JP6552160B2 - Information management system, information management method and program - Google Patents

Description

  The present invention relates to an information management system, an information management method, and a program.

Information systems used in companies and hospitals today need to handle confidential information such as personal information and trade secrets. With the enforcement of the Personal Information Protection Act, there is a growing need to prevent personal information from leaking out among confidential information in companies and hospitals. Patent Literature 1 proposes a medical conference system as an example of an information system used in a hospital. At this medical conference, patient basic information of electronic medical records and SOAP (Subjective, Objective, Assessment, Plan) description will be confirmed first. Next, the affected area is confirmed while looking at a Digital Imaging and Communication in Medicine (DICOM) image of a PACS (Picture Archiving and Communication Systems) viewer. Furthermore, it is often performed to refer to an examination report of diagnostic imaging and pathological diagnosis using an examination report system.
However, in order to handle personal information such as patient names and doctor names, it is necessary to go to the hospital where the system has been introduced and to analyze the problem (debug operation) of such a system, and the support operation is expensive and time-consuming. There was a problem that. On the other hand, Patent Literatures 2 and 3 disclose a technique for performing mask processing on personal information at a gateway between a server and a client.

JP, 2013-186650, A JP, 2006-343944, A JP, 2007-148510, A

However, the technique disclosed in Patent Document 2 has a problem in that information necessary for debugging a problem occurring on the client side cannot be obtained because personal information is masked at the gateway between the server and the client. Specifically, a problem occurs when the client side processes a character string including personal information sent from the server side. That is, if the character string is changed during the gateway gateway masking process, the processing result on the client side when the masking is not performed cannot be reproduced when the masking is performed.
For example, when sorting processing by patient name is performed on the client side, a character string that has been subjected to mask processing is passed to the client, and the sorting order cannot be reproduced. In addition, when the length of the character string including personal information is changed by the mask process, the memory usage changes, and problems such as memory shortage can not be reproduced. For this reason, it is difficult to remotely debug using a client outside the hospital.

Also, the degree of protection of personal information differs depending on the type of personal information and output environment, and in many cases, it is not possible to mask personal information uniformly. For example, when debugging in the hospital, the patient name is masked but the patient ID is not masked. However, when debugging from outside the hospital, all personal information is often masked. Since such operation differs depending on the personal information protection policy for each hospital, it is necessary to control the degree of masking in multiple stages according to the type of personal information and the output environment.
However, in Patent Document 3, in order to control the mask degree in multiple stages according to the type of personal information, it is necessary to prepare masked data in advance for each stage. Therefore, there is a problem that it is difficult to flexibly change the degree of masking in accordance with various personal information output environments.

  The present invention has been made in view of such problems, and it is an object of the present invention to easily perform failure analysis and remote maintenance of an application that handles confidential information while ensuring protection of the confidential information such as personal information.

Therefore, the present invention is an information management system having a server device and a client device , wherein the server device associates confidential information to be concealed with an information confidentiality level associated with the confidential information. Transmitting means for transmitting to the client device, the client device receiving the confidential information and the information confidentiality level from the server device, and the confidential information at a place where the confidential information is handled. Comparing means for comparing the environmental secrecy level specified based on at least one of the handling operator and the secret information output application, and the location, and the information secrecy level , based on the comparison result, A determination unit that determines whether or not to perform a confidential process that changes a display mode of the confidential information, and the confidential information when it is determined to perform the confidential process. Against, and having a security processing means for performing the concealment processing, and output means for outputting the confidential information after the security process.

  According to the present invention, it is possible to easily perform failure analysis and remote maintenance of an application that handles confidential information while ensuring protection of confidential information such as personal information.

It is a figure showing an information management system. It is a figure which shows a client apparatus and a server apparatus. It is a flowchart which shows information management processing. It is a figure which shows input XML. It is a figure which shows an example of an information confidentiality level table. It is a figure which shows a secret character string type. It is a figure which shows an example of an environmental secrecy level table. It is a figure which shows an example of environmental secrecy level information. It is a figure which shows an example of a substituted character string table. It is an explanatory view of information management processing. It is an explanatory view of information management processing. It is a figure for demonstrating a secrecy level management process. It is a flowchart which shows a secrecy level management process.

Hereinafter, embodiments of the present invention will be described based on the drawings.
FIG. 1 is a diagram showing an information management system according to the present embodiment. The information management system is a medical conference system that manages confidential information such as personal information of patients and doctors that is handled in a hospital. The information management system is not limited to the conference system, and can be applied to other medical applications. In addition, the information management system may manage confidential information in fields other than medical care, such as an in-house information system such as groupware.

The target hospital 1 is a hospital that has introduced the present system, and it is assumed that a hospital conference room 10A and a hospital debug room 10B exist on the premises. In the hospital conference room 10A, a client device 100A for protecting confidential information, which is a client of a medical conference system, is placed. The current agenda information of the conference is displayed on the UI display unit 110A of the client device 100A. In the example shown in FIG. 1, an agenda number 111A, a patient ID 112A, a patient name 113A, a patient kana name 114A, a patient gender 115A, and a patient age 116A are displayed as the agenda information.
Similarly to the in-hospital room 10A, the in-hospital debugging room 10B also includes a client apparatus 100B for protecting confidential information, which is a client of a medical conference system. The current agenda information of the conference is also displayed on the UI display unit 110B of the client device 100B. In the example shown in FIG. 1, an agenda number 111B, a patient ID 112B, a patient name 113B, a patient kana name 114B, a patient gender 115B, and a patient age 116B are displayed as the agenda information. The patient name 114B and the patient sex 115B are displayed in a form that cannot be distinguished by a viewer such as an operator.

Further, in the target hospital 1, a server apparatus 200 relating to secret information protection which is a server of a medical conference system is placed. The client devices 100A and 100B and the server device 200 are connected to an in-hospital LAN (Local Area Network) 11. Further, the in-hospital LAN 11 is connected to the Internet 13 through a GW (Gateway) 12.
As an example of a client of a medical conference system outside the target hospital 1, it is assumed that a client device 100C related to confidential information protection is placed in a partner hospital 10C. Similarly, it is assumed that a client device 100D related to confidential information protection is placed in an out-of-hospital debug room 10D in a company building such as SIer (System Integrator) that has installed this system in the target hospital 1. These client devices 100C and 100D are connected to the server device 200 via the Internet 13, the GW 12, and the hospital LAN 11. The number of client devices included in the information management system is not limited to the embodiment.

FIG. 2 is a diagram showing the client devices 100A to 100D and the server device 200. Since all the client devices 100A to 100D have the same configuration, in FIG. 2, the client devices 100A to 100D are simply referred to as the client device 100, and the configuration of the client device 100 will be described. The client device 100 is connected to various server groups (file server 3, inspection report server 4, electronic medical chart server 5) installed in the target hospital 1. In addition, the kind and number of servers installed in object hospital 1 are not limited to an embodiment. Further, as another example, the function of the server apparatus 200 may be included in the client apparatus 100, and may be configured as a peer-to-peer (P2P).
The client device 100, the server device 200, and the various server groups (3 to 5) are connected by a wired or wireless network 2. The in-hospital LAN 11, the GW 12, and the Internet 13 in FIG. 1 correspond to the network 2 in FIG.

The client device 100 includes a UI device 101, a CPU 102, a RAM 103, a communication IF 104, a program storage area 106, a data storage area 107, and a UI display unit 110. Similarly to the client device 100, the server device 200 includes a UI device 201, a CPU 202, a RAM 203, a communication IF 204, a program storage area 206, a data storage area 207, and a UI display unit 210. There is.
The UI device 101 is a mouse, a digitizer, a keyboard, or the like, and is used to input a user's instruction to the client apparatus 100. The CPU 102 implements various controls, calculations, and UI display in the client device 100 by interpreting and executing the program read from the program storage area 106 into the RAM 103. The functions and processing of the client device 100 described later are realized by the CPU 102 reading a program stored in the program storage area 106 and executing this program.

The communication IF 104 is connected to the network 2. The communication IF 104 is a communication interface between the server device 200 and various servers (3 to 5) in the hospital. The UI display unit 110 is a light emitting diode (LED), a liquid crystal panel, or the like that displays the state of the client apparatus 100 and the processing content. The program storage area 106 and the data storage area 107 are realized by a hard disk or a flash memory. Note that the configuration of each unit of the server device 200 is the same as the configuration of each unit of the client device 100.
Note that confidential information such as personal information is stored in the data storage area 207 of the server device 200. The confidential information may be placed on the file server 3, and the server device 200 may acquire the confidential information from the file server 3 through the network 2.

FIG. 3 is a flowchart showing information management processing by the information management system. In the information management process, the server apparatus 200 takes in confidential information and transmits it to the client apparatus 100. Here, the confidential information is information to be concealed, and more specifically, is a character string. The character string includes not only ordinary characters but also symbols such as special characters. In the information management system according to the present embodiment, the client device 100 does not perform a concealment process for concealing all confidential information from the operator, but appropriately performs a concealment process as necessary.
Here, a use case in which the information management system takes in input XML (Extensible Markup Language) shown in FIG. 4 will be described as an example. The input XML shown in FIG. 4 is patient information. It is assumed that the input XML shown in FIG. 4 is read from the electronic medical record server 5 or the inspection report server 4 and stored in a specific folder of the file server 3 shown in FIG.
In S300, when the CPU 202 of the server device 200 confirms that the input XML is stored in the file server 3, the CPU 202 acquires the input XML from the file server 3. Then, the server apparatus 200 expands the read input XML into the RAM 203, and decomposes the input XML into individual elements (content character strings) by the parsing process. Here, the content character string is an example of confidential information to be confidential.

Next, in S301, the CPU 202 of the server device 200 specifies the information concealment level of each content character string (specifying process). Here, the information concealment level is information indicating the degree to which the confidential information should be concealed. In the present embodiment, a high secrecy level means that the secrecy should be stricter, and a low secrecy level means that the need for secrecy is low. In the present embodiment, it is assumed that a high concealment level is set for information in which an individual is easily identified, and a low concealment level is set in information for which an individual is difficult to identify. On the contrary, the low secrecy level may mean that the importance to be concealed is high.
In the present embodiment, the server device 200 refers to the information concealment level table and specifies the information concealment level of the concealment information based on the concealment information. FIG. 5 is a diagram showing an example of the information concealment level table. The information concealment level table 500 is stored in the data storage area 207 of the server device 200 when the system is introduced. The information secrecy level table 500 is preferably created in accordance with a personal information protection policy for each hospital.

As shown in FIG. 5, the information concealment level table 500 stores the type of the content character string as the concealment information in association with the information concealment level for each hospital. The information concealment level is different for each hospital where the confidential information is handled, and the information concealment level table 500 stores the information concealment level defined for each hospital.
For example, with respect to the content character string as confidential information corresponding to PatientId (patient ID) element (type) shown in FIG. The secrecy level “1” is specified. In the following description, the case where the hospital where confidential information is handled is A hospital will be described as an example.

When the server device 200 identifies the information concealment level for the content character string, the server device 200 manages the content character string and the information concealment level in association with each other using a concealment character string type (confidential level management process). FIG. 6 is a diagram showing a secret character string type. The secret character string type 600 has an information concealment level 601 and a content character string 602 as members. In the information concealment level 601, for example, "0" is entered as a low value for information that is difficult to identify an individual, and "2" is entered as a high value for information that is easy to identify. The content character string is, for example, a character string such as “00000100” if the type of the content character string is “PatientId”. The content character string stored in the secret character string type variable is stored in the RAM 203 of FIG. 2 and then stored in the data storage area 207 and the file server 3.
Returning to FIG. 3, in S <b> 302, the CPU 202 of the server apparatus 200 transmits confidential information including a character string to be concealed such as a patient ID and a patient name to the client apparatus 100 in association with an information concealment level (transmission processing). ). Specifically, the CPU 202 associates each content character string with the information concealment level in the form of the secret character string type 600 and transmits it to the client device 100. The secret information is also held by the variable of the secret character string type 600 shown in FIG. 6 even inside the client device 100.

When the CPU 102 of the client device 100 receives the secret information and the information concealment level from the server device 200 in association with each other (reception processing), the CPU 102 of the client device 100 starts processing for the secret information in S303. In the present embodiment, the CPU 102 performs processing based on the patient name in the patient list as processing for the confidential information, and performs processing for displaying the sorting result in a tabular format on the UI display unit 110. In the present embodiment, the sort result display process is started in S303 on the assumption that the SIer in the in-hospital debug room 10B investigates a defect in the sort process. However, the content of the process started in S303 is not limited to the embodiment.
When displaying the patient list on the UI display unit 110, it is necessary to convert the secret character string type to the normal character string type. At this time, it is necessary to perform mask processing on the confidential information as necessary. Therefore, the CPU 102 of the client device 100 performs conversion from the secret character string type to the normal character string type in the processing after S304.

After the process of S303, in S304, the CPU 102 of the client device 100 refers to the environment confidentiality level table and specifies the environment confidentiality level in the environment where the confidential information is processed (specific processing). FIG. 7 is a diagram showing an example of the environment concealment level table 700. As shown in FIG. The environment concealment level table 700 stores environment information and an environment concealment level for each hospital in association with each other. The environment information includes an installation location of the client device 100, a user group to which a user who performs an operation related to processing of confidential information, and an output application. The environment concealment level table 700 is set in the data storage area 107 of the client apparatus 100 when the system is installed. As another example, the environmental concealment level table 700 may be set in the data storage area 207 of the server apparatus 200 when the system is introduced, downloaded to the client apparatus 100 and stored in the RAM 103 before executing the process of S304. Good.
The CPU 102 of the client device 100 refers to the environment concealment level table 700 and identifies the environment concealment level based on the installation location of the client device 100 where the concealment information is processed, the user group, and the output application.
The installation location of the client apparatus 100 is written in the setting file stored in the data storage area 107 or the like. Then, the CPU 102 reads the installation place from the setting file. Here, the installation location is an example of a location where confidential information is handled.
The client device 100 also stores a user table in which a group ID of a user group and a user ID of a user belonging to the user group are associated. Furthermore, the client device 100 receives an input of a user ID from the user at the time of login. Then, the CPU 102 of the client device 100 specifies a user group from the user table based on the received user ID. As another example, the user table may be stored in a server 200 or a user management server (not shown) provided other than the server 200. In this case, the CPU 102 may identify the user group with reference to the user table of the server device 200 or the user management server device.
Further, the CPU 102 specifies an output application based on an application being used, a screen being displayed on the UI display unit 110, information to be output, an output destination of information, and the like. Specifically, for example, it is assumed that an output application table in which conditions such as an application being used and the output application are associated with each other is stored in, for example, the data storage area 107 or the like. Then, the CPU 102 refers to the output application table and specifies the output application associated with the condition at the processing time.
The environment concealment level is information indicating the degree to which the confidential information should be concealed in an environment such as the installation place of the client apparatus 100, and is a value corresponding to the information concealment level. The environment information may be any information regarding the environment in which the confidential information is handled, and the type and number thereof are not limited to the embodiment.

On this premise, it is further assumed that the operator of the client device 100A belongs to the doctor group and the output application is application screen display. In this case, the CPU 102 of the client device 100A specifies the environment concealment level "2" from the first line of the environment concealment level table 700 (specifying process). FIG. 8 is a diagram showing an example of environment concealment level information indicating the identified environment concealment level. The environmental secret level information 800 is information indicating the specified environmental secret level.
Note that the execution timing of the process of S304 is not limited to the embodiment. The CPU 102 only needs to complete the process of S304 before the process of S305. For example, the CPU 102 may execute the process of S304 before receiving confidential information or the like in S302.
When the environment concealment level is a value that does not change in the client device 100, the environment concealment level may be set in advance in the RAM 103 or the like of the client device 100.

Returning to FIG. 3, after the process of S304, in S305, the CPU 102 of the client apparatus 100 compares the information concealment level of the content character string as the concealment information with the environment concealment level (comparison process). CPU102 advances a process to S306, when an information confidential level is below an environmental confidential level (it is Yes at S305). CPU102 advances a process to S308, when an information confidential level is larger than an environmental confidential level (it is No at S305).
In S <b> 306, the CPU 102 determines not to perform the concealment process on the content character string. That is, based on the comparison result, when the information concealment level is equal to or lower than the environment concealment level, the CPU 102 determines that the concealment process is not performed on the content character string (determination process). Here, the concealment process is a process of changing the display mode of the confidential information, more specifically, a process of converting the content character string into an unidentifiable form. In the present embodiment, the CPU 102 performs a mask process on the content character string as the concealment process. Next, in S307, the CPU 102 outputs a content character string (output process).

On the other hand, in S308, the CPU 102 determines that the content character string is to be concealed. That is, based on the comparison result, when the information concealment level is larger than the environment concealment level, the CPU 102 determines that the concealment process is to be performed on the content character string (determination process). Next, the CPU 102 performs mask processing as concealment processing. The mask process includes the following processes of S310 to S312. In S310, the CPU 102 checks whether or not a replacement character string corresponding to the content character string exists in the replacement character string table.
FIG. 9 is a diagram showing an example of a replacement character string table. The replacement character string table 900 stores the content character string as confidential information and the character string (replacement character string) after replacement of the content character string in association with each other. Here, the replacement character string is a character string in a form that cannot be discriminated by the operator. In the present embodiment, the characters include symbols as special characters. That is, the content string and the replacement string are both arrays including at least one of characters and symbols. In the example shown in FIG. 9, the replacement character string of the patient kana name includes the patient ID of the corresponding patient. Thereby, the operator can confirm the sorting result of the patient list by using the patient ID as a clue by looking at the replacement character string.

The replacement character string table 900 is assumed to be stored in the data storage area 107 of the client device 100. As another example, it is assumed that the replacement character string table 900 is set in the data storage area 207 of the server device 200, downloaded to the client device 100, and stored in the RAM 103.
The replacement character string is not limited to the embodiment. For example, depending on the type of defect, a completely random character string may be stored as a replacement character string in the replacement character string table.

Returning to FIG. 3, if the replacement character string exists in S310 (Yes in S310), the CPU 102 advances the process to S311. If there is no replacement character string (No in S310), the CPU 102 advances the process to S312. In S <b> 311, the CPU 102 converts the content character string into a replacement character string associated with the replacement character string table 900 (confidential processing), and then proceeds to S <b> 307. In S307, the CPU 102 outputs the replacement character string after the concealment process instead of the content character string (output process).
On the other hand, in S312, the CPU 102 converts the content character string into a character string in a form that cannot be discriminated by the viewer according to a predetermined rule (confidential processing), and then advances the processing to S307. In S307, the CPU 102 outputs the character string after the concealment process in place of the content character string (output process). In the present embodiment, the CPU 102 converts each character to "*" in S312. However, the specific processing in S312 is not limited to the embodiment. The CPU 102 may simply convert it into a random string.

Next, the information management process will be specifically described with reference to FIGS. 10 and 11. First, referring to FIG. 10, a case in which the operator in the hospital debugging room 10B investigates a defect in the sorting process will be described as an example. The server device 200 transmits the confidential information and the information confidentiality level from the server device 200 to the client device 100A in the hospital conference room 10A and the client device 100B in the hospital debug room 10B (S302).
Here, it is assumed that the operator A of the client device 100A belongs to the doctor group in the in-hospital camproom 10A. Further, it is assumed that the operator B of the hospital debugging loop 10B belongs to the SIer group. In addition, it is assumed that an output application is an application screen display, and a hospital where confidential information is handled is A hospital.

The client device 100A of the in-hospital conference room 10A performs sorting processing according to the patient kana name (S303), and then compares the information concealment level with the environment concealment level. In this case, in the client device 100A, the environmental concealment level “2” is specified from the first row of the environmental concealment level table shown in FIG. Also, the information concealment level of the content character string as the concealment information included in the input XML shown in FIG. 4 is “2” or less. Therefore, the client device 100A determines Yes in S305, determines that the confidential information is not to be performed in S306, and displays (outputs) the sort result in tabular form on the UI display unit 110A as shown in FIG.
On the other hand, the client device 100B of the in-hospital debug room 10B performs a sort process based on the patient name (S303), and then compares the information confidentiality level with the environmental confidentiality level. In this case, in the client device 100B, the environmental concealment level “1” is specified from the eighth line of the environmental concealment table shown in FIG. Therefore, the CPU 102 determines Yes in S305 for the patient ID associated with the information confidential level “1” in the confidential information, and determines not to perform the confidential processing in S306.
Further, the CPU 102 determines No in S305 for the patient name associated with the information concealment level “2”, determines to perform concealment processing in S308, and performs mask processing (S309). As shown in FIG. 9, in the replacement character string table 900, since the patient Kana name and the replacement character string are associated with each other, the CPU 102 converts the patient Kana name into a replacement character string (S309), and the replacement character string. Are displayed in tabular form on the UI display unit 110B.

Next, referring to FIG. 11, a case of outputting a log in order to confirm the data sorted by the client apparatuses 100A and 100B for debugging purpose will be described as an example. That is, the output application is a debug log. The conditions other than the output use are the same as those described with reference to FIG.
In the in-hospital camphor room 10A, the environment concealment level "2" of the client device 100A is specified from the third line of the environment concealment table shown in FIG. Then, the client device 100A compares the information concealment level with the environment concealment level immediately before the log output. The information concealment level of the content character string included in the confidential information shown in FIG. 4 is all “2” or less. Accordingly, the client device 100A determines that the concealment process is not performed in S306, generates the log file 1100A including the content character string as it is, and outputs the log file 1100A to the file server 3 or the like in S307.

On the other hand, in the in-hospital debug room 10B, the environmental concealment level “1” of the client device 100B is specified from the ninth line of the environmental concealment table shown in FIG. Therefore, the client apparatus 100B determines that the concealment process is performed for the patient name of the information concealment level “2” in S308, and converts it into a replacement character string in S309 (S311). Then, the client device 100B generates a log file 1100B including the converted character string, and outputs the log file 1100B to the file server 3 or the like (S307).
In addition, for the patient ID of the information concealment level “1”, the client apparatus 100B determines that the concealment process is not performed in S306, and outputs the content character string as it is (S307). As a result, even in the case of log output, the operator can check the processing result with the log file, and can easily perform the failure analysis.

The information management process in which the client device 100 manages confidential information has been described above. For example, when creating a patient list in a medical conference, a calculation process for a content character string is performed. The calculation process is, for example, a process of combining the agenda number and the patient name included in the confidential information to create a new agenda character string. Hereinafter, the concealment level management process by the client device 100 when the calculation process is performed on the content character string will be described. Here, as the arithmetic processing, editing processing such as extraction of a partial character string from a content character string can be mentioned in addition to connection (joining) of a plurality of content character strings. When the CPU 102 of the client device 100 extracts a partial character string from the content character string (editing process), the CPU 102 of the client device 100 associates the extracted partial character string with the extracted content character string. Corresponding information secrecy level. In addition, this process is an example of the concealment level management process which matches the information concealment level of the secret information before edit with respect to the secret information after edit.
FIG. 12 is a diagram for explaining the concealment level management process when content character strings are concatenated. As illustrated in FIG. 12, for example, the CPU 102 combines a variable of a secret character string type content character string “Agenda No” with a variable of a secret character string type content character string “patient name”. Generate a variable of content string of secret string type "string".

FIG. 13 is a flowchart showing the confidentiality level management process by the client device 100. In S1301, the CPU 102 compares the information secrecy levels associated with the types of the two content character strings to be linked, and sets the larger one of the information secrecy levels as the information secrecy level of the concatenation result. Do. In the example shown in FIG. 12, the information confidentiality level “0” of “Agenda No” in the left item is compared with the information confidentiality level “2” of “patient name” in the right item, and the information confidentiality level “2” is compared. It is set to the information concealment level of the "subject string" as the connection result.
Next, in S1302, the CPU 102 concatenates the content character string of the left term and the content character string of the right term, and sets the concatenated character string as the content character string of the concatenation result. In the example shown in FIG. 12, the content character string “No. 3” of “Agenda No” in the left item and the content character string “Rieko” of “Patient name” in the right item are combined. The content character string "No. 3: xxx Rieko" of the column "is set as the content character string of the connection result. When the CPU 102 concatenates a normal character string type variable, the CPU 102 regards the variable as a concealed character string type having an information concealment level “0” and performs concatenation processing. The concealment level management process is also executed in the server device 200 in the same manner.
Note that the processing of S1302 is an example of editing processing for editing confidential information. The processes of S1301 and S1302 are an example of a concealment level management process of associating the highest information concealment level among the information concealment levels of a plurality of pieces of confidential information before combining with the combined confidential information.

  Thus, in the calculation of the content character string as confidential information executed in the information management system, the information confidentiality level is automatically propagated to the calculation result. Therefore, even a developer who is unfamiliar with the medical domain can properly handle confidential information.

As described above, when displaying a character string on the UI display unit 110, the information management system according to the present embodiment appropriately performs mask processing in units of content character string. Therefore, it is possible to appropriately prevent the information in the content string from being leaked to a third party without affecting the processing result such as sorting in the client apparatus 100.
Furthermore, when the information protection policy is changed, the information management system may change each value of the environment concealment level table or the information concealment level table, and there is no need to change the implementation of the system. Therefore, it is possible to flexibly cope with the change of the information protection policy.

  As described above, according to each of the above-described embodiments, it is possible to easily perform failure analysis and remote maintenance of an application that handles confidential information while ensuring protection of confidential information such as personal information.

<Other Embodiments>
Although the embodiment has been described above in detail, the present invention can be embodied as, for example, a system, an apparatus, a method, a program, or a recording medium (storage medium). Specifically, the present invention may be applied to a system composed of a plurality of devices (for example, a host computer, an interface device, an imaging device, a web application, etc.), or may be applied to a device composed of a single device. good.
Needless to say, the object of the present invention can be achieved as follows. That is, a recording medium (or storage medium) storing a program code (computer program) of software for realizing the functions of the above-described embodiments is supplied to a system or apparatus. Such storage media are, of course, computer readable storage media. Then, the computer (or CPU or MPU) of the system or apparatus reads out and executes the program code stored in the recording medium. In this case, the program code itself read from the recording medium realizes the functions of the above-described embodiment, and the recording medium on which the program code is recorded constitutes the present invention.
The present invention is not limited to such specific embodiments, and various modifications and changes can be made within the scope of the gist of the present invention described in the claims.

Reference Signs List 100 client device, 102 CPU, 103 RAM, 110 UI display unit, 200 server device, 202 CPU, 203 RAM, 210 UI display unit

Claims (14)

An information management system having a server device and a client device, comprising:
The server device includes a transmission unit that transmits, to the client device, the confidential information to be concealed and the information concealment level associated with the confidential information in association with each other.
The client device is
Receiving means for receiving the confidential information and the information confidentiality level from the server device;
Comparing the at least one of the power application of the operator and the confidential information dealing with the confidential information at a place where the confidential information is handled, and the location, and the environment confidentiality level specified based on, and the information confidential level, the Means for comparing
A determination unit that determines whether to perform a concealment process of changing the display mode of the confidential information based on the comparison result;
Secrecy processing means for performing the secrecy process on the secrecy information when it is determined that the secrecy process is to be performed;
An information management system comprising: output means for outputting the secret information after the secret processing.   The information management system according to claim 1, wherein the concealment process is a process of converting the concealment information into an indistinguishable form.   The information management system according to claim 1, wherein the output unit outputs the confidential information that has not been subjected to the confidential processing when it is determined that the confidential processing is not performed. Editing means for editing the confidential information;
4. A security level management means according to any one of claims 1 to 3, further comprising: secrecy level management means for correlating the information secrecy level of the secret information before editing with the secret information after editing by the editing means. Information management system. The editing means performs editing to combine a plurality of confidential information into one information,
5. The information according to claim 4, wherein the concealment level management means associates the highest information concealment level among the information concealment levels of a plurality of pieces of concealment information before combination with the concealed information after combination. Management system. A first storage unit that stores the type of the confidential information and the information concealment level in association with each other;
First specifying means for specifying the information concealment level based on the type of the secret information in the first storage means;
The environment concealment level is stored in association with environmental information indicating an environment in which the confidential information is handled including at least one of an operator who handles the confidential information and an output application at the location where the confidential information is handled, and the location. A second storage means,
The second storage means further includes second specifying means for specifying the environment concealment level based on the environment in which the secret information is handled.
6. The comparison means according to claim 1, wherein the comparison means compares the information confidentiality level specified by the first specification means with the environmental confidentiality level specified by the second specification means. Information management system described in paragraph 1. The environment concealment level is specified based on a place where the concealment information is handled , an operator who handles the concealment information at the place, and an output application of the concealment information. Information management system described in Section. 8. The secret processing means converts a character string as the secret information into a character string in an unidentifiable form unlike the secret information, according to any one of claims 1 to 7. Information management system described. The information processing apparatus further comprises a third storage unit that stores the confidential information and a substitution character string in an unidentifiable form in association with each other.
9. The information management system according to claim 8 , wherein the concealment processing unit converts the concealment information into the replacement character string associated with the concealment information in the third storage unit. The output application, the application screen display, information management system according to any one of claims 1 to 9, characterized in that it comprises any one of usage trends analysis logging and debugging log output at least. A receiving unit configured to receive, from the server apparatus, the confidential information to be concealed and the information concealment level in association with each other;
At least one of an operator that handles the confidential information and an output application of the confidential information at the location where the confidential information is handled , and an environmental confidentiality level that is specified based on the location, and the confidential information are associated with each other A comparison means for comparing the information concealment level ;
A determination unit that determines whether to perform a concealment process of changing the display mode of the confidential information based on the comparison result;
Secrecy processing means for performing secrecy processing on the secrecy information when it is determined that the secrecy processing is to be performed;
An output unit that outputs the confidential information after the confidential processing. An information management method executed by an information management system, comprising:
Corresponding to the confidential information and the environmental confidentiality level specified based on the location and at least one of the operator who handles the confidential information and the use of the confidential information in the location where the confidential information to be confidential is handled A comparison step of comparing with the added information concealment level ;
A determination step of determining whether to perform a concealment process of changing the display mode of the confidential information based on the comparison result;
A concealment processing step of performing concealment processing on the confidential information when it is determined that the concealment processing is to be performed;
And D. an output step of outputting the confidential information after the confidential processing. An information management method executed by a client device,
A receiving step of receiving from the server apparatus the secret information to be concealed and the information concealment level in association with each other;
At least one of an operator that handles the confidential information and an output application of the confidential information at the location where the confidential information is handled , and an environmental confidentiality level that is specified based on the location, and the confidential information are associated with each other A comparison step of comparing the information concealment level, and
A determination step of determining whether to perform a concealment process of changing the display mode of the confidential information based on the comparison result;
When it is determined to perform the concealment process, a concealment process step of performing the concealment process on the concealment information;
And D. an output step of outputting the confidential information after the confidential processing. Computer,
A receiving unit configured to receive, from the server apparatus, the confidential information to be concealed and the information concealment level in association with each other;
At least one of an operator that handles the confidential information and an output application of the confidential information at the location where the confidential information is handled , and an environmental confidentiality level that is specified based on the location, and the confidential information are associated with each other A comparison means for comparing the information concealment level ;
A determination unit that determines whether to perform a concealment process of changing the display mode of the confidential information based on the comparison result;
Secrecy processing means for performing the secrecy process on the secrecy information when it is determined that the secrecy process is to be performed;
A program for functioning as output means for outputting the confidential information after the confidential processing.

Images