JP6925496B1 - Information processing equipment, programs and information processing methods - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide an information processing device, a program and an information processing method capable of correcting historical information while ensuring confidentiality and completeness of processing history information with respect to data or value. An information processing device has a request receiving unit that receives a correction request for correction of a first history information related to a history of a first process for data or value from a user device of a user, and a first history information before the correction. A concealment unit that conceals using the first key information stored in the key storage unit, a storage unit that stores the concealed first history information before correction in the backup storage unit, and a correction unit. Based on the request, the correction unit that performs processing for correcting the first history information by referring to the history storage unit that stores the first history information, and the first key information have a plurality of privileges of the first history information. A division unit that divides each person, and a transmission unit that transmits the divided first key information to each of a plurality of authorized person devices of a plurality of authorized persons and deletes the transmitted first key information from the key storage unit. , Equipped with. [Selection diagram] FIG. 7

Description

The present invention relates to an information processing device, a program, and an information processing method.

In recent years, techniques for recording / referencing historical information of processing for data or value, such as information processing and payment processing, have been known. Further, in such a technology, it is necessary to ensure the confidentiality and integrity of historical information to a certain extent from the viewpoint of personal information protection and information security. For example, Patent Document 1 discloses an automatic setting system that masks and records a part of history information including user data when the setting data is operated. In this automatic setting system, the user data included in the history information is not masked in response to the history information acquisition request, and the organization that holds the history information and the organization to which the user who requested the acquisition of the history information belongs If different, some of the history information is masked.

Japanese Unexamined Patent Publication No. 2020-135576

By the way, when erroneous history information is recorded, correction (correction or deletion) may be requested for this erroneous history information. It is also necessary to ensure the confidentiality and integrity of historical information when responding to such correction requests. However, the above-mentioned prior art cannot meet the request for correction of the history information while ensuring the confidentiality and completeness of the history information.

Therefore, an object of the present invention is to provide an information processing device, a program, and an information processing method capable of correcting historical information while ensuring the confidentiality and completeness of processing history information with respect to data or value.

The information processing device according to one aspect of the present invention includes a request receiving unit that receives a correction request for correction of the first history information regarding the history of the first processing for data or value from the user device of the user, and a first before correction. 1 A concealment unit that conceals history information using the first key information stored in the key storage unit, and a storage unit that stores the concealed first history information before correction in the backup storage unit. With reference to the history storage unit that stores the first history information based on the correction request, the correction unit that performs processing for correcting the first history information and the first key information are the first history information. The divided unit divided for each of a plurality of authorized persons and the divided first key information are transmitted to each of the plurality of authorized persons' devices of the plurality of authorized persons, and the transmitted first key information is deleted from the key storage unit. It includes a transmitter.

The program according to one aspect of the present invention has a request receiving function for receiving a correction request from a user device of a user for correction of the first history information regarding the history of the first processing for data or value, and a request receiving function before the correction. A concealment function that conceals the first history information using the first key information stored in the key storage unit, and a storage that stores the concealed first history information before correction in the backup storage unit. Based on the function and the correction request, the correction function that performs processing for correcting the first history information by referring to the history storage unit that stores the first history information, the first key information, and the first history information The division function that divides each of the multiple authorized persons and the divided first key information is transmitted to each of the plurality of authorized persons of the plurality of authorized persons, and the transmitted first key information is deleted from the key storage unit. Realize the transmission function to be performed.

In the information processing method according to one aspect of the present invention, the computer receives a correction request from the user's user device for correction of the first history information regarding the history of the first processing for data or value, and the first before correction. The history information is concealed using the first key information stored in the key storage unit, and the concealed first history information before correction is stored in the backup storage unit, and based on the correction request, With reference to the history storage unit that stores the first history information, processing for correcting the first history information is performed, and the first key information is divided and divided for each of a plurality of authorized persons of the first history information. The first key information is transmitted to each of the plurality of authorized devices of the plurality of authorized persons, and the transmitted first key information is deleted from the key storage unit.

INDUSTRIAL APPLICABILITY According to the present invention, it is possible to provide an information processing device, a program, and an information processing method capable of correcting historical information while ensuring the confidentiality and completeness of processing history information with respect to data or value.

It is a figure for demonstrating the system configuration example of the information management system which concerns on 1st Embodiment. It is a figure for demonstrating an example of the outline of the information management system which concerns on 1st Embodiment. It is a figure for demonstrating an example of the outline of the information management system which concerns on 1st Embodiment. It is a figure for demonstrating an example of the outline of the information management system which concerns on 1st Embodiment. It is a figure for demonstrating an example of the outline of the information management system which concerns on 1st Embodiment. It is a figure for demonstrating an example of the outline of the information management system which concerns on 1st Embodiment. It is a figure which shows an example of the functional structure of the management apparatus which concerns on 1st Embodiment. It is a figure which shows an example of the data structure of the information management system which concerns on 1st Embodiment. It is a figure which shows an example of the data structure of the information management system which concerns on 1st Embodiment. It is a figure which shows the operation example of the information management system which concerns on 1st Embodiment. It is a figure which shows the operation example of the information management system which concerns on 1st Embodiment. It is a figure which shows an example of the hardware composition of the management apparatus which concerns on 1st Embodiment. It is a figure which shows an example of the functional structure of the management apparatus which concerns on 2nd Embodiment.

Preferred embodiments of the present invention will be described with reference to the accompanying drawings. In each figure, those having the same reference numerals have the same or similar configurations.

In the present invention, the "part", "means", "device", and "system" do not simply mean physical means, but the "part", "means", "device", and "system" are used. It also includes the case where the function to be possessed is realized by software. Further, even if the functions of one "part", "means", "device", or "system" are realized by two or more physical means or devices, two or more "parts" or "means", The functions of "device" and "system" may be realized by one physical means or device.

[First Embodiment]
The first embodiment of the present invention (hereinafter, referred to as “the present embodiment”) will be described.

The information management system 1 according to the present embodiment is a system for managing history information regarding the history of processing for an object including data or value. The information management system 1 acquires, for example, a transfer history from each of a plurality of businesses that execute the target transfer (hereinafter, also simply referred to as “transfer”), and the history desired by the user from the acquired transfer history. Provide an infrastructure (hereinafter, also referred to as “Retrieval infrastructure”) from which the information can be retrieved. In addition, the information management system 1 receives a correction request for these historical information managed by the retrieval infrastructure, and based on this correction request, corrects the historical information while ensuring information security (confidentiality, integrity, availability). (Modify or delete).

The "target" is a target of processing in the history of history information. The subject includes, for example, if the process is "transfer", at least one of the value of transferring between multiple accounts or the data transferred between multiple devices. Further, the target includes, for example, data to be operated when the process is "operation". In addition, the "account" here is typically an account, but in addition, the user's right to receive services on the network (combination of user ID and password) and the owner if the target is a tangible property. And so on.

The "value" includes, for example, electronic money, virtual currency (cryptographic assets), points issued by each company (so-called corporate currency), and the like.

"Value transfer" means that the owner who owns the value changes. Value transfer may include, for example, transfer between a plurality of different accounts (eg, accounts) held by the same person. Value transfer can be, for example, a transfer transaction between multiple accounts, a deposit / withdrawal from an account, a point conversion, a payment transaction using a bank account (eg, a bank transfer), or a debit card or credit card. It may include a card payment transaction using a prepaid card or the like.

"Operation" refers to, for example, acquisition, update, processing, integration or provision of data.

<1. System configuration>
A system configuration example of the information management system 1 according to the present embodiment will be described with reference to FIG.

As shown in FIG. 1, the information management system 1 includes a management device 100, a user device 200, a counterparty device 300, and a business operator device 400.

The management device 100 is communicably connected to these devices via the network N in order to link the history information and the like between the user device 200, the partner device 300, and the operator device 400. Further, the management device 100 may be communicably connected to another external device, for example, the third party engine device 500 of the external system 5 via the network N, for example.

"History information" is information regarding the history (including logs) of processing for data or value. The history information may be, for example, information indicating the history of relocation, or access information (for example, URL, etc.) for accessing the history of relocation. The history information includes the first history information and the second history information. The details of the history information will be described later in the request reception unit 111.

The "first history information" is information regarding the history of the first process for data or value. The first process may be, for example, a process for transferring data or value.

The "second history information" is information regarding the history of the second process for data or value. The second process is a process different from the first process and is a process related to the first process. The first process and the second process may have a certain relationship or causal relationship, for example. The second process may be, for example, a process for transferring data or value.

The second process may be, for example, the following processes (A) to (B21) with respect to the first process.
(A) Processing related to the same transaction (A1) Processing related to the same transaction with a certain degree of continuity (B) Processing related to related transactions (B1) Processing related to different transactions within a predetermined period for the same user ( B11) Processing related to different transactions with a certain degree of continuity (B2) Processing related to different transactions within a predetermined period for the same counterparty (B21) Processing having a certain degree of continuity in processing related to different transactions

In the case of (A) above, for example, in the case of a commercial transaction using credit card payment, the process of withdrawal from the account of the credit card user is the first process, and the member store that purchased the product using the credit card. The processing of depositing money into the account may be the second processing. Further, in the case of (A) above, in the case of a remittance transaction, the process of withdrawal from the bank account of the remittance source is the first process, and the process of depositing money to the bank account of the other party to the remittance is the second process. good.

The network N is composed of a wireless network and a wired network. Examples of networks include mobile phone networks, PHS (Personal Handy-phone System) networks, wireless LAN (Local Area Network), 3G (3rd Generation), LTE (Long Term Evolution), 4G (4th Generation), and 5G (4th Generation). 5th Generation), WiMax (registered trademark), infrared communication, Bluetooth (registered trademark), wired LAN, telephone line, power line network, IEEE1394 compliant network, etc.

The management device 100 provides information for providing history information to a user by means of a retrieval infrastructure and for providing a service (hereinafter, referred to as "information management service") that enables correction of history information in response to a request from the user. It is a processing device. By executing a predetermined program, the management device 100 realizes a server function of extracting the history information required by the user from the history information acquired from the plurality of business device 400 and providing it to the user device 200 of the user. do. Further, the management device 100 receives a correction request from the user and corrects the history information based on the correction request. The predetermined program may be, for example, a program dedicated to the information management system 1 installed in the management device 100.

The management device 100 may be provided with hardware, an OS, or the like dedicated to the information management system 1 (for example, an on-premises type server configuration), or may be provided with SaaS (Software as a Service) or PaaS (Platform as a Service) by a cloud server. , IaaS (Infrastructure as a Service) may be used as appropriate.

The management device 100 may provide the business device 400 with an SDK (Software Development Kit) or an API (Application Programming Interface) for the information management system 1 for acquiring history information, for example. The business operator device 400 may make the management device 100 acquire the history information by using these SDKs and APIs.

The user device 200 is a terminal device such as a smartphone or a laptop, and performs input from the user to the functions provided by the management device 100 and the operator device 400, output to the user from these functions, and communication with these devices. It is possible to do. By executing a predetermined program, the user device 200 connects to the management device 100 and the operator device 400 to send and receive information on the functions of these devices, and receives instructions from customers for these functions. .. The user device 200 receives, for example, an input of a correction request requesting correction of the history information (hereinafter, also simply referred to as “correction request”), or a recovery request requesting recovery of the history information before correction (hereinafter, simply “correction request”). It also accepts input of "recovery request"). The predetermined program may be, for example, a Web application provided as standard in the user device 200, or an application program dedicated to the information management system 1 installed in the user device 200 (hereinafter, "information providing application"). Also called).

The user is a person who uses the information management system 1, and may be, for example, a transfer source or a transfer destination of data or value transfer.

The other party device 300 is a terminal device such as a smartphone or a laptop, and performs input from the other party to the functions provided by the management device 100 and the operator device 400, output to the other party from these functions, and communication with these devices. It is possible to do. Here, the "counterparty" is the transfer source or transfer destination partner of the target transfer. The other party is also a user, and the other party device 300 is also a user device 200. By executing a predetermined program, the other party device 300 connects to the management device 100 and the operator device 400 to send and receive information on the functions of these devices, and receives instructions for these functions from the other party. .. For example, the counterparty device 300 receives and outputs a request notification (hereinafter, also simply referred to as “request notification”) indicating that the correction request has been made from the management device 100, or accepts an input of evaluation for the correction request. .. The predetermined program may be a Web application provided as standard in the other party device 300, or may be an information providing application.

If the first process or the second process is a process for transferring data or value, and both the user and the other party are the transfer source or the transfer destination transferor, the user device 200 and the other party device 300 are used by the transferor. It is also a transferor device.

The business operator device 400 is an information processing device used by a business operator that executes processing for an object such as value transfer or data manipulation. The operator is also a user of the retrieval infrastructure. In the present embodiment, an example will be described in which the business device 400 is a business device 400a used by the business A, a business device 400b used by the business B, and a business device 400c used by the business C. However, this is not the only purpose.

Business operator A is a business operator that issues A coin, which is a virtual currency. Business A executes a transaction using A coins. Business operator B is the business operator of the issuer of B-pay, which is electronic money. Business operator C is the business operator that issues C points. Business operator C executes a transaction using C points. The business operator device 400 performs processing for executing each business operator's transaction. Then, the business operator device 400 stores the executed transaction history (transfer history) in each storage unit.

At least a part of the user device 200, the other party device 300, and the operator device 400 may be, for example, an authorized person device described later. The user device 200, which is an authorized user device, the other party device 300, and the business operator device 400 receive key information divided from the management device 100 by the management device 100, and manage the received key information. Further, these devices transmit the key information to be managed to the management device 100 in response to a request such as agreement information from the management device 100. These devices may, for example, delete the transmitted key information. Here, the "agreement information" is information indicating the agreement of the authorized person or the like for reference / restoration of the first history information.

The third-party engine device 500 is an information processing device used by a third-party organization. The third-party engine device 500 may be, for example, an authorized person device. The third-party engine device 500 receives the key information from the management device 100, for example, and manages the received key information. Further, the third-party engine device 500 transmits the key information to be managed to the management device 100 in response to a request from the management device 100 such as agreement information. The third-party engine device 500 may, for example, delete the transmitted key information.

The "third-party institution" is an institution other than the user and the business operator related to the first processing. Third-party institutions are neutral institutions, such as auditors (supervisory agencies and scheme operators), lawyers, and TTPs (Trusted Tird Party). Further, the third party organization may be, for example, an organization other than the business operator related to the second processing.

<2. Overview>
An example of the outline of the information management system 1 will be described with reference to FIGS. 2 to 6. FIG. 2 is a scene of acquisition / storage of history information, FIG. 3 is a scene of reference of history information without correction, FIG. 4 is a scene of correction of history information, FIG. 5 is a scene of reference of history information before correction, and FIG. Now, an example of the outline of each scene of recovery of the history information before correction will be described.

<2-1. Acquisition and storage of history information>
An example of acquisition / storage of history information in the information management system 1 will be described with reference to FIG. As a premise, as shown in FIG. 2, it is assumed that the following value transfers (a) to (f) are executed between users 1 to 4.
(A) In the operator device 400a, after confirming the customer of user 1 (KYC), deposit money into the A coin account of user 1 (transferor: user 1).
(B) Remittance between A coin accounts of users 1 and 2 in the operator device 400a (transferor: users 1 and 2)
(C) In the operator device 400a and the operator device 400b, the amount specified from the user 2's A coin account is converted into B pay and transferred to the user 2's B pay account (transferor: user 2).
(D) In the business device 400b and the business device 400c, the amount specified from the user 2's B-pay account to the user 3's C point account is remitted (transferor: user 2.3).
(E) Remittance between C point accounts of users 3.4 in the operator device 400c (transferor is user 3.4)
(F) Withdrawal from the C point account of user 4 after confirming the customer of user 4 in order to settle the payment for the purchase of goods, etc. in the business device 400c (transferor: user 4).

(1) The acquisition unit 120 of the management device 100 receives the first history information (a) to (1) from the business device 400 used by each of the business operators A to C that execute the above-mentioned value transfer (a) to (f). F) to acquire. In this example, the first history information (a) to (f) is also simply referred to as "history (a) to (f)".

(2) The recording unit (not shown) of the management device 100 associates tag information representing at least one of value or value transfer with the history information of the transfer based on the acquired first history information. Record in the storage. The "history storage unit" referred to here is a storage unit that stores the latest history information, and may be a history storage unit 131 of the management device 100 described later, or may be a storage unit of an external device. .. Here, "tag information" is information representing at least one of value and transfer of value. In other words, the tag information is information that gives meaning to the items included in the history information.

For example, the recording unit may record the tag information "users 1 to 4" representing the account identification information of the transfer source or transfer destination in association with the history information of each transfer. For example, in the history (e), the tag information of the transfer source account identification information "user 3" and the tag information of the transfer destination account identification information "user 4" are associated with each other.

According to the above configuration, the management device 100 can search and extract what the user requests based on the tag information associated with the history information. Therefore, according to the above configuration, for example, the management device 100 does not need to normalize the history information for searching / extracting. Therefore, according to the above configuration, the management device 100 can perform search / extraction without unifying these formats even if the formats of the history information in the plurality of businesses are different.

<2-2. Providing history information>
An example of reference to the history information that has not been corrected in the information management system 1 will be described with reference to FIG. In the examples of FIGS. 3 to 6 including this example, the tag information is stored in the tag storage unit (in FIGS. 3 to 6, the tag storage unit is referred to as “tag DB”). Although the tag information and the history information have different storage locations (DB), they are stored in association with each other. The tag storage unit and the history storage unit may have different security levels set.

(1) As shown in FIG. 3, the user 4 has a first history of transfer regarding the user 3 in order to confirm how the value (C point) of the user 3 who has sent money to himself / herself has been transferred. Request the management device 100 to refer to the information. Specifically, the user 4 transmits a reference request requesting the history of transfer from the user device 200 to the management device 100. The request receiving unit 111 of the management device 100 receives this reference request from the user device 200.

(2) The acquisition unit 120 of the management device 100 searches the history storage unit (in FIGS. 3 to 6, the history storage unit is referred to as “history DB”) based on the tag information and the reference request of (1) above. .. In this example, the search key for searching the first history information of the transfer related to the user 3 is "user 3".

(3) The acquisition unit 120 of the management device 100 extracts and acquires the first history information of the transfer corresponding to the search key from the history storage unit. The management device 100 extracts and acquires the first history information (d) to which the tag information substantially matching the search key “user 3” is associated, for example. Further, the management device 100 extracts and acquires the second history information (e) related to the first history information together with the first history information (d). The "substantial match" here may include an exact match or a partial match between the character string or numerical value (hereinafter referred to as "character string or the like") indicated by the search key and the character string or the like of the tag information. Further, the substantially matching may include, for example, matching in a form in which fluctuations of each character string or the like are absorbed, in a form in which the character string or the like is rounded, or in a form in which the character string or the like has a range.

The "first history information" is history information relating to the history of the first process for data or value. Further, the "second history information" is history information relating to the history of the second processing for the data or value. The first history information and the second history information are associated and stored in the history storage unit. In this example, the first process is the above (d) "remittance from the user 2's B-pay account to the user 3's C point account", and the second process is the above (e) "user 3.4's C point". Remittance between accounts. "

(4) The providing unit 122 of the management device 100 provides the user device 200 with the extracted first history information (d) and (e). The user 4 confirms the provided first history information (d) on the user device 200, and the C point of the user 3 who has remitted to himself / herself is from the B pay account of the user 2 to the C point account of the user 3. You can see that it is related to what was sent to.

According to the above configuration, the management device 100 can provide a plurality of transfer histories acquired from the operator device 400 that are required according to the user's request. Therefore, according to the above configuration, the user can grasp the transfer of a plurality of targets at once.

<2-3. Correction of history information>
An example of correction of historical information in the information management system 1 will be described with reference to FIG.

(1) As shown in FIG. 4, when the user 3 confirms the first history information provided by the management device 100 by the provision request, it is found that the first history information is incorrect, so that the first history information Request the management device 100 to correct the above. In this example, in the first history information, it is assumed that the withdrawal amount when the remittance is made from the B-pay account of the user 2 to the C-point account of the user 3 is incorrect. It shall contain the information to identify the information and the correct withdrawal amount. The "information for specifying the first history information" may be, for example, information included in the history information shown in FIGS. 8 (a) and 9 (a) described later. Specifically, the user 3 transmits a correction request requesting correction to the first history information from the user device 200 to the management device 100. The request receiving unit 111 of the management device 100 receives the correction request from the user device 200.

(2) When the correction request of the above (1) is received, the acquisition unit 120 of the management device 100 acquires the user data regarding the transferee of the transfer indicated by the first history information. Specifically, the acquisition unit 120 is a request notification (hereinafter, simply "request notification") indicating that the correction request of the above (1) has been made to the other party device 300 of the other party from the viewpoint of the user 2 of the correction request source and the transfer source. In order to notify (also referred to as), the other party's e-mail address, the IP address of the other party's device 300, and the like are searched. As a result of the search, the acquisition unit 120 acquires user data (email address or IP address) regarding the transferee. User data is data about a user. Details of the user data will be described later.

(3) The first notification unit 116 of the management device 100 notifies the other party device 300 of the other party user 2 of the request notification based on the user data regarding the other party acquired in (2) above.

(4) The first evaluation reception unit 117 of the management device 100 evaluates the correction request of the above (1) as a response to the request notification of the above (2) from the other party device 300 (hereinafter, also referred to as "first evaluation"). ) Is accepted. Here, "evaluation of correction request" means, for example, evaluation of whether or not the other party agrees to the correction of the first history information for which correction is requested, and whether or not the content of the correction is valid. To do.

(5) The correction unit 114 of the management device 100 determines whether or not the first history information can be corrected based on the first evaluation received in (4) above. In this example, it is assumed that the correction unit 114 determines that the first history information can be corrected based on the correction request and the first evaluation in (4) above.

(6) The concealment unit 112 of the management device 100 conceals the first history information before correction by using the first key information. Here, the "first key information" is information including the first encryption key (denoted as "key A" in FIGS. 4 to 6) stored in the key storage unit. The first key information and the second key information described later are collectively referred to as "key information". The key information may be, for example, a token having the authority to use the encryption key instead of the encryption key itself. In the present embodiment, the encryption key will be described as a common key of a common key cryptosystem, but the purpose is not limited to this. The encryption key may be, for example, a pair of a public key and a private key of a public key cryptosystem, and in this case, the private key may be included in the key information. The concealment unit 112 encrypts the first history information before correction by using, for example, the first encryption key. The storage unit 113 stores (stores) the concealed first history information before correction in the backup storage unit (in FIGS. 3 to 6, the backup storage unit is referred to as “backup DB”). The "key storage unit" referred to here is a storage unit that stores the latest key information, and may be a key storage unit 132 of the management device 100 described later, or may be a storage unit of an external device. ..

(7) The correction unit 114 of the management device 100 performs a process for correcting the first history information based on the result of the determination in (5) above. In this example, the correction unit 114 corrects (changes) the withdrawal amount of the first history information to the correct withdrawal amount included in the correction request.

(8) The division unit 115 of the management device 100 divides the first key information into a plurality of authorized persons of the first history information by a process using the secret sharing method (hereinafter, also referred to as “secret sharing process”). do. Here, the "authorized person" is a person who has the authority for the first history information, and may be, for example, the person who has the authority for the first process indicated by the first history information. In this example, the authorized person is user 2 and user 3 for the sake of simplicity, but is not limited to this. In addition to user 2 and user 3, the authorized person is the B-pay operator B, the C-point operator C, and the third party who are involved in the remittance from the user 2's B-pay account to the user 3's C-point account. Personnel institutions, etc. may be included.

(9) The transmission unit 141 of the management device 100 transmits the result of the correction in (7) above and the divided first encryption key (denoted as "key A1" and "key A2" in FIGS. 4 to 6). , That is, transmission is performed to a plurality of authorized user devices of a plurality of authorized persons, that is, the user device 200 of the user 2 and the other device 300 of the user 3.

(10) The transmission unit 141 of the management device 100 deletes the transmitted first encryption key of the above (9) from the key storage unit.

According to the above configuration, the management device 100 conceals the history information before correction and distributes the key information to the authorized person to maintain confidentiality, and saves the history information before correction to complete the history information. It is possible to secure a certain degree of sex. Therefore, according to the above configuration, the management device 100 makes it possible to correct the history information while ensuring the confidentiality and completeness of the processing history information with respect to the data or the value.

<2-4. Refer to history information before correction>
An example of referencing the history information before correction in the information management system 1 will be described with reference to FIG.

(1) As shown in FIG. 5, the user 3 requests the management device 100 to refer to the first history information before correction. Specifically, the user 3 transmits a reference request (hereinafter, also referred to as “reference request”) requesting reference to the first history information before correction from the user apparatus 200. The request receiving unit 111 of the management device 100 receives this reference request from the user device 200. Further, it is assumed that the user device 200 includes the first encryption key (key A1) divided in (8) of FIG. 4 in the reference request.

(2) The acquisition unit 120 of the management device 100 receives the agreement of the user 2 (authorized person) for the reference of the reference request of the above (1) and the agreement information including the divided first encryption key from each of the plurality of authorized person devices. The request for this agreement information is transmitted to the other party device 300 of the user 2 in order to acquire the above. The agreement information may directly indicate the agreement of the authority, or may indirectly indicate the agreement of the authority by including the first encryption key owned by the authority.

(3) The acquisition unit 120 of the management device 100 acquires the agreement information transmitted from the other party device 300 as a response to the request of the above (2). Since the user 2 is the reference request source for the remaining authorized user 2, the management device 100 considers that the reference request source has agreed to the reference, and the reference request is regarded as the agreement information. You may.

(4) The release unit 121 of the management device 100 restores the original first encryption key (key A) based on the reference request in (1) above and the agreement information in (3) above. The release unit 121 restores the original first encryption key (key A) from the divided first encryption keys (key A1 and key A2) included in the reference request and the agreement information by secret sharing processing, for example. That is, the unlocking unit 121 collects the first encryption key divided from the authorized person device to form a consensus on the reference request from the authorized person.

(5) The release unit 121 of the management device 100 uses the first encryption key restored based on the reference request in (1) above and the agreement information in (3) above to conceal the first history information before correction. Release the concealment. The unlocking unit 121 decrypts the first history information before correction with the restored first encryption key (key A).

(6) The providing unit 122 of the management device 100 provides the user device 200 of the user 3 with the first history information before the correction whose concealment has been released in the above (4).

(7) The concealment unit 112 of the management device 100 generates second key information different from the first key information and stores it in the key storage unit. Here, the "second key information" is information including a second encryption key (denoted as "key A'" in FIGS. 4 to 6) different from the first encryption key stored in the key storage unit. The concealment unit 112 conceals the first history information before correction again with the generated second encryption key. The division unit 115 divides the concealed second encryption key for each authorized person. The transmission unit 141 transmits the divided second encryption key to each of the authorized person devices, and deletes another transmitted second encryption key from the key storage unit.

According to the above configuration, when referring to the first history information before correction, the management device 100 collects the divided first encryption keys from the authorized person to form a consensus on the reference, and then causes the user to refer to the first history information. be able to. Therefore, according to the above configuration, the management device 100 can allow the user to refer to the first history information before the correction while maintaining the confidentiality.

<2-5. Recovery of history information before correction>
An example of recovery of history information before correction in the information management system 1 will be described with reference to FIG.

(1) As shown in FIG. 6, when the correction in FIG. 4 is incorrect, the user 3 restores the original (history information before correction), so that the management device 100 recovers the first history information before correction. To request. Specifically, the user 3 transmits a recovery request (hereinafter, also simply referred to as “recovery request”) requesting recovery of the first history information before correction from the user device 200. The request receiving unit 111 of the management device 100 receives the recovery request from the user device 200.

(2) The acquisition unit 120 of the management device 100 receives the agreement information including the first encryption key divided from the agreement of the user 2 (authorized person) for the recovery of the recovery request of the above (1) from each of the plurality of authorized person devices. The request for this agreement information is transmitted to the other party device 300 of the user 2 in order to acquire the above.

(3) The acquisition unit 120 of the management device 100 acquires the agreement information transmitted from the other party device 300 as a response to the request of the above (2). Since the user 2 is the recovery request source for the remaining authorized user 2, the management device 100 considers that the recovery request source has agreed to the recovery, and regards the recovery request as the agreement information. You may.

(4) The release unit 121 of the management device 100 restores the original first encryption key (key A) based on the restoration request of (1) above and the agreement information of (3) above. The release unit 121 restores the original first encryption key (key A) from the divided first encryption keys (key A1 and key A2) included in the reference request and the agreement information by secret sharing processing, for example. That is, the unlocking unit 121 collects the first encryption key divided from the authorized person device to form a consensus on the recovery request from the authorized person.

(5) The release unit 121 of the management device 100 is the first history information before correction, which is concealed by the first encryption key restored based on the recovery request of (1) above and the agreement information of (3) above. Release the concealment. Specifically, the release unit 121 decrypts the first history information before correction with the restored first encryption key (key A).

(6) The concealment unit 112 of the management device 100 generates a second encryption key (key A') and conceals the corrected first history information using the generated second encryption key. The storage unit 113 stores the concealed first history information after correction in the backup storage unit. After that, the division unit 115 divides the concealed second encryption key for each authorized person. The transmission unit 141 transmits the divided second encryption key to each of the authorized person devices, and deletes the transmitted second encryption key from the key storage unit.

(7) The recovery unit 123 of the management device 100 restores the first history information before correction, which has been released from secrecy, to the history storage unit 131.

(8) In the restoration of the above (7), the restoration unit 123 of the management device 100 reassociates the first history information before the correction with the second history information.

According to the above configuration, when recovering the first history information before correction, the management device 100 can recover after forming a consensus on the recovery by collecting the divided first encryption keys from the authorized person. can. Therefore, according to the above configuration, the management device 100 can recover the first history information before the correction while maintaining the confidentiality.

According to the above configuration, the management device 100 conceals the corrected history information and distributes the key information to the authorized person to maintain confidentiality, and the corrected history information is not erased by overwriting and updating. By saving, the completeness of the history information can be ensured to a certain extent. Therefore, according to the above configuration, the management device 100 makes it possible to correct the history information while ensuring the confidentiality and completeness of the processing history information with respect to the data or the value.

<3. Functional configuration>
The functional configuration of the management device 100 according to the present embodiment will be described with reference to FIG. 7. As shown in FIG. 7, the management device 100 includes a control unit 110, a storage unit 130, and a communication unit 140.

The control unit 110 includes a request reception unit 111, a concealment unit 112, a storage unit 113, a correction unit 114, and a division unit 115. Further, the control unit 110 is, for example, a first notification unit 116, a first evaluation reception unit 117, a second notification unit 118, a second evaluation reception unit 119, an acquisition unit 120, a release unit 121, a provision unit 122, or a restoration unit 123. May be provided. Further, the control unit 110 may include, for example, a recording unit (not shown).

-Request reception department-
The request receiving unit 111 receives a correction request from the user device 200 of the user requesting correction of the first history information regarding the history of the first processing for the data or the value.

The mode in which the request receiving unit 111 receives various requests including a correction request may be any mode. The request receiving unit 111 may receive, for example, a message indicating this correction request from the user device 200 via the communication unit 140. Further, the request receiving unit 111 may allow the user to input and receive an information request from the screen of the information management service (screen of the information providing application or Web browser) displayed by the user device 200. Further, the request receiving unit 111 may receive this information request by, for example, the user device 200 using the API or SDK library implemented by the management device 100.

The request receiving unit 111 may, for example, receive various requests from the user device 200 that specify a search key regarding the transfer history of the correction target or the reference target.

Here, a configuration example of history information including the first history information and the second history information will be described with reference to FIGS. 8 to 9.

As shown in FIG. 8A, for example, in the case of a transfer for which the first process or the second process is the target, the history information includes the transfer identification information and transfer of each transfer issued for each business operator as the transfer history. Relocation date and time indicating the date and time of execution, account identification information of the transfer source / destination, relocation location indicating the device where the transfer was executed, relocation details, related history indicating the history of processing related to relocation, and related data indicating data related to relocation. Data, other external information, authorized persons, etc. may be included.

The transfer identification information may be, for example, a reference number for each business operator, a reference number for a remittance transaction, a slip number for a sales slip, or the like. The account identification information may be, for example, the transferee name or recipient name of the transfer, the customer ID or account number issued by the first business operator to the customer, or the like.

The history information may include, for example, credit information. Here, "credit information" is information indicating the credit of the parties involved based on the transfer. Here, the “participant” is a person involved in the transfer, for example, a user who is the transferor of the transfer source / destination, a business operator who executes the transfer, and the like. At least some of the participants may be, for example, the other party or an authorized person. Credit information includes, for example, the history of approval or refusal of value transfer, the history of evaluation at the time of transaction (evaluation from business parties such as "like"), the result of customer confirmation / corporate confirmation at the time of transfer, It may include external information such as home delivery and mail order. The credit information may be, for example, the credit status of the user when using the credit card in the case of transfer by credit card payment.

For the history information, the authority level for the history information may be set for each authorized person. "Authority level" refers to the degree of authority for reference / recovery of history information. For example, the authority level is set in three stages of "upper", "standard", and "lower". When the authority level is "lower", only the reference request for the history information is possible, and when the authority level is "standard", the reference of the history information is possible. In addition to the request, a correction request is possible, and in the case of "upper level", in addition to the reference request / correction request, the divided key information is owned and the concealed history information is de-concealed (for example, decryption). It may be possible.

The permission level may be, as another example, an access permission level for accessing historical information. For example, the access authority level is set in three stages of "upper", "standard", and "lower". If the access authority level is "lower", only the history information can be referenced, and if it is "standard", the history information can be referenced. In addition, correction is possible, and in the case of "upper level", in addition to reference / correction, reference / change of definition information of history information (reference / change of history information format, access authority level, etc.) and storage of history information ( Backup) etc. may also be possible.

In the present embodiment, the authority level "upper" is set as "upper authority", the authority level "standard" is set as "standard authority", and the authority level "lower" is set. An authorized person is called a "lower authority person". For example, the higher authority may be a third party organization, the standard authority may be a business operator or a person involved in the first processing (transfer source / transfer destination transferor, etc.), and the lower authority may be another user. Hereinafter, the "authorized person" may be limited to a higher-level authority person, a higher-level authority person, and a standard authority person, for example, based on the characteristics of the history information (for example, confidentiality, etc.). Further, as another example, the higher authority may include the requester of the reference request / correction request and the user of the first process. With such a configuration, it is possible to prevent an arbitrary reference or correction of information by the business operator.

As shown in FIG. 8 (b), the tag information associated with the history information in FIG. 8 (a) may be, for example, a person involved (authorized person), transfer date / time, transaction type, authentication type, transfer location, or the like. good.

As shown in FIG. 9A, for example, when the first process or the second process is a data operation, the history information includes the data operation history, the data to be operated, other external information, etc. as the transfer history. It may be included.

As shown in FIG. 9B, the tag information associated with the history information of FIG. 9A and representing the data is, for example, an operation indicating a person involved (authorized person) and the date and time when the operation was executed. It may be an operation location indicating the date and time, the operation type, or the location where the operation was executed.

The user data, which is the data related to FIG. 8 (a) and the data to be operated in FIG. 9 (a), is, for example, user identification information, name, telephone number, address, e-mail address, and personal number for identifying the user. It may include so-called personal information of the user such as (My Number), gender, or date of birth.

The user data may include, for example, a license number, a card number, account data of an account held by the user, and device information (for example, MAC address, IP address, serial number, etc.) of the user apparatus 200 used by the user.

The user data may include, for example, biological information regarding the biological characteristics of the user (for example, user's face image data, fingerprint information, eyeball iris information, voiceprint information, etc.).

The user data may include, for example, location information (for example, GPS data, etc.), Web history information (for example, browsing history, search history, cookie information, etc.), purchase history information of products on an EC site, and the like.

The “transaction data”, which is the related data in FIG. 8 (a) and the data to be operated in FIG. 9 (a), is the data related to the transaction in the transfer by the transaction. The transaction data includes, for example, "transaction identification information" for identifying the transaction to be paid, a payer name indicating the name of the customer who is the payer, a payee name indicating the name of the payee, and a payment settlement status (for example, "". Payment indicating "not billed" / "billing completed" / "payment settlement instruction completed" / "payment completed", etc.) Payment status, service name or product name to be paid, payment amount indicating the amount to be paid in the transaction to be paid (settlement) Amount), a payment method representing a payment method such as card payment, electronic money payment or bank transfer, transaction time indicating the time when the transaction was made, transaction place indicating the place where the transaction was made, and other data items may be included. .. The transaction data may also include data items relating to the account data of the payer's account or the payee's account.

The related data in FIG. 8A and the data to be operated in FIG. 9A, "account data", are information for managing each account. The account data includes, for example, bank identification information for identifying the target bank, account type, account number, name, account ID for identifying the account owned by the payer or recipient, the total amount deposited in the account, etc. Includes the account balance indicating the account balance of, or the transaction content indicating the content of the transaction using the account.

The transaction content includes, for example, a deposit / withdrawal history. The deposit / withdrawal history includes, for example, a deposit / withdrawal ID for identifying each deposit / withdrawal, an ID of a bank card used for deposit / withdrawal, an ID indicating a deposit / withdrawal partner of a credit card company, etc. in the case of credit card withdrawal. Includes the customer ID shown, the deposit / withdrawal date / time indicating the date and time of deposit / withdrawal, the deposit amount indicating the amount deposited in the account, or the withdrawal amount indicating the amount withdrawn from the account.

Returning to FIG. 7, the description will be continued. The request receiving unit 111 may, for example, receive a reference request from the user device 200 for requesting reference to the history information including the first history information before correction.

The request receiving unit 111 may receive, for example, a recovery request from the user device 200 requesting the recovery of the first history information before correction.

− Concealment Department−
The concealment unit 112 conceals the first history information before / after the correction by using the first key information stored in the key storage unit 132. For example, when the first key information is the first encryption key, the concealment unit 112 encrypts the first history information before and after the correction by using the first encryption key.

For example, the concealment unit 112 may conceal information that can identify an individual with respect to the first history information before / after correction. The concealment unit 112, for example, with respect to the first history information before / after correction, (1) deletes a data item related to personal information or deletes a cell contained in the data item, and (2) all data related to personal information. Or part of it is abstracted, (3) generalization that replaces data related to personal information by higher-level conceptualization or numerical shortening, (4) top or bottom coding for data related to personal information, (5) data exchange of data related to personal information Or, (6) concealment processing may be performed by adding noise (error) to the data related to personal information.

For example, the concealment unit 112 may conceal each of the first history information before correction divided by the division unit 115 described later by using the first key information.

For example, when the concealment unit 112 recovers the first history information before correction by the recovery unit 123 described later, the concealment unit 112 uses the first history information after correction and the second key information stored in the key storage unit 132. It may be concealed.

-Preservation part-
The storage unit 113 stores the first history information before correction, which is concealed by the concealment unit 112, in the backup storage unit 133 (denoted as “bk storage unit” in FIG. 7).

The storage unit 113 may store, for example, the first history information before correction, which is concealed and divided by the concealment unit 112, in the backup storage unit 133.

According to the above configuration, since the first history information before the correction, which is concealed by the concealment unit 112, is stored, the completeness of the history information can be guaranteed to some extent even if the correction is performed.

The storage unit 113 may store, for example, the corrected first history information concealed by the concealment unit 112 in the backup storage unit 133.

-Correction part-
The correction unit 114 refers to the history storage unit 131 based on the correction request received by the request reception unit 111, and performs a process for correcting the first history information.

The correction unit 114 may perform a process for correcting the first history information, for example, based on the first evaluation received by the first evaluation reception unit 117. For example, when all of the first evaluations are "agree with the correction requested by the correction request", the correction unit 114 performs a process for correcting the first history information. On the other hand, if a part of the first evaluation is "I do not agree with the correction requested by the correction request", the correction unit 114 does not perform the process for correcting the first history information. good.

According to the above configuration, even if a false correction request is made, the correction unit 114 makes a correction based on the first evaluation of the other party or the authority for the correction request, so that the false correction can be suppressed. ..

For example, when the correction unit 114 performs a process for correction, the correction unit 114 cancels the association between the first history information before the correction and the second history information, and the first history information after the correction is referred to as the second history information. It may be associated and stored in the history storage unit 131.

For example, in the case of a data structure (for example, when using RDB or the like) in which the first history information before correction is overwritten and updated with the first history information after correction so that the association with the second history information can be inherited as it is. Does not lose its association with the second history information. However, when the association with the second history information cannot be inherited before and after the correction in the correction of the first history information (for example, when using a file system that manages the first history information before and after the correction as a separate file), the first 2 There is a possibility that the association with the history information will disappear. According to the above configuration, in the data configuration in which the association cannot be inherited, the corrected first history information is stored in the history storage unit 131 in association with the second history information, so that the first history information and the second history It is possible to avoid losing the association with information.

The correction unit 114 may perform a process for correcting the first history information, for example, based on the evaluation received by the second evaluation reception unit 119 (hereinafter, also referred to as “second evaluation”). The correction unit 114 performs a process for correcting the first history information when, for example, a predetermined number or more of the second evaluation "agrees with the correction requested by the correction request". On the other hand, the correction unit 114 performs a process for correcting the first history information when, for example, a predetermined number or more of the second evaluation "does not agree with the correction requested by the correction request". It may not be done. The second evaluation is the evaluation of the transferor of the transfer associated with the first process to be corrected if the second process is a process for transferring data or value. Therefore, the correction unit 114 may change the conditions for making corrections (hereinafter, also referred to as “correction conditions”) between the first evaluation and the second evaluation, and typically the correction of the first evaluation. The conditions may be stricter than the correction conditions of the second evaluation.

When correcting historical information, there is a risk that false corrections will be made in response to false correction requests, resulting in inconsistency with related transactions. According to the above configuration, such a risk can be reduced because the correction is made based on the second evaluation of the transferor of the transfer of the related transaction.

-Division-
The division unit 115 divides the first key information for each of a plurality of authorized persons of the first history information. For example, the division unit 115 may divide the first encryption key included in the first key information into each of a plurality of authorized persons of the first history information by secret sharing processing.

For example, the division unit 115 may divide the first key information into a plurality of higher-level authorized persons for which an authority level equal to or higher than a predetermined authority level is set among the plurality of authorized persons.

For example, the division unit 115 may divide the second key information for each of a plurality of authorized persons.

-First notification unit-
The first notification unit 116 is a process for transferring data or value in the first process, and when a correction request is received by the request reception unit 111, the transferor device of the transfer source or the transfer destination of the transfer (the transferor device ( Notify the other party device 300) or the authorized person device of a request notification indicating that this correction request has been made. The mode in which the first notification unit 116 and the second notification unit 118 described later notify the transferor device, the authorized person device, and the like of various information including the request notification may be any mode. For example, the first notification unit 116 or the like may transmit information for push notification of the request notification to the other party device 300, and display it as an alert message on the screen of the other party device 300 based on the information. The first notification unit 116 or the like may, for example, notify the other party device 300 by outputting a correction request to the screen of the information management service. Further, the first notification unit 116 and the like may, for example, send an e-mail notifying that the correction request has been made to the e-mail address of the other party.

The first notification unit 116, for example, is a process for transferring data or value in the first process, and when a correction request is received by the request reception unit 111, the first notification unit 116 informs the transferor device of the transferor or the transferee of the transfer destination. In addition / instead, the request notification may be notified to the terminal device of the person who has made a transaction with the other party of the transfer under predetermined approximate conditions. Here, the "predetermined approximate condition" is a condition for determining whether or not the transaction is a transfer or the like performed in a situation similar to the transfer to be corrected (for example, transaction time, transaction place, etc. included in the transaction data). Is.

-First evaluation reception department-
The first evaluation reception unit 117 receives the first evaluation for the correction request as a response to the request notification notified by the first notification unit 116 from the other party device 300 or the authorized person device. The mode in which the first evaluation receiving unit 117 receives the first evaluation may be any mode as in the request receiving unit 111.

-Second notification unit-
The second notification unit 118 is a transfer source or transfer destination of the second process when the correction request is received by the request reception unit 111 and the first history information is stored in association with the second history information. Notify the transferor device (counterpart device 300) and the authorized person device of the transferor of a request notification indicating that the correction request has been made.

According to the above configuration, the second notification unit 118 may be a transferor of the second history information transfer, for example, when it is necessary to correct the second history information of the transaction transfer related to the first history information. The authorized person can also be notified of the request notification indicating that the correction request has been made. Therefore, according to the above configuration, the second notification unit 118 can urge the transferor of the second process to make corrections in order to eliminate the inconsistency between the first process and the second process.

-Second evaluation reception department-
The second evaluation reception unit 119 receives the second evaluation for the correction request as a response to the request notification notified by the second notification unit 118 from the transferor device or the authorized person device. The mode in which the second evaluation receiving unit 119 accepts the second evaluation may be any mode as in the request receiving unit 111.

-Acquisition part-
The acquisition unit 120 acquires the agreement of the authority for the reference of the reference request and the agreement information including the first key information divided by the division unit 115 from each of the plurality of authority devices. The mode for acquiring various information including the agreement information in the acquisition unit 120 may be any mode. For example, the acquisition unit 120 may receive a data file indicating the agreement information from the authorized person device via the communication unit 140, or may remotely access the authorized person device to acquire the data file indicating the agreement information. good.

The acquisition unit 120 may acquire, for example, the agreement of the authorized person for the recovery of the first history information before the correction and the agreement information including the divided first key information from each of the plurality of authorized persons' devices.

The acquisition unit 120 acquires history information regarding the history of these processes from a plurality of business operator devices 400 used by each of the plurality of business operators that execute the first process and the second process. The acquisition unit 120 may, for example, receive a data file indicating agreement information from the operator device 400 via the communication unit 140, or remotely access the operator device 400 to acquire a data file indicating history information. You may.

As another example of the above aspect, the acquisition unit 120 instructs the management device 100 to provide the history information stored in the management device 400 to the library provided by the API or SDK implemented by the management device 100 or the business device 400. You may. The acquisition unit 120 may acquire history information from the API or the library as a response to this instruction.

For example, the acquisition unit 120 may acquire consent information from the business operator device 400 or the user device 200 on the premise of acquiring the history information. Here, the "consent information" refers to the provision of transfer history information regarding a business operator's customer (for example, users 1 to 4 in the example of FIG. 2) from the business operator's device 400 to the management device 100. This is information indicating that the user agrees. The consent information may include, for example, matters to be agreed. The items to be agreed are, for example, whether or not at least a part of the history information can be provided, whether or not it can be used at the provider, or its use when at least a part of the first history information is provided and used as "possible". The purpose (for example, provision / disclosure to a third party, etc.) may be included.

The timing for the acquisition unit 120 to acquire the consent information is (a) when the customer of the business operator registers as a user of the information management service, and (b) when the application installed on the user device 200, terms of use, etc. are changed. , (C) Each time the value transfer is executed, etc., the timing can be considered.

The acquisition unit 120 may extract information such as user data, transaction data, or account data from the acquired history information. As another example, the acquisition unit 120 may acquire user data, transaction data, account data, or the like from the business operator device 400 or the user device 200 in addition to the first history information.

-Release part-
Based on the reference request and the agreement information, the release unit 121 refers to the backup storage unit 133 to release the concealment of the concealed first history information before correction.

The release unit 121 restores the original first encryption key from the divided first encryption key included in the reference request and the agreement information by secret sharing processing, for example. The unlocking unit 121 decrypts the first history information before correction by using the restored first encryption key.

The release unit 121 may release the concealment of the first history information before correction, which has been concealed, by referring to the backup storage unit 133, for example, based on the recovery request and the agreement information.

The release unit 121 restores the original first encryption key from the divided first encryption key included in the recovery request and the agreement information by secret sharing processing, for example. The unlocking unit 121 decrypts the first history information before correction by using the restored first encryption key.

The release unit 121 may include a restoration unit (not shown). The first key information may include history restoration information for restoring the first history information before the correction divided by the division unit 115 before the division. The history restoration information may be, for example, the first history information (distributed piece) before correction divided by the secret sharing process. The restoration unit divides the first history information before correction, which has been released from secrecy and divided, based on the first key information including the history restoration information acquired from the authorized person's device. Restore before.

According to the above configuration, the first history information itself can be divided and restored after consensus building of the authorized person. Therefore, according to the above configuration, the confidentiality of the history information can be further improved when the first history information is corrected.

-Providing department-
The providing unit 122 provides the user device 200 of the requesting source with the first history information before correction, which has been released from concealment by the releasing unit 121. Any mode may be used in which the providing unit 122 provides various types of information including the first history information. The providing unit 122 may transmit, for example, a data file or a message including link information for accessing the first history information to the user apparatus 200. As another example, the providing unit 122 may make the user device 200 refer to the first history information on the screen of the information management service.

According to the above configuration, the providing unit 122 can provide the first history information before correction to the requesting user device 200 after forming a consensus among the authorized persons. Therefore, according to the above configuration, the providing unit 122 can ensure the confidentiality of the history information and also ensure its availability (making it possible to refer to the first history information before correction).

-Recovery department-
The recovery unit 123 restores the first history information before correction, which has been released from secrecy, to the history storage unit 131. For example, the recovery unit 123 may update the corrected first history information of the history storage unit 131 with the first history information before correction.

According to the above configuration, when recovering the first history information before correction, it is possible to recover after consensus building of the authorized person. Therefore, according to the above configuration, the providing unit 122 can ensure the confidentiality of the history information and also ensure its availability (making it possible to recover the first history information before correction).

-Recording unit-
Based on the history information acquired by the acquisition unit 120, the recording unit records the tag information in the tag storage unit in association with the history information. There may be a plurality of tag information associated with the history information by the recording unit.

For example, in the example shown in FIG. 2, the recording unit stores the transfer of value by remittance (a), (d), and (e) by associating each history information with tag information indicating the transaction type "remittance transaction". You may.

For example, the recording unit may record tag information representing a person involved in the transfer in association with the first history information of the transfer. The participants in the transfer may include, for example, the transferor of the transfer source or the transfer destination when the first process or the second process is a transfer.

The first process may include the first transfer and the second process may include the second transfer. For example, the recording unit may record the first history information of the first transfer and the second history information of the second transfer in the history storage unit 131 in association with each other.

-Memory unit-
The storage unit 130 stores history information, tag information, user data, transaction data and / or account data and the like. The storage unit 130 may store each information by using a database management system (DBMS), or may store each information by using a file system. When using the DBMS, the storage unit 130 may provide a table for each of the above information and manage each information by associating the tables with each other. The storage unit 130 includes a history storage unit 131, a key storage unit 132, and a backup storage unit 133. The history storage unit 131, the key storage unit 132, and the backup storage unit 133 may be set to different security levels. The storage unit 130 may include, for example, a tag storage unit.

The history storage unit 131 stores the first history information and the second history information in association with each other. Further, the history storage unit 131 may store the history information in association with the tag information stored in the tag storage unit, for example.

-Communication unit-
The communication unit 140 transmits and receives various information and various data to and from the user device 200, the other party device 300, the operator device 400, and other devices of the external system via the network N. The communication unit 140 receives, for example, history information from the operator device 400 or a reference request from the user device 200 via the network N. The communication unit 140 transmits the history information to the user apparatus 200 as a result of the reference to the reference request, for example, via the network N. The communication unit 140 includes a transmission unit 141.

− Transmitter −
The transmission unit 141 transmits the first key information divided by the division unit 115 to each of the plurality of authorized person devices of the plurality of authorized persons, and deletes the transmitted first key information from the key storage unit 132.

According to the above configuration, confidentiality can be ensured to a certain extent by concealing the history information before correction and distributing the key information to authorized persons. Therefore, according to the above configuration, it is possible to correct the history information while ensuring the confidentiality of the processing history information with respect to the data or value.

For example, the transmission unit 141 transmits the first key information divided by the division unit 115 to each of the plurality of privileged devices of the plurality of higher-level authorized persons, and the transmitted divided first key information is stored in the key storage unit. It may be deleted from 132.

For example, in cases where there are many authorized persons, it may be difficult to reach consensus by distributing key information to all authorized persons. According to the above configuration, in such a case, the history information before correction can be concealed and the key information can be distributed only to the upper authority. Therefore, according to the above configuration, it is possible to ensure the confidentiality of the history information to a certain extent and the availability to a certain extent. Therefore, according to the above configuration, the management device 100 can correct the history information while ensuring the confidentiality and availability of the processing history information with respect to the data or value.

For example, the transmission unit 141 transmits the second key information divided by the division unit 115 to each of the plurality of authorized devices, and deletes the transmitted divided second key information from the key storage unit 132.

According to the above configuration, confidentiality can be ensured to a certain extent by concealing the corrected history information and distributing the key information to authorized persons. Therefore, according to the above configuration, the management device 100 makes it possible to recover the history information before correction while ensuring the confidentiality of the processing history information with respect to the data or value.

<4. Operation example>
An operation example of the management device 100 will be described with reference to FIGS. 10 to 11. FIG. 10A is a flow chart showing a flow of processing in the management device 100 from the acquisition of history information from the operator device 400 to the recording of the acquired first history information. FIG. 10B is a flow chart showing a flow of processing from receiving a reference request from the user device 200 to providing the first history information in the first history information that has not been corrected in the management device 100. Is. FIG. 11 is a flow chart showing a flow of processing in the management device 100 from receiving a correction request from the user device 200 to correcting the first history information. The order of processing shown below is an example, and may be changed as appropriate.

As shown in FIG. 10 (a), the acquisition unit 120 of the management device 100 is from a plurality of operator devices 400 used by each of the plurality of operators performing the transfer of objects including at least one of data or value. Acquire the first history information (S10).

Based on the first history information acquired by the acquisition unit 120, the recording unit records tag information representing at least one of the target or the transfer in the history storage unit 131 in association with the first history information of the transfer (S11). ).

As shown in FIG. 10B, the request receiving unit 111 of the management device 100 receives a reference request from the user device 200 by designating a search key related to the transfer history and requesting a reference to the transfer history (S20). ..

Based on the tag information and the reference request received by the request receiving unit 111, the providing unit 122 refers to the history storage unit 131 and extracts the first history information of the transfer corresponding to the search key (S21).

The providing unit 122 provides the extracted first history information to the requesting user device 200 (S22).

As shown in FIG. 11, the request receiving unit 111 of the management device 100 refers to the history storage unit 131 and receives a correction request requesting correction of the first history information from the user device 200 (S30).

The concealment unit 112 conceals the first history information before correction by using the first key information stored in the key storage unit 132 (S31). The storage unit 113 stores the concealed first history information before correction in the backup storage unit 133 (S32).

Based on the correction request, the correction unit 114 refers to the history storage unit 131 that stores the first history information, and performs a process for correcting the first history information (S33). The division unit 115 divides the first key information for each of a plurality of authorized persons of the first history information (S34).

The transmission unit 141 transmits the divided first key information to each of the plurality of authorized person devices of the plurality of authorized persons (S35). The transmission unit 141 deletes the transmitted first key information from the key storage unit 132 (S36).

<5. Hardware configuration>
An example of the hardware configuration in the case where the management device 100 described above is realized by the computer 800 will be described with reference to FIG. The function of each device can be realized by dividing it into a plurality of devices.

As shown in FIG. 12, the computer 800 includes a processor 801 and a memory 803, a storage device 805, an input I / F unit 807, a data I / F unit 809, a communication I / F unit 811 and a display device. Includes 813.

The processor 801 controls various processes in the computer 800 by executing a program stored in the memory 803. For example, each functional unit or the like included in the control unit 110 of the management device 100 can be realized by the processor 801 executing a program temporarily stored in the memory 803.

The memory 803 is, for example, a storage medium such as a RAM (Random Access Memory). The memory 803 temporarily stores the program code of the program executed by the processor 801 and the data required when the program is executed.

The storage device 805 is a non-volatile storage medium such as a hard disk drive (HDD) or a flash memory. The storage device 805 stores an operating system and various programs for realizing each of the above configurations. In addition, the storage device 805 can also store a table for registering various information and various data such as history information and user data, and a DB for managing the table. Such programs and data are referred to by the processor 801 by being loaded into the memory 803 as needed.

The input I / F unit 807 is a device for receiving input from the user. Specific examples of the input I / F unit 807 include a keyboard, a mouse, a touch panel, various sensors, a wearable device, and the like. The input I / F unit 807 may be connected to the computer 800 via an interface such as USB (Universal Serial Bus).

The data I / F unit 809 is a device for inputting data from the outside of the computer 800. Specific examples of the data I / F unit 809 include a drive device for reading data stored in various storage media. It is also conceivable that the data I / F unit 809 is provided outside the computer 800. In that case, the data I / F unit 809 is connected to the computer 800 via an interface such as USB.

The communication I / F unit 811 is a device for performing data communication via the Internet N by wire or wirelessly with an external device of the computer 800. It is also conceivable that the communication I / F unit 811 is provided outside the computer 800. In that case, the communication I / F unit 811 is connected to the computer 800 via an interface such as USB.

The display device 813 is a device for displaying various information. Specific examples of the display device 813 include a liquid crystal display, an organic EL (Electro-Luminescence) display, a display of a wearable device, and the like. The display device 813 may be provided outside the computer 800. In that case, the display device 813 is connected to the computer 800 via, for example, a display cable or the like. Further, when the touch panel is adopted as the input I / F unit 807, the display device 813 can be integrally configured with the input I / F unit 807.

[Second Embodiment]
Next, a second embodiment of the present invention (hereinafter, referred to as "the present embodiment") will be described. The first embodiment is a form in which the key information is distributed and managed for each of a plurality of authorized persons, but in the present embodiment, in addition to the distributed management of the key information, the management of the key information is outsourced to a third party. Is a form that can be selected. Hereinafter, the points different from those of the first embodiment will be mainly described.

<1. System configuration>
In the management system 1a according to the present embodiment, one of the following management methods (a) and (b) can be manually or automatically selected as the key information management method.
(A) The key information divided for each of a plurality of authorized persons is distributed and managed in each of the plurality of authorized persons' devices. (B) The key information is managed only by a third party (the key information is not divided).

The management device 100a according to the present embodiment accepts, for example, from an authorized person device or the like, a selection of which of the above (1) and (2) management methods is to be adopted. Further, the management device 100a determines whether or not to divide the key information and where to set the management destination (transmission destination) of the key information based on the received selection. Based on the result of this determination, the management device 100a divides the key information (or does not divide it) or transmits the key information to the management destination.

The third-party engine device 500 receives, for example, undivided key information from the management device 100, and manages the received key information. Further, the third-party engine device 500 transmits the key information to be managed to the management device 100 in response to a request from the management device 100 such as agreement information. The third-party engine device 500 may, for example, delete the transmitted key information.

<2. Functional configuration>
An example of the functional configuration of the management device 100a according to the present embodiment will be described with reference to FIG. As shown in FIG. 13, the control unit 110 of the management device 100a includes a request reception unit 111, a concealment unit 112, a storage unit 113, a correction unit 114, and a division unit 115 of the control unit 110 of the management device 100. , The first notification unit 116, the first evaluation reception unit 117, the second notification unit 118, the second evaluation reception unit 119, the acquisition unit 120, the release unit 121, the provision unit 122, and the restoration unit 123. In common. The control unit 110 of the management device 100a includes a selection reception unit 124 and a selection unit 125 in addition to these functional units.

The selection reception unit 124 divides the key information from at least one of the authorized person devices and stores it in a plurality of authorized person devices (the management method of (a) above), a user, and a business related to the first process. Accepts the choice of storing in the third-party institution device 500 of a third-party institution other than the person (the management method of (b) above).

The selection unit 125 divides the key information based on the characteristics of the first history information and stores it in a plurality of authorized person devices (the management method of (a) above), and a business related to the user and the first process. Select either storage in a third-party institution device 500 of a third-party institution other than the person (management method in (b) above).

The "characteristics of the first history information" are, for example, the confidentiality of the first history information (whether or not personal information to be kept secret is included, the disclosure level, etc.), the execution date and time of the first process indicated by the first history information. (History recording date and time), the execution subject of the first process indicated by the first history information, or the classification of the first process (whether the target is data or value, and the first process is value transfer or data Operation etc.) etc.

"Disclosure level" indicates the degree of information disclosure of historical information. For example, when the first process is an identity verification process, the disclosure level may be indicated in three stages of 1 to 3 as follows. The disclosure levels 1 to 3 indicate that the larger the value at the end, the higher the degree of disclosure.
-Disclosure level 1: Log showing only that the process has been executed (for example, "yy month dd day: identity verification process is executed")
-Disclosure level 2: The execution of the process and the log including the execution result (OK / NG) (for example, "yy month dd day: the identity verification process is executed and the identity verification is successful")
-Disclosure level 3: Data to be processed (target data) (for example, image data of the license used in the identity verification process)

For example, when the selection reception unit 124 accepts the selection to be stored in the third party engine device 500, that is, the selection to adopt the management method (b), the transmission unit 141 does not cause the division unit 115 to divide the key information. Then, the key information may be transmitted to the third party organization 500, and the transmitted key information may be deleted from the key storage unit 132. Further, for example, when the selection unit 125 selects to save the key information in the third party engine device 500, the transmission unit 141 transmits the key information to the third party organization 500 without causing the division unit 115 to divide the key information. , The transmitted key information may be deleted from the key storage unit 132.

The acquisition unit 120 may acquire the agreement information including the third party's agreement on the reference / recovery of the first history information and the undivided key information from the third party engine device 500, for example.

For example, the acquisition unit 120 may acquire the agreement information that does not include the key information and includes the agreement of the authority for the reference / recovery reference of the first history information from each of the plurality of authorized devices.

It should be noted that the above-described embodiment is an example for explaining the present invention, and the present invention is not intended to be limited only to the embodiment. Further, the present invention can be modified in various ways as long as it does not deviate from the gist thereof. Further, those skilled in the art can adopt an embodiment in which each element described below is replaced with an equal one, and such an embodiment is also included in the scope of the present invention.

[Modification example]
Although the present invention has been described based on the above-described embodiment, the following cases are also included in the present invention.

[Modification 1]
At least a part of each configuration included in the management devices 100 and 100a according to the above embodiment may be provided in the operator device 400. For example, the functions of the request receiving unit 111 and the providing unit 122 of the management device 100 may be implemented in the operator device 400.

[Modification 2]
The secret sharing method of the secret sharing process used by the dividing unit 115, the releasing unit 121, etc. of the management device 100 according to the above embodiment may be, for example, the (t, n) threshold method. In the (t, n) threshold method, for example, when the division unit 115 divides the encryption key including the first encryption key and the second encryption key and the history information into n pieces, t or more divided encryption keys The unlocking unit 121 can restore the encryption key before the division by collecting the history information and the history information. For example, in the division unit 115, t may be set by the number of all authorized persons, and n may be set by the number of higher authorized persons among the authorized persons.

[Modification 3]
Although not shown in the above embodiment, the history information may be distributed and managed by a plurality of devices using, for example, a distributed ledger technology (blockchain technology). For example, when the history information is distributed and managed by using the distributed ledger technology, the management device 100 is composed of a plurality of devices, and the history information is distributed and managed by the plurality of devices. Further, in such a case, the third party organization that manages the key information may be a virtual currency exchange.

1 ... Information management system, 100, 100a ... Management device, 110 ... Control unit, 111 ... Request reception unit, 112 ... Concealment unit, 113 ... Storage unit 113, 114 ... Correction unit, 115 ... Division unit, 116 ... First Notification unit 117 ... 1st evaluation reception unit, 118 ... 2nd notification unit 118, 119 ... 2nd evaluation reception unit, 120 ... acquisition unit, 121 ... release unit, 122 ... provision unit, 123 ... recovery unit, 130 ... memory Unit, 140 ... Communication unit, 200 ... User device, 300 ... Remote device, 400 ... Operator device, 800 ... Computer, 801 ... Processor, 803 ... Memory, 805 ... Storage device, 807 ... Input I / F section, 809 ... Data I / F section, 811 ... Communication I / F section, 813 ... Display device

Claims (14)

A request receiving unit that receives a correction request for correction of the first history information regarding the history of the first processing for data or value from the user device of the user.
A concealment unit that conceals the first history information before correction using the first key information stored in the key storage unit, and a concealment unit.
A storage unit that stores the concealed first history information before correction in a backup storage unit, and a storage unit.
Based on the correction request, a correction unit that performs a process for correcting the first history information by referring to the history storage unit that stores the first history information, and a correction unit.
A division unit that divides the first key information for each of a plurality of authorized persons of the first history information, and
A transmission unit that transmits the divided first key information to each of the plurality of authorized person devices of the plurality of authorized persons and deletes the transmitted first key information from the key storage unit.
Information processing device. The authority level for the first history information is set for each authority person, and the authority level is set.
The division unit divides the first key information into a plurality of higher-level authorized persons for which the authority level equal to or higher than a predetermined authority level is set among the plurality of authorized persons.
The transmission unit transmits the divided first key information to each of the plurality of authorized person devices of the plurality of higher-level authorized persons, and the transmitted divided first key information is transmitted from the key storage unit. delete,
The information processing device according to claim 1. The first process is a process for transferring data or value.
The user is the transfer source or transfer destination of the transfer,
The information processing device
When the correction request is received, the first notification unit that notifies the transferor device of the transfer source or the transfer destination of the transfer with a request notification indicating that the correction request has been made, and
As a response to the request notification from the transferor device, a first evaluation receiving unit that receives an evaluation for the correction request is further provided.
The correction unit performs a process for correcting the first history information based on the received evaluation.
The information processing device according to claim 1 or 2. The first history information is a second process for data or value, and is stored in the history storage unit in association with the second history information of the second process related to the first process.
When the correction unit performs the process for making the correction, the correction unit releases the association between the first history information before the correction and the second history information, and the first history information after the correction is referred to as the second history information. Stored in the history storage unit in association with the history information,
The information processing device according to any one of claims 1 to 3. The second process is a process for transferring data or value.
When the correction request is accepted and the first history information is stored in association with the second history information, the transferor device of the transfer source or transfer destination of the second process receives the correction request. A second notification unit that notifies a request notification indicating that the correction request has been made, and
As a response to the request notification from the transferor device, a second evaluation receiving unit that receives an evaluation for the correction request is further provided.
The correction unit performs a process for correcting the first history information based on the received evaluation.
The information processing device according to claim 4. The request receiving unit receives a reference request from the user device requesting reference to the first history information before the correction.
The information processing device
An acquisition unit that acquires the agreement of the authority with respect to the reference and the agreement information including the divided first key information from each of the plurality of authority devices.
Based on the reference request and the agreement information, the backup storage unit is referred to, and the concealed first history information before correction is released from concealment.
A providing unit that provides the user device with the first history information before correction, which has been released from concealment, is further provided.
The information processing device according to any one of claims 1 to 5. The request receiving unit receives a recovery request from the user device requesting recovery of the first history information before the correction.
The information processing device
An acquisition unit that acquires the agreement of the authorized person for the restoration and the agreement information including the divided first key information from each of the plurality of authorized person devices.
Based on the recovery request and the agreement information, the backup storage unit is referred to, and the concealed first history information before correction is released from concealment.
A recovery unit that restores the first history information before correction, which has been released from concealment, to the history storage unit is further provided.
The information processing device according to any one of claims 1 to 6. When the recovery unit recovers the first history information before correction, the concealment unit conceals the corrected first history information by using the second key information stored in the key storage unit. And
The storage unit stores the concealed first history information after correction in the backup storage unit.
The division unit divides the second key information for each of the plurality of authorized persons.
The transmission unit transmits the divided second key information to each of the plurality of authorized devices, and deletes the transmitted divided second key information from the key storage unit.
The information processing device according to claim 7. The division unit divides the first history information before the correction into each of the plurality of authorized persons.
The concealment unit conceals each of the divided first history information before correction by using the first key information.
The storage unit stores the concealed and divided first history information before correction in the backup storage unit.
The information processing device according to any one of claims 1 to 8. The first key information includes history restoration information for restoring the divided first history information before correction before division.
The information processing device
A restoration unit that restores the uncorrected first history information that has been dehisden and divided, and restores the first history information before correction based on the first key information acquired from the authorized person device. Further prepare
The information processing device according to claim 8. The information processing device divides the first key information from the authorized person device and stores it in the plurality of authorized person devices, and a third party other than the user and the business operator related to the first process. It is further equipped with a selection reception unit that accepts one of the choices, such as storing it in the third party institution's equipment.
When the transmitting unit accepts the selection to be stored in the third-party institution device, the transmitting unit transmits the first key information to the third-party institution without causing the dividing unit to divide the first key information. Delete the transmitted first key information from the key storage unit,
The information processing device according to any one of claims 1 to 9. The information processing device divides the first key information based on the characteristics of the first history information and stores it in the plurality of authorized person devices, and the user and a business operator related to the first process. It is further equipped with a selection unit to select one of the storage in the third party equipment of a third party other than the above.
When the transmitting unit accepts the selection to be stored in the third-party institution device, the transmitting unit transmits the first key information to the third-party institution without causing the dividing unit to divide the first key information. Delete the transmitted first key information from the key storage unit,
The information processing device according to any one of claims 1 to 9. On the computer
A request acceptance function that accepts a correction request for correction of the first history information regarding the history of the first process for data or value from the user's device, and a request reception function.
A concealment function that conceals the first history information before correction by using the first key information stored in the key storage unit.
A save function for saving the concealed first history information before correction in a backup storage unit, and
A correction function that performs a process for correcting the first history information by referring to the history storage unit that stores the first history information based on the correction request.
A division function that divides the first key information for each of a plurality of authorized persons of the first history information, and
A transmission function is realized in which the divided first key information is transmitted to each of a plurality of authorized person devices of the plurality of authorized persons, and the transmitted first key information is deleted from the key storage unit.
program. The computer
Receives a correction request from the user's user device to request correction of the first history information regarding the history of the first process for data or value.
The first history information before correction is concealed by using the first key information stored in the key storage unit.
The concealed first history information before correction is stored in the backup storage unit, and the information is stored in the backup storage unit.
Based on the correction request, the history storage unit that stores the first history information is referred to, and a process for correcting the first history information is performed.
The first key information is divided into each of a plurality of authorized persons of the first history information.
The divided first key information is transmitted to each of the plurality of authorized person devices of the plurality of authorized persons, and the transmitted first key information is deleted from the key storage unit.
Information processing method.

Images