JP2016162298A - Access control device, method, and program - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide an access control device, method, and program with which it is possible to easily make settings for controlling access to personal data.SOLUTION: An access control device 10 sets, for each service category, a base policy table 31 that defines the allowability of providing items constituting personal data, sets a custom policy table 32 prioritized over the base policy table 31 that defines for each service the allowability of providing items, determines upon request for the provision of one of items whether or not to provide a requested item on the basis of the setting of the base policy table 31 or custom policy table 32, and sets the custom policy table 32 to the effect that a requested item will be provided when, while determination was made not to provide the item, input for consent to the provision of the item is accepted.SELECTED DRAWING: Figure 1

Description

  The present invention relates to an access control apparatus, method, and program.

  In recent years, in order to provide more useful services, efforts to utilize big data have been actively carried out. In particular, when using personal data related to an individual, it is necessary to consider the privacy of the individual. For example, according to the OECD (Organization for Economic Co-operation and Development) guidelines, the purpose of use of the collected personal data should be made clear to the collected person, and the collected personal data Personal data must not be used for purposes other than those for which consent has been obtained from a non-collector.

  Regarding such personal data, Non-Patent Document 1 describes P3P (Platform for Privacy Preferences), which is a standard relating to a mechanism for controlling personal data provided to a Web service. Non-Patent Document 2 proposes an agent system that issues a warning when a user attempts to use a service that violates the preference by setting the preference according to P3P.

  Patent Document 1 discloses a system for controlling whether or not personal data can be provided in accordance with a personal data access policy. The access policy in the disclosed system is realized as a conditional expression for a combination of a resource to be accessed, an application provider, an access use, and the like, and is set in advance.

JP 2014-178727 A

W3C, “The platform for privacy preferences 1.0 (P3P1.0) specification”, 2002. L. F. Cranor, et. al. , “Use of a P3P user agent by early adapters”, In Proceedings of the 2002 ACM works on Privacy in the Electronic Society, WPE'02. 1-10, 2002.

  However, since it is assumed that the types and purpose of use of personal data are enormous, it is not realistic to set them one by one. It is difficult for a user to set preferences appropriately.

  An object of the present invention is to provide an access control apparatus, method, and program for easily performing settings for controlling access to personal data.

Specifically, the following solutions are provided.
(1) An access control apparatus that controls access to personal data, and sets a base policy that determines whether or not to provide items constituting the personal data for each service category to which the personal data is provided Base policy setting means, custom policy setting means for setting a custom policy having priority over the base policy, which determines whether or not to provide the item for each service, and provision of any of the items is requested And a provision determining means for determining whether to provide the requested item based on the setting of the base policy or the custom policy, and the custom policy setting means includes the provision policy When the determination means determines that the requested item is not provided, the item is provided. An access control device that sets to provide the item in the custom policy when the consent input is received.

The access control device of (1) sets a common setting for each service category as a base policy setting in a privacy policy setting for providing personal data, and sets a unique setting for each service as a custom policy setting. Do. This custom policy is set based on the consent of provision only when a request from the service is not provided.
Therefore, the access control device sets a policy common to multiple services as a base policy at a time, and sets only a custom policy for each service different from the base policy only by obtaining consent from the service user. It is possible to easily set a policy for controlling access to the.

  (2) A profile obtaining unit that obtains a service profile including information on the requested item from the service provider, and the custom policy setting unit does not provide the requested item by the provision determining unit. The access control device according to (1), wherein the access control device presents the service profile and asks for consent to provide the item.

  The access control apparatus (2) presents a service profile including information on the requested item when requesting the consent to provide the item to the service user. Can do it easily.

  (3) The request includes a request level of anonymization in the case of providing the item, and the base policy setting unit and the custom policy setting unit determine the permission level of anonymization that permits the provision of the item. The access control apparatus according to (1) or (2), wherein the provision determination unit determines whether to provide the item based on a comparison result between the request level and the permission level.

  The access control device (3) can finely control access to personal data for each anonymization level without providing an item for a detailed data request exceeding the degree of permission for anonymization.

  (4) The base policy setting means outputs the setting contents of the base policy in a table format centered on the category and the item, and accepts the setting for each category and the item. ). The access control device according to any one of

  Since the access control apparatus (4) outputs the setting difference for each service category so that the service user can intuitively recognize the setting, the setting error of the service user can be suppressed.

  (5) The access control device according to any one of (1) to (4), further comprising setting output means for outputting the setting contents of the custom policy.

  Since the access control device (5) outputs the setting in the custom policy, the service user can easily grasp the setting status of the custom policy.

  (6) The access control apparatus according to any one of (1) to (5), further including history output means for outputting history information including a determination result by the provision determination means.

  Since the access control device (6) visualizes the history of access control, the service user can easily grasp the provision status of personal data.

  (7) The access control apparatus according to any one of (1) to (6), further including a deletion unit that receives the selection of the custom policy and deletes the selected custom policy.

  The access control device of (7) can easily delete a custom policy that is no longer needed because it is reflected in the base policy or changed to prohibit the provision of personal data.

  (8) The access control device according to any one of (1) to (7), further including a proposal output unit that outputs a change proposal of the base policy based on the amount of the custom policy corresponding to the base policy. .

  The access control device (8) prompts the user to update the base policy to reflect the custom policy. Therefore, the custom policy that can be determined only by the base policy is deleted, and the custom policy setting amount of each service is deleted. Can be reduced.

  (9) A method executed by the access control device according to (1), wherein the base policy setting unit provides items constituting the personal data for each service category to which the personal data is provided. A base policy setting step for setting a base policy that determines whether or not the service is allowed; and a custom policy in which the custom policy setting means sets a custom policy that has priority over the base policy that determines whether or not to provide the item for each service Whether to provide the requested item based on the setting of the base policy or the custom policy, in response to a request for provision of any of the items, by the policy setting step and the provision determining unit Providing judgment step for judging whether or not, the custom policy setting step , When it is determined not to provide the requested item by the providing judgment step, when receiving a consent input that provides the items set to provide the items in the custom policy method.

  The method (9) makes it possible to easily set a policy for controlling access to personal data, as in (1).

  (10) A program for causing a computer to execute each step described in (9).

  The program (10) causes a computer to function so as to easily set a policy for controlling access to personal data.

  According to the present invention, setting for controlling access to personal data can be easily performed.

It is a block diagram which shows the structure of the access control apparatus which concerns on one Embodiment of this invention. It is a figure which shows the example of the screen of the setting of the base policy table of the access control apparatus which concerns on one Embodiment of this invention. It is a figure which shows the example of the base policy table set by the access control apparatus which concerns on one Embodiment of this invention. It is a figure which shows the example of the anonymization degree table. It is a figure which shows the example of a category table. It is a figure which shows the example of the custom policy table set by the access control apparatus which concerns on one Embodiment of this invention. It is a flowchart which shows the example of the provision judgment process of the access control apparatus which concerns on one Embodiment of this invention. It is a flowchart which shows the example of a setting process of the custom policy table of the access control apparatus which concerns on one Embodiment of this invention. It is a figure which shows the example of the screen which sets the custom policy table of the access control apparatus which concerns on one Embodiment of this invention.

Hereinafter, embodiments of the present invention will be described with reference to the drawings.
FIG. 1 is a block diagram showing a configuration of an access control apparatus 10 according to an embodiment of the present invention.
The access control apparatus 10 includes a base policy setting unit 11, a custom policy setting unit 12, a provision determination unit 13, a profile acquisition unit 14, a setting output unit 15, a history output unit 16, a deletion unit 17, a proposal The output means 18, the memory | storage part 30, the base policy table 31, and the custom policy table 32 are provided. The access control device 10 functions as a gateway for providing personal data stored in the service user's terminal to the service, and whether or not the user's personal data can be provided in response to a request from the service provider. Judging.

The base policy setting means 11 sets a base policy table 31 that determines whether or not items constituting personal data can be provided for each service category to which personal data is provided. The base policy setting means outputs the setting contents of the base policy in a tabular format with categories and items as axes, and accepts settings for each category and item.
The service category may include, for example, road service, advertisement distribution, public service, driving support service, and the like.
Items constituting the personal data may include, for example, age, sex, zip code, vehicle type, position information, and the like.
Anonymization level in the case of providing or not providing the personal data item is set.

Specifically, the base policy setting unit 11 sets a base policy as shown in FIG. FIG. 2 is a diagram showing an example of a setting screen of the base policy table 31 of the access control apparatus 10 according to an embodiment of the present invention.
For example, the base policy setting unit 11 displays a tabular screen about service categories and items for setting a base policy on the touch panel 300, and accepts item settings. When receiving the touch of the setting button 311, the base policy setting unit 11 determines the service category and item based on the position of the setting button 311 on the screen, and sets the corresponding item in the base policy table 31.
Further, the base policy setting unit 11 changes the setting stage every time the setting button 311 is touched. The base policy setting means 11 limits the setting stage to “not provide”, anonymization level 1, anonymization level 2, and anonymization level 3 so that the user can set without error. It is good also as a setting.
Furthermore, the base policy setting unit 11 may reflect the setting contents of the base policy table 31 on the color of the setting button 311 corresponding to the item, and color-code each setting stage. The color classification is, for example, “not provided” is black 324, level 1 is red 321, level 2 is yellow 322, level 3 is green 323, and color display that calls attention according to the degree of permission for anonymization of items Also good.

The base policy setting unit 11 stores a base policy table 31 in which item settings are associated with each service category in the storage unit 30 (for example, a memory or an auxiliary storage device) as shown in FIG. FIG. 3 is a diagram showing an example of the base policy table 31 set by the access control apparatus 10 according to an embodiment of the present invention.
As shown in FIG. 3, the base policy table 31 stores the setting of personal data items in association with each service category. The level set in the item represents the degree of permission indicating how much anonymization is permitted, and corresponds to the definition of the anonymization degree table (see FIG. 4). FIG. 4 is a diagram illustrating an example of the anonymization degree table.
As shown in FIG. 4, the anonymization degree table stores anonymization level definition (for example, generalization level) in association with each item of personal data.
At the level of anonymization, “ALL” means not processed (ie, not generalized).

The base policy setting unit 11 may also store a category table that associates individual services with service categories in the storage unit 30 as shown in FIG. FIG. 5 is a diagram illustrating an example of a category table.
As shown in FIG. 5, the category table stores a service included in a category in association with each service category. The category of the service that is not registered in the category table may be set to “Other”.

The custom policy setting means 12 sets a custom policy table 32 that determines whether or not items can be provided for each service. Custom policies take precedence over base policies.
Specifically, the custom policy setting unit 12 is a custom policy in which item settings are associated with each service in accordance with a determination result of the provision determination unit 13 and a user's consent input described later (see FIG. 9). Similar to the base policy table 31, the policy table 32 is stored in the storage unit 30 as shown in FIG. FIG. 6 is a diagram showing an example of the custom policy table 32 set by the access control apparatus 10 according to an embodiment of the present invention.
As shown in FIG. 6, the custom policy table 32 stores the setting of personal data items and the registration date and time (time information at the time of setting) in association with each service. Similar to the base policy table 31, the level set in the item represents the anonymization permission level and corresponds to the definition of the anonymization level table.
When there are a plurality of custom policies for the same service, the access control device 10 (providing judgment means 13) uses the policy with the latest registration date. With the custom policy table 32 that stores past custom policies, the access control apparatus 10 can inform the user of the setting status of the custom policies in detail. The custom policy table 32 may be stored by overwriting the latest custom policy. The access control device 10 can reduce the use of the storage area.

The provision determining unit 13 determines whether to provide the requested item based on the setting of the base policy table 31 or the custom policy table 32 in response to the request for provision of any item. .
Specifically, upon receiving a request for provision from a service provider, the provision determining unit 13 determines whether or not the service of the received request is registered in the custom policy table 32. It is determined whether to provide the requested item based on the setting of the item registered in the custom policy table 32.
If it is not registered in the custom policy table 32, the provision determining unit 13 acquires a service category based on the category table from the received request service, and the base policy table 31 associated with the acquired service category. Based on the setting of the item, it is determined whether to provide the requested item.
The provision determining unit 13 may acquire the service category based on the service profile.

The request for provision of personal data includes the degree of request for anonymization when items are provided. The provision determination unit 13 determines whether or not to provide an item and an anonymization level based on a comparison result between the request level and the permission level.
The anonymization level refers to a level for anonymizing item data when a requested item is provided. The request level refers to the anonymization level of an item that requests provision, and the permission level refers to the anonymization level that permits an item to be provided (that is, the level of generalization to permit).
Specifically, when the permission level is “anonymization level 2”, an item can be provided when the request level is anonymization level 2 or higher (for example, anonymization level 2 or 3), and the request level is anonymous. An item cannot be provided when the level is less than 2 (for example, anonymization level 1).
For example, the provision determining unit 13 anonymizes the degree of request based on a comparison result between the degree of request of the item requested by the service provider and the degree of permission set in the custom policy table 32 or the base policy table 31. If the level is higher than the anonymization level of the permission level, it is determined that the service is provided.

When the provision determining unit 13 determines that the requested item is not provided, the custom policy setting unit 12 provides the item in the custom policy table 32 when the consent input for providing the item is received from the user. Then set.
Specifically, when a service requesting personal data is registered in the custom policy table 32, when it is determined that no item is provided based on this custom policy, or when the service is not registered in the custom policy table 32 When it is determined that the service is not provided based on the base policy table 31, the custom policy setting unit 12 sets a custom policy for the service. For setting, the custom policy setting unit 12 accepts an agreement input for providing the item from the user, and sets a custom policy for providing the item based on the agreement.

The profile acquisition unit 14 acquires a service profile including information on the requested item from the service provider.
Specifically, when the provision determining unit 13 determines that the item is not provided, the profile acquiring unit 14 acquires and stores a service profile including information on the requested item from the service provider. The profile acquisition unit 14 stores the information on the items to be stored, including the degree of anonymization requested by the provider.
The custom policy setting means 12 presents the service profile and asks the user for consent to provide the item.
When the user's operation input becomes possible (for example, when the vehicle has been driven and stopped at the parking lot), the custom policy setting means 12 has been stored for the service that refuses to provide personal data. The custom policy table 32 is set so that the service profile is displayed and the user is requested to consent to provide the requested item, and when the consent is obtained, the provision of the requested item is permitted. The custom policy setting means 12 sets a custom policy at the requested level.

The setting output unit 15 outputs the setting contents of the custom policy table 32.
The access control device 10 (custom policy setting unit 12 or deletion unit 17) may accept a selection from the list of output custom policies and perform change registration or deletion.

The history output unit 16 outputs history information including the determination result by the provision determination unit 13.
Specifically, the history output means 16 outputs history information including the service that requested the item, the requested item and the degree of request for anonymization, and whether or not the item has been provided.

The deleting unit 17 receives a selection of a service registered in the custom policy table 32 and deletes the custom policy of the selected service.
Specifically, the deletion unit 17 displays the custom policy table 32, accepts a selection from the user, and deletes the registration of the selected service from the custom policy table 32.

The proposal output means 18 outputs a change proposal for the base policy table 31 based on the amount of the custom policy table 32 corresponding to the base policy table 31.
Specifically, the proposal output unit 18 detects that the number of services of the same category registered in the custom policy table 32 is equal to or greater than a predetermined number, or a plurality of services registered in the custom policy table 32. If the services are included in the same category and the settings of the same item are detected to be the same, the number of services, the setting contents, and the category corresponding to the service are displayed to propose change of the base policy table 31 do.

  FIG. 7 is a flowchart showing an example of provision determination processing of the access control apparatus 10 according to an embodiment of the present invention. The access control device 10 includes hardware included in a computer and its peripheral devices, and software that controls the hardware, and the following processing is executed by a control unit (for example, CPU) according to predetermined software under the OS. It is processing to do.

  In step S <b> 101, the CPU (providing determination unit 13) receives an item request from the service provider.

  In step S102, the CPU (providing determination unit 13) determines whether there is a custom policy for the service. Specifically, the CPU determines whether or not the item setting for the service is registered in the custom policy table 32. If this determination is YES, the CPU moves the process to step S104, and if this determination is NO, the CPU moves the process to step S103.

  In step S103, the CPU (providing determination unit 13) acquires the setting of the base policy table 31 based on the category of the service. Thereafter, the CPU moves the process to step S105.

  In step S104, the CPU (providing determination unit 13) acquires the setting of the custom policy table 32 of the service.

  In step S105, the CPU (providing determination means 13) determines whether or not the anonymization request level is within the permission level range. If this determination is YES, the CPU moves the process to step S108, and if this determination is NO, the CPU moves the process to step S106.

  In step S106, the CPU (providing determination unit 13) acquires a service profile from the service provider.

  In step S107, the CPU (profile acquisition unit 14) stores the acquired service profile, the requested item, and the degree of anonymization request.

  In step S108, the CPU creates and stores history information including the service, the requested item, the request for anonymization, and information on whether or not the item has been provided. Thereafter, the CPU ends the process.

  FIG. 8 is a flowchart showing an example of setting processing of the custom policy table 32 of the access control apparatus 10 according to an embodiment of the present invention.

  In step S201, the CPU (custom policy setting means 12) displays the saved profile, the requested item, and the request level of anonymization, and requests consent.

  In step S202, the CPU (custom policy setting means 12) determines whether or not consent has been accepted. Specifically, the CPU determines whether or not an operation indicating consent has been performed on the display requesting consent (for example, whether or not “YES” in FIG. 9 has been touched). If this determination is YES, the CPU moves the process to step S203, and if this determination is NO, the CPU moves the process to step S204.

  In step S203, the CPU (custom policy setting means 12) sets the custom policy table 32. Thereafter, the CPU ends the process.

  In step S204, the CPU (custom policy setting means 12) deletes the service from the custom policy table 32. Thereafter, the CPU ends the process.

FIG. 9 is a diagram showing an example of a screen for setting the custom policy table 32 of the access control apparatus 10 according to an embodiment of the present invention.
The access control apparatus 10 displays a service name, a business type, etc. as a profile from the stored service profile, and displays the stored items and the degree of anonymization request.
The access control device 10 may display the items in an easy-to-understand manner using icons. For example, the position information may be displayed as a “position information icon”, and the vehicle type information may be displayed as a “car type icon”.
As shown in FIG. 9, the access control device 10 asks the service user for consent, and when “YES” is selected, for example, the service name yyyyyy and the degree of request for anonymization of “location information” 2 ”and the request level“ level 1 ”for anonymization of“ vehicle type ”are registered in the custom policy table 32 in association with each other.
When “NO” is selected, the access control apparatus 10 deletes the service from the custom policy table 32. Note that when “NO” is selected, the access control apparatus 10 may set only the setting for the item for which consent is requested to “not provide”.

According to the present embodiment, the access control apparatus 10 performs the setting common to each service category as the setting of the base policy table 31 in the setting of the privacy policy related to the provision of personal data, and sets the unique setting for each service. The custom policy table 32 is set. This custom policy table 32 is set based on the consent of provision only when a request from the service is not provided. Therefore, the access control apparatus 10 sets a policy common to a plurality of services as a base policy at a time, and sets only a custom policy for each service different from the base policy only by obtaining consent from the service user. It is possible to easily set a policy for controlling access to data.
Furthermore, when the access control apparatus 10 requests the service user to give consent for providing the item, the access control apparatus 10 presents a service profile including information on the requested item, and therefore the service user determines whether to agree. Can be easily done.
Furthermore, the access control apparatus 10 can finely control access to personal data for each anonymization level without providing an item for a detailed data request exceeding the degree of permission for anonymization.
Furthermore, since the access control device 10 outputs the setting difference for each service category so that the service user can intuitively recognize the setting, the setting error of the service user can be suppressed.
Furthermore, since the access control apparatus 10 outputs the setting in the custom policy, the service user can easily grasp the setting status of the custom policy.
Furthermore, since the access control apparatus 10 visualizes the access control history, the service user can easily grasp the provision status of the personal data.
Furthermore, the access control apparatus 10 can easily delete a custom policy that is no longer needed because it is reflected in the base policy or changed to prohibit the provision of personal data.
Furthermore, since the access control device 10 prompts the user to update the base policy to reflect the custom policy, the custom policy that can be determined only by the base policy is deleted, and the setting amount of the custom policy for each service is reduced. Can be reduced.

  As mentioned above, although embodiment of this invention was described, this invention is not restricted to embodiment mentioned above. The effects described in the embodiments of the present invention are only the most preferable effects resulting from the present invention, and the effects of the present invention are limited to those described in the embodiments of the present invention. is not.

  A series of processing by the access control apparatus 10 can also be performed by software. When a series of processing is performed by software, a program constituting the software is installed in a general-purpose computer or the like. The program may be recorded on a computer-readable recording medium (for example, a removable medium such as a CD-ROM) and distributed to the user, or may be downloaded to the user's computer via a network. May be distributed.

DESCRIPTION OF SYMBOLS 10 Access control apparatus 11 Base policy setting means 12 Custom policy setting means 13 Provision judgment means 14 Profile acquisition means 15 Setting output means 16 History output means 17 Deletion means 18 Suggestion output means 30 Storage part 31 Base policy table 32 Custom policy table 33 History table

Claims (10)

An access control device for controlling access to personal data,
Base policy setting means for setting a base policy that determines whether or not to provide an item constituting the personal data for each category of service to which the personal data is provided;
Custom policy setting means for setting whether or not to provide the item for each service and setting a custom policy having priority over the base policy;
Providing determination means for determining whether to provide the requested item based on a setting of the base policy or the custom policy in response to a request to provide any of the items; Prepared,
The custom policy setting means sets the provision of the item in the custom policy when the provision determination means determines that the requested item is not provided and accepts the consent input for providing the item. ,
Access control device. Profile acquisition means for acquiring a service profile including information of the requested item from the service provider,
2. The access according to claim 1, wherein the custom policy setting unit presents the service profile and requests an agreement to provide the item when the provision determining unit determines that the requested item is not provided. Control device. The request includes the degree of request for anonymization when providing the item,
The base policy setting means and the custom policy setting means define an anonymization permission level that permits provision of the item,
The access control apparatus according to claim 1, wherein the provision determination unit determines whether to provide the item based on a comparison result between the request level and the permission level.   The base policy setting means outputs the setting contents of the base policy in a table format centered on the category and the item, and accepts the setting for each category and the item. The access control device according to Item.   The access control apparatus according to claim 1, further comprising setting output means for outputting setting contents of the custom policy.   The access control apparatus according to any one of claims 1 to 5, further comprising history output means for outputting history information including a determination result by the providing determination means.   The access control apparatus according to claim 1, further comprising a deletion unit that receives selection of the custom policy and deletes the selected custom policy.   The access control apparatus according to claim 1, further comprising: proposal output means for outputting a change proposal for the base policy based on the amount of the custom policy corresponding to the base policy. A method executed by the access control apparatus according to claim 1,
A base policy setting step in which the base policy setting means sets a base policy that determines whether or not to provide an item constituting the personal data for each category of service to which the personal data is provided;
A custom policy setting step in which the custom policy setting means sets a custom policy having priority over the base policy, which determines whether or not to provide the item for each service;
The provision determining means determines whether to provide the requested item based on the setting of the base policy or the custom policy in response to a request for provision of any of the items. Providing decision step,
In the custom policy setting step, when it is determined that the requested item is not provided in the provision determining step, if the consent input for providing the item is accepted, the custom policy setting step sets the item to be provided in the custom policy. ,
Method. The program for making a computer perform each step of Claim 9.

Images