), Bluetooth (registered trademark), or the like may be used.

(PC5)
The PC 5 is a general computer provided with a browser and a scanner driver, and accesses the personal information protection device 1 via a wired / wireless LAN to transmit / receive data. For example, the image data received from the personal information protection device 1 is displayed on the display unit 3, the image read by the image reading unit 2 is transmitted as image data to the personal information protection device 1, or the person in charge of the window inputs The input data input to the unit 4 is transmitted to the personal information protection device 1.

(Peripheral device)
The image reading unit 2 is a component that reads an image from the surface of a medium placed on the reading surface, and is, for example, a scanner.
The display unit 3 is a component that displays information visible to the user, and is, for example, an LCD (Liquid Crystal Display) or a display.
The input unit 4 is a component that receives a request from a user, and is, for example, a keyboard or a mouse.
Here, for example, the display unit 3 and the input unit 4 may be a touch panel having both a display function such as an LCD and a position input function such as a touch pad.

(Personal information protection device 1)
As shown in FIG. 4, the personal information protection device 1 includes a control unit 20, a storage unit 30, and an I / F unit 40. The personal information protection device 1 is connected to the PC 5 (FIG. 1) via the I / F unit 40 and the LAN. Connected to enable input / output.

(Control unit 20)
The control unit 20 is configured by, for example, a CPU (Central Processing Unit). The control unit 20 (CPU) develops and executes a program stored in the storage unit 30. Thereby, the control unit 20 functions as an image processing unit 21, a screen data generation unit 22, an input data processing unit 23, a registration processing unit 24, and a communication control unit 25. Details of each function will be described later.

(Storage unit 30)
The storage unit 30 is a component that stores data and programs.

(I / F part 40)
The I / F unit 40 is an interface connected to an external device, and includes a communication unit 41.
The communication unit 41 is an interface connected to the network N, and is controlled by a communication control unit 25 described later, so that a personal information DB server 61 (FIG. 1), an encrypted image management server 62 (FIG. 1), and an identification DB This is a component that is communicably connected to the server 63 (FIG. 1) and transmits and receives data.

(Function of the control unit 20)
Here, functions realized by the control unit 20 (image processing unit 21, screen data generation unit 22, input data processing unit 23, registration processing unit 24, and communication control unit 25) will be described.

(Image processing unit 21)
The image processing unit 21 receives image data (image read by the image reading unit 2) from the PC 5, and executes image analysis processing, image pattern recognition processing, character recognition processing, and image cutout processing.
First, the image processing unit 21 analyzes image data (image analysis processing), and determines an image pattern from the analysis result (image pattern recognition processing). At this time, if the image pattern is a driver's license, the image processing unit 21 accesses the identification DB server 63 via the communication control unit 25 to obtain the personal information acquisition area table 31 of the driver's license (see FIG. Refer to 2). The image processing unit 21 performs character recognition processing on the range of the predetermined area obtained from the personal information acquisition area table 31 of the driver's license for the image of the image data, and from the range of the predetermined area in the image of the image data Get character data. Furthermore, if the information obtained from the predetermined area is arbitrary registration information (intention confirmation target information), the image processing unit 21 cuts out the range of the predetermined area from the image and extracts a cut image (personal information area data; divided image data). Is acquired (image clipping process).

  Here, the image processing unit 21 accesses the identification DB server 63 via the communication control unit 25 in advance, acquires the personal information acquisition area table 31, and temporarily stores it in the storage unit 30. May be. Thereby, the image processing unit 21 may refer to the personal information acquisition area table 31 stored in the storage unit 30.

  Here, the image pattern recognition process performed by the image processing unit 21 may use image pattern information transmitted from the PC 3. For example, the type of identification card submitted by the user (for example, driver's license) may be transmitted by the person in charge of the window operating the PC 5.

(Screen data generation unit 22)
The screen data generation unit 22 generates screen data displayed on the PC 5 (display unit 3) so as to be visible to the user. The screen data generation unit 22 generates an image (FIG. 5) on the PC 5 (display unit 3) and generates a file having a function of inputting information on the PC 5 (input unit 4). 3) has the function of transmitting.
In the present embodiment, the screen data generation unit 22 acquires an image or a fixed sentence from the storage unit 30 according to the processing result of the image processing unit 21, and sends the character obtained by the character recognition process to the user. Screen data for confirming typographical errors and the like of data and screen data for prompting selection of correspondence (deletion / encryption) of arbitrary registration information are generated.

  For example, when the image pattern is a driver's license as a result of processing by the image processor 21, the screen data generator 22 accesses the identification DB server 63 via the communication controller 25 to obtain a driver's license. Acquire (download) images and fixed phrases that compose the confirmation screen for the testimony. And the screen data generation part 22 produces | generates the screen data of the intention confirmation screen about the personal information of the driver's license shown in FIG. 5 using the acquired image and a fixed phrase.

  Here, the image processing unit 21 accesses the identification DB server 63 via the communication control unit 25 in advance to acquire the personal information acquisition area table 31, and also displays an image displayed on the intention confirmation screen and a fixed form. The sentence may be downloaded and stored in the storage unit 30. Thereby, the screen data generation part 22 can acquire the image and fixed form sentence which were memorize | stored in the memory | storage part 30, and can produce | generate the screen data of an intention confirmation screen.

The will confirmation screen shown in FIG. 5 will be described.
Here, the personal information of the driver's license includes a name (d1), a date of birth (d2), an address (d3), a license number (d4), and a face photograph (d5). Among them, essential registration information is a name and date of birth, and optional registration information (intention confirmation target information) is an address, a license number, and a face photo. Since the mandatory registration information is information that must be registered, "cannot be selected because it is necessary information" is displayed in the intention confirmation column, and [Delete] or [Encryption] cannot be selected. On the other hand, the arbitrary registration information is left to the user to make a registration decision, and [Delete] or [Encryption] can be selected in the intention confirmation column. When [Encryption] is selected, a password (decryption key) can be input. For example, in FIG. 5, [Encryption] is selected as the address, and the password is input. [Encryption] is selected for the face photo, “Please enter” is displayed in the password input field, and the password can be entered. On the other hand, the license number is in a state where [Delete] is selected.

(Input data processing unit 23)
The input data processing unit 23 receives an input or instruction from the PC 5 (input unit 4).
The input data processing unit 23 receives the update (registration) instruction from the PC 5 (input unit 4), the screen data information displayed on the PC 5 (display unit 3) from the screen data generation unit 22, and the PC 5 ( The input data from the input unit 4) is acquired in association with each other, and the input data is output to the registration processing unit 24.

(Registration processing unit 24)
The registration processing unit 24 deletes or encrypts arbitrary registration information (personal information not required at the time of authentication) of personal information in response to a user request.
The registration processing unit 24 acquires “intention confirmation information” selected for the cut-out image (optional registration information) from the input data. If the intention confirmation information is [Delete], the clipped image is deleted. On the other hand, if the intention confirmation information is [encryption], the clipped image is encrypted (encrypted clipped image data). Then, the data is stored in the encrypted image management server 62 in association with the password (decryption key) set (input) for the clipped image.
At this time, in order to reduce the risk of data leakage, the encrypted cut-out image data and the decryption key may be stored in separate devices instead of the single encrypted image management server 62.

(Communication control unit 25)
The communication control unit 25 is a component that controls the communication unit 41 to transmit / receive data to / from the PC 5, the personal information DB server 61, the encrypted image management server 62, and the identification DB server 63.

(Example)
The procedure performed in the personal information management system according to the first embodiment will be described using the flowcharts shown in FIGS. 7 to 8 (refer to FIGS. 1 to 6 as appropriate).
(User procedure)
First, the user fills in the necessary items on the document (step S101). This necessary item includes an item for confirming the intention of handling personal information. Select [Delete] or [Encrypt] and enter it. For the optional registration information for which [Encryption] is selected, the password (decryption key) written together is also entered. That is, not only the selection input of [Delete] or [Encryption] but also the selection of a password (decryption key) of personal information is left to the user's intention. In other words, the user can change the password of the personal information to another password without making it the same as the account password.
Then, the user submits the identification card and documents to the window (the person in charge of the window (FIG. 1)) (step S102).

(Operation of PC5)
The person in charge of the window receives the submitted ID card (original) and documents, and uses them to confirm the identity of the user (step S103). If there is no deficiency in the description of the document, the person in charge of the counter accesses the personal information protection device 1 using the PC 5 and starts the registration work.
First, the person in charge of the counter places the identification card on the reading surface of the scanner (image reading unit 2), and causes the scanner to read the image (step S104). At this time, on the PC 5 (display unit 3), an instruction image “Please place an ID card on the scanner” and an image of a “read start” button are displayed. The image reading unit 2 reads the identification card and outputs image data (step S105). The PC 5 transmits the image data input from the image reading unit 2 to the personal information protection device 1.

(Operation of personal information protection device 1)
The personal information protection device 1 outputs the image data received by the communication unit 41 from the PC 5 to the image processing unit 21.
First, the image processing unit 21 analyzes an image of the image data (image acquired from the image reading unit 2) (step S106: image analysis processing), and determines an image pattern from the analysis result (step S107: image pattern recognition processing). ). Next, the image processing unit 21 performs character recognition processing on a range of a predetermined area described in the personal information acquisition area table 31 based on the image pattern, and acquires character data from the image (step S108: character recognition processing). ). Further, if the information obtained from the predetermined area is arbitrary registration information (intention confirmation target information), the image processing unit 21 cuts out the range of the predetermined area from the image and divides it into one or a plurality of cut-out images (divided into a plurality of pieces). Obtained divided images) (step S109: image cutout process).

  The screen data generation unit 22 acquires an image or a fixed phrase from the storage unit 30 according to the processing result of the image processing unit 21, and typographical error of the character data obtained by the character recognition process to the counter person in charge. Screen data for confirming the above, and screen data for prompting selection of correspondence (deletion / encryption) of arbitrary registration information are generated (step S110). Then, the communication control unit 25 transmits screen data to the PC 5 via the communication unit 41.

(Operation of PC5)
The PC 5 displays the screen data received from the personal information protection device 1 on the display unit 3.
The person in charge of the window inputs data via the input unit 4 while viewing the screen of the display unit 3 based on the contents described in the document (step S111). At this time, the intention confirmation screen (FIG. 5) displayed on the screen includes an item for confirming the intention of handling arbitrary registration information (intention confirmation target information). Select [Enter]. In addition, the person in charge of the window also inputs the decryption key described in the document together with the intention confirmation for the optional registration information for which [Encryption] is selected.

  When the contact person presses a registration button (not shown) displayed on the screen, the input data processing unit 23 receives an update (registration) instruction from the input unit 4, and the PC 5 receives the input data from the personal information protection device 1. Send to.

(Operation of personal information protection device 1)
The personal information protection device 1 outputs the input data received by the communication unit 41 from the PC 5 to the input data processing unit 23. Thereby, the input data processing unit 23 acquires the input data (step S112).

  The registration processing unit 24 receives character data recognized by the image processing unit 21 (obtained in step S108) and a cut-out image (obtained in step S109), and input data (obtained in step S112) from the input data processing unit 23. Obtain (step S113).

  First, the registration processing unit 24 processes the character data corresponding to the essential registration information into data (personal information DB server registration data) that can be registered in the personal information DB server 61 (step S114, FIG. 8). Here, the name (d1) and the date of birth (d2) are associated with each other.

Next, the registration processing unit 24 processes the character data and the cutout image corresponding to the arbitrary registration information based on the intention confirmation information included in the input data.
First, any one of the arbitrary registration information is acquired (step S115), and the “intention confirmation information” selected for the arbitrary registration information is determined (step S116).
If the intention confirmation information is [delete] (step S116, delete), the registration processing unit 24 deletes the clipped image (step S117).

On the other hand, if the intention confirmation information is [encryption] (step S116, encryption), the registration processing unit 24 can decrypt with the password (decryption key) set (input) for the clipped image. The cutout image is encrypted to generate encrypted cutout image data (step S118).
The registration processing unit 24 associates the encrypted clipped image data with a password (decryption key) for decrypting the encrypted clipped image data (step S119).

And the registration process part 24 determines whether there exists any other arbitrary registration information which can be acquired from input data (step S120).
If there are others (step S120, there is), the registration processing unit 24 acquires one of them (step S121) and performs the process of step S116.

  On the other hand, if there is no other (No in step S120), the registration processing unit 24 can manage the encrypted image management server 62 by setting the encrypted clipped image data generated in step S117 and its decryption key as a set. Data is processed (step S122). (Encrypted clipped image data and decryption key)

  Furthermore, the registration processing unit 24 further associates the encrypted clipped image data and decryption key arbitrary registration information associated in step S119 with the essential registration information associated in step S114, and the encrypted image management server 62 manages them. It is processed into possible data (encrypted image management server registration data) (step S123).

  Then, the communication control unit 25 controls the communication unit 41 to transmit the personal information DB server registration data to the personal information DB server 61, and the encrypted cut image data, the decryption key, and the encrypted image management server registration data. Are transmitted to the encrypted image management server 62 (step S124).

  As described above, as shown in FIG. 5, the person in charge selects [Encryption] for the personal information “address” and “face photo”, and [Delete] for the personal information “license number”. 3, the driver's license image shown in FIG. 3 is processed so that the address (d3), the license number (d4), and the face photograph (d5) are blacked out as shown in FIG. 6 (a). The Of these blacked out information, the license number (d4) whose intention confirmation information is [deleted] is deleted. On the other hand, for the address (d3) and face photograph (d5) whose intention confirmation information was [encrypted], the area set in the personal information acquisition area table 31 (FIG. 2) is cut out from the image of the driver's license. (Crop image). 6B is a cut-out image of the address (d3), and FIG. 6C is a cut-out image of the face photograph (d5). These clipped images are encrypted with the password (decryption key) input on the intention confirmation screen shown in FIG.

  According to the present embodiment, personal information that is not required at the time of authentication can be deleted or encrypted after authentication according to a user's request, so that it is difficult to specify an individual. Can provide a high system. For example, even if personal information is leaked for some reason, it is difficult to decipher information that can be decrypted with a password set by the user, and the deleted information cannot be acquired. For this reason, it is difficult to identify an individual from the leaked information.

  The personal information of the driver's name (d1) and date of birth (d2) cannot be deleted / encrypted because it is mandatory registration information. However, the address (d3), license number (d4), face The personal information of the photograph (d5) can be selected and input for deletion / encryption because it is optional registration information (intention confirmation target information). That is, it can be set to either deletion or encryption according to the authentication level of the personal information.

<< Second Embodiment >>
A personal information management system according to the second embodiment shown in FIG. 9 will be described.
In the personal information management system 10A according to the second embodiment, the user himself / herself accesses the personal information protection device 1A using the PC 115 via the Internet line (network N), and performs personal registration processing. This is to cause the information protection apparatus 1A to perform.
The personal information management system 10A according to the second embodiment uses a copy of an identification card necessary for user identification and a document (in which an e-mail address is entered) in which a user has been entered in advance as an office center. The person in charge of office work input at the work center prepares to perform registration processing.

(Personal information management system 10A)
The personal information management system 10A includes a device (PC 105, image reading unit 2, display unit 103, and input unit 104) installed in an office center and a user-owned device (PC 115, display unit 113, and input unit 114). A personal information DB server 61, an encrypted image management server 62, an identification card DB server 63, and a WEB server 64 (personal information protection apparatus 1A).
PC 105, PC 115, personal information DB server 61, encrypted image management server 62, identification DB server 63, and WEB server 64 (personal information protection apparatus 1A) can communicate with each other via network N. It is connected.

The personal information management system 10A is configured such that the PC 115 accesses WEB data in the WEB server 64 and causes the WEB server 64 (personal information protection apparatus 1A) to perform user registration processing. The personal information of the user thus obtained is managed by the personal information DB server 61 and the encrypted image management server 62.
Each configuration will be briefly described below. Since the structure with the same code | symbol of 1st Embodiment is the same function, description is abbreviate | omitted for convenience.

[Office Center]
In the office center, an image reading unit 2, a display unit 103, an input unit 104, and a PC 105 as a registration preparation terminal are installed. The person in charge of office work operates the PC 105 to transmit the entire image of the copy of the identification document read by the image reading unit 2 to the WEB server 64 via the network N.

[User side]
The user operates the PC 115 to access the WEB data uploaded by the WEB server 64 (personal information protection apparatus 1A). Thereby, the intention confirmation screen shown in FIG. 5 is displayed. This WEB data is, for example, HTML data.
The user selects and inputs [Delete] or [Encryption] for handling of arbitrarily registered information (intention confirmation target information) while viewing the WEB data (intention confirmation screen).

(Personal information protection device 1A)
As shown in FIG. 10, the personal information protection apparatus 1A includes a control unit 20A, a storage unit 30A, and an I / F unit 40, and inputs / outputs to / from the PC 105 and PC 115 via the I / F unit 40 and the network N. Connected as possible.

(Control unit 20A)
The control unit 20A functions as an image processing unit 21, a WEB data generation unit 22A, an input data processing unit 23, a registration processing unit 24, and a communication control unit 25A.
The WEB data generation unit 22A acquires an image or a fixed sentence from the storage unit 30A according to the processing result of the image processing unit 21, and gives the user typographical error of the character data obtained by the character recognition processing. WEB data to be confirmed and WEB data for prompting selection of correspondence (deletion / encryption) of arbitrary registration information are generated.
The communication control unit 25A outputs the entire image of the copy of the identification card received from the PC 105 as the registration preparation terminal to the image processing unit 21. Further, the communication control unit 25A notifies the PC 115 of the URL that can access the WEB data generated by the WEB data generation unit 22A by mail.

(Storage unit 30A)
The storage unit 30A is a component that stores data and programs. In the second embodiment, the storage unit 30A stores a program that enables transmission / reception of mail executed by the communication control unit 25A.

(I / F part 40)
The I / F unit 40 is an interface connected to an external device, and includes a communication unit 41.
The communication unit 41 is an interface connected to the network N, and is controlled by a communication control unit 25 described later, so that a personal information DB server 61 (FIG. 1), an encrypted image management server 62 (FIG. 1), and an identification DB This is a component that is communicably connected to the server 63 (FIG. 1) and transmits and receives data.

(Example)
The procedure performed in the personal information management system according to the second embodiment will be described using the flowcharts shown in FIGS. 11 to 12 (refer to FIGS. 1 to 6 and FIGS. 8 to 10 as appropriate).

  First, the user mails a document in which necessary information such as an e-mail address is entered and a copy of the identification card to the office center (step S201). Necessary items of this document are items necessary for preparation for performing registration processing performed at the business center. For example, since a web address for accessing a registration site (WEB) is sent from the office center by e-mail, there is an item for entering the e-mail address. In addition, there are items for entering a signature as proof of identity verification. On the other hand, in the personal information management system 10 according to the first embodiment, there is no item (see step S101 in FIG. 7) for confirming the intention of handling personal information in which necessary items are entered in the document.

(Operation of Registration Preparation Terminal 105)
In the office center, the office input person opens the mail, and obtains a document and a copy of the identification card.
First, the person in charge of office work places a copy of the identification card on the reading surface of the scanner (image reading unit 2) to read the image (step S202). The image reading unit 2 reads a copy of the identification card and generates image data (step S203). Next, the office worker in charge operates the PC 105 as the registration preparation terminal, and transmits the image data of the read image and the user's mail address to the personal information protection apparatus 1A.

(Operation of personal information protection device 1)
The personal information protection device 1 outputs the image data received by the communication unit 41 from the registration preparation terminal 105 to the image processing unit 21.
First, the image processing unit 21 analyzes an image of the image data (image acquired from the image reading unit 2) (step S211: image analysis processing), and determines an image pattern from the analysis result (step S212: image pattern recognition processing). ). Next, the image processing unit 21 performs character recognition processing on a range of a predetermined area described in the personal information acquisition area table 31 based on the image pattern, and acquires character data from the image (step S213: character recognition processing). ). Further, if the information obtained from the predetermined area is arbitrary registration information (intention confirmation target information), the image processing unit 21 cuts out the range of the predetermined area from the image and obtains a cut image (step S214: image cutting process). ).

  The screen data generation unit 22 acquires an image or a fixed sentence from the storage unit 30 according to the processing result of the image processing unit 21, and gives the user a typographical error in the character data obtained by the character recognition process. WEB data for prompting selection of the screen data for confirming the selection and the correspondence (deletion / encryption) of the arbitrary registration information is generated (step S215). Then, the screen data generation unit 22 causes the communication control unit 25 to upload the WEB data and make the WEB data accessible using the Internet line (network N) (step S216).

  Next, the communication control unit 25 creates an e-mail addressed to the user's e-mail address (PC 115) received from the registration preparation terminal 105. A URL that can access the uploaded WEB data is described in the body of the e-mail. Then, the communication control unit 25 transmits an e-mail to the PC 115 (step S217).

(Operation of PC115)
The user operates the PC 115 to receive an e-mail from the person in charge of office work (step S221, FIG. 12), and clicks the URL described in the text to access the WEB data (step S222). Thus, the WEB data is displayed on the screen of the display unit 113 (step S223). At this time, an intention confirmation screen (FIG. 5) is displayed.

The user inputs data via the input unit 4 while viewing the WEB data displayed on the screen of the PC 115 (step S224). At this time, the intention confirmation screen (FIG. 5) displayed on the screen includes an item for confirming the intention of handling arbitrary registration information (intention confirmation target information). The user can select [Delete] or [Encryption]. Select and enter. For the arbitrary registration information for which [Encryption] is selected, the decryption key written together is also input.
Thereafter, when the user presses a registration button (not shown) displayed on the screen, the PC 115 transmits the input data to the WEB server 64 (personal information protection apparatus 1A) (step S225).

(Operation of Personal Information Protection Device 1A)
The input data processing unit 23 of the personal information protection apparatus 1A (WEB server 64) receives an update (registration) instruction from the user via the communication control unit 25, and acquires input data (step S231). Then, the input data processing unit 23 outputs the input data to the registration processing unit 24.
As a result, the registration processing unit 24 acquires the character data recognized by the input data processing unit 23 (obtained in step S213), the cut-out image (obtained in step S214), and the input data (obtained in step S231). (Step S232).

  Since the subsequent processing is the same as steps S114 to S124 (FIG. 8) in the first embodiment, description of the processing is omitted.

<< Third Embodiment >>
A personal information management system according to the third embodiment shown in FIG. 13 will be described.
The personal information management system 10B according to the third embodiment is an automated transaction system that uses identification documents required for user identification and documents entered in predetermined items in an unmanned store such as a lending finance business. It is inserted into an automatic contract machine (personal information protection device 1B) as a device to perform user registration processing.

(Unmanned contract machine 9)
The unmanned contract machine 9 is a configuration unit including the personal information protection device 1 (1B), the image reading unit 2, the display unit 3, and the input unit 4 described in the first embodiment. Since the processing of each component is the same as that of the first embodiment, description thereof is omitted. As a result, the user himself / herself operates the unmanned contract machine 9 to cause the image reading unit 2 to read an image of a necessary document or while viewing the intention confirmation screen (FIG. 5) displayed on the display unit 3. About the handling of arbitrary registration information (intention confirmation target information) by operating the input unit 4, it is possible to select and input [Delete] or [Encryption].
Hereinafter, the I / F unit 40 included in the personal information protection device 1B will be briefly described. The other configurations having the same reference numerals in the first embodiment have the same functions, and thus the description thereof is omitted for the sake of convenience.

(I / F part 40)
The I / F unit 40 is an interface connected to an external device, and includes I / F units 42 to 44 in addition to the communication unit 41.
The I / F unit 42 is an interface connected to the image reading unit 2, and is a configuration unit that receives image data from the image reading unit 2 and outputs it to the control unit 20 (image processing unit 21).
The I / F unit 43 is an interface connected to the display unit 3, and is a configuration unit that receives screen data from the control unit 20 (screen data generation unit 22) and outputs the screen data to the display unit 3.
The I / F unit 44 is an interface connected to the input unit 4, and is a configuration unit that receives input data from the input unit 4 and outputs the input data to the control unit 20 (input data processing unit 23).

(Example)
The procedure performed in the personal information management system according to the first embodiment will be described with reference to the flowchart of FIG. 15 (refer to FIGS. 1 to 6, 8, and 13 to 14 as appropriate).

  First, the user enters necessary items in the document (step S301). Necessary items of this document are items necessary for preparation for the registration process. For example, an item for entering a signature as proof of identity verification. On the other hand, in the personal information management system 10 according to the first embodiment, there is no item (see step S101 in FIG. 7) for confirming the intention of handling personal information in which necessary items are entered in the document.

Next, the user puts the document into the slot of the unmanned contract machine 9 (step S302).
Thereby, the unmanned contract machine 9 causes the document to be read on the reading surface of the scanner (image reading unit 2). The image reading unit 2 reads a document to generate image data (step S303), and transmits the image data to the personal information protection apparatus 1.

(Operation of unmanned contract machine 9)
Similarly, the user puts the identification card into the slot of the unmanned contract machine 9 (step S311).
Thereby, the unmanned contract machine 9 places the identification card on the reading surface of the scanner (image reading unit 2) and reads it. The image reading unit 2 reads the identification card to generate image data (step S312), and transmits the generated image data to the personal information protection apparatus 1.

  First, the image processing unit 21 analyzes the image acquired by the image reading unit 2 (step S313: image analysis processing), and determines an image pattern from the analysis result (step S314: image pattern recognition processing). Next, the image processing unit 21 performs character recognition processing on the range of the predetermined area described in the personal information acquisition area table 31 based on the image pattern, and acquires character data from the image of the predetermined area (step S315: Character recognition processing). Furthermore, if the information obtained from the predetermined area is arbitrary registration information (intention confirmation target information), the image processing unit 21 cuts out the range of the predetermined area from the image and acquires a cut-out image (step S316: image cut-out process). ).

  The screen data generation unit 22 acquires an image or a fixed sentence from the storage unit 30 according to the processing result of the image processing unit 21, and gives the user a typographical error in the character data obtained by the character recognition process. Screen data for confirming the screen and screen data for prompting selection of correspondence (deletion / encryption) of the arbitrary registration information are generated (step S317).

The user inputs data via the input unit 4 while viewing the screen of the display unit 3 (step S318). At this time, the intention confirmation screen (FIG. 5) displayed on the screen includes an item for confirming the intention of handling arbitrary registration information (intention confirmation target information). The user can select [Delete] or [Encryption]. Select and enter. For the arbitrary registration information for which [Encryption] is selected, the decryption key written together is also input.
Thereby, the personal information protection apparatus 1 acquires input data from the input unit 4 (step S319).

  When the user presses a registration button (not shown) displayed on the screen, the input data processing unit 23 receives an update (registration) instruction from the input unit 4, and the display unit from the screen data generation unit 22 at this timing. 3 is acquired by associating the screen data information displayed in 3 with the input data from the input unit 4. Then, the input data processing unit 23 outputs the input data to the registration processing unit 24.

  Thereby, the registration processing unit 24 acquires character data (obtained in step S315) and a cut-out image (obtained in step S316) from the image processing unit 21, and input data (obtained in step S319) from the input data processing unit 23. (Step S320).

  Since the subsequent processing is the same as steps S114 to S124 (FIG. 8) in the first embodiment, description of the processing is omitted.

  The present invention is not limited to the above-described embodiment, and various changes and modifications can be made without departing from the gist of the present invention.

  The screen data generation unit 22 may generate screen data for selecting the type of identification card (image pattern) presented by the user. Accordingly, the image processing unit 21 acquires the type of the selected identification card (image pattern) from the PC 5 in the first embodiment or the PC 105 in the second embodiment, so that the image pattern of the image data is obtained. Can be specified. Therefore, in this case, the image processing unit 21 may not perform the image pattern recognition process.

  The registration processing unit 24 encrypts the cutout image (personal information area data; divided image data) and stores it in the encrypted image management server 62. Character data obtained by character recognition processing of the cutout image (Personal information area data; OCR data) may be encrypted and stored.

  In the intention confirmation screen shown in FIG. 5, [Decryption] may be included in the choices in the intention confirmation column in addition to [Delete] and [Encryption]. When [Non-encryption] is selected according to the user's will, the optional registration information is registered without being encrypted as in the case of the essential registration information.

DESCRIPTION OF SYMBOLS 1 Personal information protection apparatus 2 Image reading part 3 Display part 4 Input part 5 Network 9 Unmanned contract machine (automatic transaction apparatus)
DESCRIPTION OF SYMBOLS 10 Personal information management system 20 Control part 21 Image processing part 22 Screen data generation part 22A WEB data generation part 23 Input data processing part 24 Registration processing part 25 Communication control part 30 Storage part 31 Personal information acquisition area table 40 I / F part 41 Communication unit 61 Personal information DB server 62 Encrypted image management server 63 Identification card DB server 64 WEB server 103 Display unit 104 Input unit 105 PC (registration preparation terminal)
113 Display unit 114 Input unit 115 PC
N network

Claims (15)

A personal information protection device for protecting a plurality of personal information included in image data,
An image processing unit that divides the image data into regions including the personal information;
A protection pattern requesting unit for selectively inputting a protection pattern as to whether or not to encrypt the personal information area data related to each divided image data;
A personal information protection device comprising: a personal information processing unit that encrypts the personal information area data when the selection input is a protection pattern of encryption. The protection pattern request unit provides options for the protection pattern including one or both of “deletion” and “non-encryption” not to be encrypted in addition to “encryption” to be encrypted,
The personal information protection device according to claim 1, wherein the personal information processing unit deletes the personal information area data when the selection input is “delete”. The protection pattern request unit further requests input of a decryption key,
The personal information processing unit encrypts the personal information area data so that the personal information area data can be decrypted with the inputted decryption key when the selection input is “encryption”. The personal information protection device described. It is connected to the information processing device so that it can communicate,
The protection pattern request unit
Sending image data requesting input of the protection pattern and input of the decryption key to the information processing apparatus;
The personal information processing unit
The personal information protection device according to claim 3, wherein the protection pattern selection input data and the decryption key are received from the information processing device. An image input device is connected to the information processing device,
The personal information protection device according to claim 4, wherein the image data before being divided by the image processing unit is image data of an image captured by the image input device. It is connected to another information processing device so that it can communicate,
An image input device is connected to the other information processing device,
The personal information protection device according to claim 4, wherein the image data before being divided by the image processing unit is image data of an image captured by the image input device. An image input device,
The personal information protection device according to claim 1, wherein the image data before being divided by the image processing unit is image data of an image captured by the image input device. Connected to the database server so that it can communicate
Of the plurality of personal information area data obtained from one image data,
Associating all of the encrypted personal information area data encrypted with the protection pattern “encrypted” selected and all of the unencrypted personal information area data with the protection pattern “unencrypted” selected,
Further, the encrypted personal information area data is associated with the decryption key obtained by encrypting the encrypted personal information area data.
The personal information protection device according to claim 3, wherein the personal information protection device is stored in the database server. It is communicably connected to an ID database server that stores the characteristics of the ID and range data indicating the range of a predetermined area of each personal information description column included in the ID,
The image processing unit
Obtaining all the range data of the identification card whose characteristics match the characteristics of the image data;
The personal information protection device according to any one of claims 1 to 8, wherein the image data is divided by an area indicated by each of the range data.   10. The personal information protection apparatus according to claim 1, wherein the personal information area data is one or both of image data and character recognition data. A personal information protection method executed by a personal information protection device including an input unit that accepts input from outside,
Analyzing the image data received by the input unit, recognizing the positions of a plurality of personal information included in the image data, and dividing the image data into regions including the personal information;
A protection pattern requesting process for requesting to selectively input a protection pattern as to whether or not to encrypt the personal information area data relating to each divided image data;
When the selection input from the input unit is a protection pattern that encrypts, a personal information processing process for encrypting the personal information area data;
The personal information protection method characterized by performing. The protection pattern includes options including one or both of “deletion” and “non-encryption” not to be encrypted, in addition to “encryption” to be encrypted,
The personal information protection method according to claim 11, wherein, in the personal information processing process, when the selection input is “delete”, the personal information area data is deleted. The protection pattern request process further requests to input a decryption key,
12. The personal information processing step, wherein when the selection input is “encryption”, the personal information area data is encrypted so that it can be decrypted with the decryption key input from the input unit. The personal information protection method according to claim 12.   14. A personal information protection program for causing a computer of the personal information protection apparatus to execute the personal information protection method according to claim 11. An image reading device that reads an image on a medium, an information processing device that inputs image data output by the image reading device, and a plurality of personal information included in the image data that are communicably connected to the information processing device A personal information protection system comprising a personal information protection device,
The personal information protection device includes:
An image processing unit that divides the image data into regions including the personal information;
A protection pattern requesting unit for selectively inputting a protection pattern as to whether or not to encrypt the personal information area data related to each divided image data;
A personal information protection system comprising: a personal information processing unit that encrypts the personal information area data when the selection input is a protection pattern of encryption.

Images