JP2005051463A - Anonymity database system - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To obtain an anonymous database system that transfers information without transmitting any individual specification information. <P>SOLUTION: The anonymity database system comprises a service terminal and a database system connected to the service terminal through a network, and an identification ID generating device provided to the service terminal has a reception part 201 which receives an identification ID generation request, a biometrics information input part 202 which inputs biometrics information 100 on a user, an identification ID generating rule storage part 205, an identification ID generation part 203 which generates an identification ID according to the biometrics information 100 and an identification ID generating rule, and a transmission part 204 which sends the identification ID. When information for registration in the database system is inputted to the service terminal, the identification ID by the identification ID generating device 210 and the information are paired and registered in the database system. <P>COPYRIGHT: (C)2005,JPO&NCIPI

Description

  The present invention relates to an anonymous database system, and more particularly to an anonymous database system using biometric information.

  Conventionally, there are many cases where service providers manage user personal information such as service usage history and hobbies / preferences and use it for marketing to users.

  In this way, in the real world, various personal information is collected, held and managed for each organization. Most of these personal information includes information for identifying an individual related to privacy (hereinafter, abbreviated as personal identification information). Therefore, organizations that hold and manage information are obliged to keep their personal information confidential. Therefore, even personal information that does not include personal identification information cannot be disclosed. However, personal information has a new meaning and value by combining analysis, etc., and may have economic effects and academic progress.

  However, the confidentiality obligation associated with the acquisition of actual data largely depends on the trust relationship between the information provider and the user. In addition, due to the law protecting personal information, the handling of personal information is restricted, and the disclosure of information accumulated by each organization may be stagnant. Therefore, effective use of personal information is not made.

  In a conventional system, a technique related to a personal information integrated management system in which personal information unintended by a user is not created by using an IC card has been proposed (see, for example, Patent Document 1).

  This is because the user registers anonymously using the key pair prepared for each service provider by the user and the customer ID issued by the service provider, and the user discloses the customer ID and public key only to the personal information management system. By registering as user's personal information, customer authentication can be performed without going through the personal information management system. In addition, when the service provider needs to confirm the user's identity, the service provider can also verify the identity while remaining anonymous by making an inquiry to the personal information integrated management system.

  However, if the user sends personal identification information to a personal information integrated management system that is a third party organization, there is a high possibility that the personal anonymity (privacy) cannot be secured. In fact, humans inside third-party organizations cannot throw away the possibility of leaking personally identifiable information. In addition, if a personal information integrated management system, which is a third party organization, is separately established, it will be necessary to maintain and manage it.

  Also, it is necessary to always carry the IC card, and the anonymity and convenience cannot be pursued with the IC card when it is lost or stolen.

  Another conventional system has been proposed in which a data provider separates personal information from other data, generates two data sets, and then provides personal identification information to a trust authority (TTP) ( For example, see Patent Document 2.)

JP 2003-85493 A JP 2000-324094 A

  As described above, in the conventional database system that handles personal information, when the user registers the personal information in the database, it is necessary to register the personal information and the personal identification information as a pair. Therefore, when database system information is leaked due to network hacking, etc., there is a problem that the association between personal information and personal identification information is easily guessed, and it may be difficult to ensure privacy. .

  The present invention has been made to solve such a problem, and an object thereof is to provide an anonymous database system capable of exchanging information without any personal identification information flowing on the network.

  The present invention is an anonymous database system comprising a service terminal and a database system connected to the service terminal, wherein the service terminal inputs a receiving means for receiving an identification ID generation request and user biometric information. Based on biometrics information input means, identification ID generation rule storage means for storing an identification ID generation rule when generating an identification ID, biometric information input to the input means and the identification ID generation rule, Identification ID generating means for generating an identification ID, registration information input means for inputting information for registration in the database system, input to the identification ID generated by the identification ID generation means and the registration information input means Information registered in the database system as a pair with the information When biometric information is input to the recording means and the biometric information input unit, the biometric information is registered in the database system using the same identification ID as the identification ID generated by the identification ID generation unit from the biometric information. An anonymous database system comprising information display means for searching and displaying information.

  By using the identification ID configured as described above and created from biometric information, which is a biological characteristic unique to the person, instead of the personal identification information, information can be exchanged without the personal identification information flowing.

Embodiment 1 FIG.
An anonymous database system according to Embodiment 1 of the present invention will be described with reference to FIG. As shown in FIG. 1, the anonymous database system includes biometric information 100, which is a biological characteristic unique to a person such as a fingerprint, palm print, iris, and voice print, a service terminal 200, a database system 300, and a network 400. It is configured. The service terminal 200 is provided with an identification ID generation device 210. The identification ID generation device 210 may be built in the service terminal 200, but may be provided outside and connected by a connection cable or the like.

  As shown in FIG. 1, in the anonymous database system, a service terminal 200 and a database system 300 are connected via a network 400. In addition to these, the biometric information 100 of each user does not function alone, but operates as part of the system by being input to the identification ID generation device 210 of the service terminal 200.

  FIG. 2 is a diagram showing an outline of the implementation of the anonymous database system in the first embodiment. As shown in FIG. 2, the user 10 directly accesses the service terminal 200 and the third party accesses the database system 300.

  The user 10 who wants to register personal information (the height of the user (174.3 cm) and the weight of the user (58.5 kg) in the example of FIG. 2) in the database system 300 is stored in the identification ID generation device 210 with biometric information ( In the example of FIG. 2, a fingerprint 100 is input. Thus, a unique identification ID is generated in the identification ID generation device 210 using data obtained from the biometric information. This identification ID is generated based on ridge data and voiceprint data obtained from biometric information such as fingerprints, palm prints, irises, voiceprints, etc., and is generated from the same biometric information 100. Always produce the same. Different identification IDs are generated from different ridge data and voiceprint data. Since the ridge data and the voiceprint data are absolutely different depending on the individual, it cannot be the same as the identification ID of another person. The identification ID is composed of, for example, a character string made up of a predetermined number of alphanumeric characters. As shown in the example of FIG. 2, the identification ID is a character string arranged meaninglessly at first glance, such as “iksnb5”. It looks like this. The service terminal 200 registers the information in the database system 300 by pairing the generated identification ID with the personal information to be registered automatically or manually input in advance in the service terminal 200. In the example of FIG. 2, the pair is a data set (identification ID: iksnb5, height: 174.3, weight: 58.5). In this way, personal information can be registered in the database system 300 without transmitting any personal identification information such as the user's name, address, or mail address. In the database system 300, personal information is sequentially registered for each identification ID as shown in FIG.

  Also, when the user 10 refers to his / her personal information registered in the database system 300, first, the biometric information 100 is input to the identification ID generation device 210. Then, a unique identification ID is generated in the identification ID generation device 210. Since this identification ID is always generated from the same biometric information 100, the identification ID generated at this time is the same as that used when registering personal information. Yes. Then, the service terminal 200 searches for the information of the person with the generated identification ID using the identification ID, receives it from the database system 300, and displays it to the user 10. By doing so, the database system 300 can refer to the personal information without transmitting the personal identification information at all.

  Further, the third party 20 can freely receive information from the database system 300 and perform data analysis or the like. However, although the identification ID is included in the information obtained by the third party 20, it is not possible to specify an individual because it does not include personal identification information. It is difficult to restore biometric information from the identification ID, and even if it can be restored, it cannot be input to the identification ID generation device 210. This is because even if the fingerprint shape data is obtained by restoration in order to input a fingerprint, it cannot be input to the identification ID generating device 210 unless the user's finger is available. Similarly, a palm print, an iris, a voice print, and the like cannot be input by the identification ID generation device 210 except for the user himself / herself.

  FIG. 3 is a diagram illustrating a configuration of the identification ID generation apparatus 210 according to the first embodiment. The service terminal 200 according to the first embodiment includes the identification ID generation device 210 as described above, but the identification ID generation device 210 includes a reception unit 201 that receives an identification ID generation request from the service terminal 200, and a user Biometric information input unit 202 from which biometric information is input, identification ID generation unit 203 that generates an identification ID from the biometric information, transmission unit 204 that transmits the generated identification ID to service terminal 200, An identification ID generation rule storage unit 205 that stores identification ID generation rules for generating an identification ID is provided.

  FIG. 4 is a diagram showing a flow when the identification ID generation device 210 receives biometric information of each user. Hereinafter, the operation of the identification ID generation device 210 in FIG. 2 will be described with reference to FIGS. 3 and 4.

  In step S <b> 10, the receiving unit 201 of the identification ID generation device 210 receives an identification ID generation request from the service terminal 200. In step S20, the biometric information input unit 202 waits until biometric information is input from the user. If it is determined in step S30 that biometric information has been received, the process proceeds to step S40. In step S <b> 40, the identification ID generation unit 203 generates an identification ID from the received biometric information 100 and the identification ID generation rule stored in the identification ID generation rule storage unit 205. At this time, as described above, since the biometric information is always different depending on the individual, the same identification ID is always generated for the same user, and different identification IDs are always generated for the different users. When the identification ID is generated, the process proceeds to step S50. In step S50, when the transmission unit 204 transmits the generated identification ID to the service terminal 200, the process ends in step S60.

  As described above, in the first embodiment, the user can register personal information in the database system 300 using the identification ID generated from the biometric information 100 while remaining anonymous. In addition, by using the identification ID generated from the biometric information 100, it is possible to refer to the personal information on the database system 300 while being anonymous without specifying the individual.

  As a result, personal identification information can be exchanged without flowing on the network, and a secure network can be constructed with simple personal authentication. In addition, a third party can use the database system without infringing on the privacy of each user.

Embodiment 2. FIG.
In the first embodiment described above, the construction of a system in which personal identification information does not flow on the network by using the identification ID generated from the biometric information 100 has been described. However, in the first embodiment, there is no problem because there is one database system 300. However, when a user registers different data in a plurality of database systems 300, these data are: A third party may refer to it freely. However, when these data are related to each other, there is a possibility that anonymity may not be protected depending on the contents of the data.

  Therefore, in the second embodiment, an example will be described in which a unique identification ID generation rule for each database system 300 is used to prevent association with data of another database system 300.

  FIG. 5 is a diagram showing an outline of mounting in the second embodiment. In the second embodiment, the identification ID generation device 210 receives the unique identification ID generation rule in each database system 300 in advance, so that the identification ID generation device 210 generates an identification ID unique to each database system 300. . As a result, the data of a plurality of anonymous data systems 300 cannot be associated.

  FIG. 6 shows a configuration of the identification ID generation apparatus 210 according to the second embodiment. The service terminal 200 in the embodiment includes an identification ID generation device 210. The identification ID generation device 210 includes a reception unit 201, a biometric information input unit 202, an identification ID generation unit 203, a transmission unit 204, an identification ID generation rule storage unit 205, and an identification ID generation rule change unit 206. . About the structure of 201-205, it is the same as that of said Embodiment 1. FIG. The identification ID generation rule changing unit 206 causes the identification ID generation rule storage unit 205 to store the identification ID generation rule that the reception unit 201 receives together with the identification ID generation request.

  FIG. 7 is a diagram showing a flow when the identification ID generation device 210 receives biometric information of each user. Hereinafter, the operation of the identification ID generation device 210 in FIG. 6 will be described with reference to FIG.

  In step S <b> 10, the receiving unit 201 of the identification ID generation device 210 receives an identification ID generation request and an identification ID generation rule from the service terminal 200. In step S11, the identification ID generation rule stored in the identification ID generation rule storage unit 205 is updated with the received identification ID generation rule, and the process proceeds to step S20. In step S20, the biometric information input unit 202 stands by until biometric information is input from the user. If it is determined in step S30 that biometric information has been received, the process proceeds to step S40. In step S <b> 40, the identification ID generation unit 203 generates an identification ID from the received biometric information 100 and the identification ID generation rule stored in the identification ID generation rule storage unit 205. At this time, the same identification ID is always generated for the same user, and a different identification ID is always generated for the different user. Even if the same user has different identification ID generation rules, different identification IDs must be generated. When the identification ID is generated, the process proceeds to step S50. In step S50, when the transmission unit 204 transmits the generated identification ID to the service terminal 200, the process ends in step S60.

  As described above, in the second embodiment, the same effect as in the first embodiment is obtained, and furthermore, the identification ID is generated according to the identification ID generation rule held by each database system 300. Data cannot be associated with other database systems 300. As a result, it is possible to avoid a risk that personal information of a plurality of database systems 300 is inadvertently associated and anonymity is uncovered.

Embodiment 3 FIG.
In the above-described second embodiment, each database system 300 has its own identification ID generation rule so that data of a plurality of database systems 300 cannot be associated. However, this makes it impossible to perform analysis by combining the personal information of the plurality of database systems 300.

  Therefore, in the third embodiment, a system in which both database systems 300 are mixed is constructed by combining the first embodiment and the second embodiment. FIG. 8 shows an outline of the implementation in the third embodiment.

  That is, in the present embodiment, two types of database systems are prepared as the database system 300: a database system holding a common identification ID generation rule and a database system holding a unique identification ID generation rule. In the example of FIG. 8, the database systems A and B are database systems holding unique identification ID generation rules, and the database systems C and D are database systems holding common identification ID generation rules. As a result, data that may be associated is stored in the database system 300 that holds the common identification ID generation rule, and data that is not desired to be associated is stored in the database system 300 that holds the unique identification ID generation rule. The data can be accumulated according to the user's wishes.

  As a result, in the present embodiment, personal information that may not be anonymized by being associated cannot be associated, and personal information that can be associated can be associated with the third party 20. It is possible to construct a system that can be provided and combined to perform analysis and the like.

Embodiment 4 FIG.
In the second and third embodiments, the identification ID generation rule 205 differs depending on each database system 300, so that a problem occurs when the user 10 wants to migrate data in one database system 300 to another database system 300. . That is, since the identification ID generation rules are different, the user 10 cannot refer to these data simply by copying the data as it is.

  Therefore, in the fourth embodiment, a function for freely changing the storage destination of personal information between the database systems 300 is added to the service terminal 200.

  FIG. 9 is a diagram showing an outline of mounting in the fourth embodiment. First, when the user 10 designates the original database system 300 to be migrated and refers to the personal information stored therein, all the data to be migrated is transferred to the service terminal 200 and extracted. Then, the identification ID of the data transferred into the service terminal 200 is changed to the identification ID generated using the identification ID generation rule of the new database system 300 to be transferred. Finally, the data whose identification ID has been changed is registered in the new database system 300 to be migrated.

  By adding such a function, the user 10 can freely change the database system 300 for storing his / her personal information, and the degree of freedom of the anonymous database system can be increased.

Embodiment 5 FIG.
In the above-described first to fourth embodiments, since the single biometric information is used as an input, when the biometric information cannot be input for some reason such as injury, the database system 300 is used. Can no longer be used.

  Therefore, in the fifth embodiment, an identification ID conversion table generated from a plurality of biometric information 100 in advance is input to the database system 300. The conversion table may be provided in the service terminal 200.

  That is, the identification ID (hereinafter referred to as the first identification ID) generated from the original bimetric information (hereinafter referred to as the first biometric information) and the spare second one. A set of identification IDs (hereinafter referred to as second identification IDs) generated from the biometric information (hereinafter referred to as second biometric information) is registered in the conversion table of the database system 300 in advance. Keep it.

  Even after registration of the conversion table, in normal times, the user inputs the first biometric information, thereby generating a first identification ID, and data registration / reference is performed using the first identification ID. . At this time, when the first biometric information cannot be input for some reason such as injury, the user inputs the second biometric information, thereby generating a second identification ID. Thus, the second identification ID is converted into the first identification ID by the conversion table, and data registration / reference is performed using the first identification ID obtained by the conversion.

  FIG. 10 shows a specific example of the conversion table. In the conversion table, “conversion source” stores a second identification ID, and “conversion destination” stores a first identification ID. Thus, the number of identification IDs generated from the preliminary biometric information 100 is not limited to one, and any number can be registered in the conversion table.

  FIG. 11 is a diagram showing an outline of implementation in the fifth embodiment. When performing data registration / reference in the database system 300, first, it is confirmed whether the identification ID of the data registration / reference request is in the conversion source of the conversion table. Then, if the identification ID is in the conversion source of the conversion table, the identification ID is converted into the conversion destination identification ID associated with the conversion table, and the identification ID obtained by the conversion is used. Data registration / reference processing. If not, it is recognized that it is normally used, and the original registration ID is used as it is, and data registration / reference processing is performed in the same manner as in the first to fourth embodiments.

  As described above, in the present embodiment, the biometric information input unit 202 inputs a plurality of pieces of biometric information (biometric information used at normal time and one or more other biometric information) of a single user. A conversion table for registering the identification IDs generated from them as a set so that the correspondence can be understood, and other biometrics other than the biometrics used at normal time from the user at the time of data registration / reference When the information is input, it is searched whether or not the identification ID generated from it is in the conversion table. If there is, the corresponding ID is referred to by referring to the correspondence relationship of the conversion table. An identification ID conversion means for converting the identification information generated from the biometric information to be used and outputting the identification ID, and obtained by the conversion. Since the data registration / reference is performed using the identification ID, the second identification ID is registered as a spare even if one biometric information cannot be input due to injury or the like. Data biometrics information can be entered to register / reference data. Therefore, the range of users 10 who can use this anonymous database system is widened, and this system can be provided to more people.

It is a block diagram which shows the structure of the anonymous database system which concerns on Embodiment 1 of this invention. It is explanatory drawing which shows the mounting outline in the anonymous database system which concerns on Embodiment 1. FIG. 2 is a block diagram illustrating a configuration of an identification ID generation apparatus 210 according to Embodiment 1. FIG. It is a flowchart which shows the flow of the identification ID generation apparatus 210 concerning the form 1 of mounting. It is explanatory drawing which shows the mounting outline | summary in the anonymous database system which concerns on Embodiment 2. FIG. 6 is a block diagram illustrating a configuration of an identification ID generation device 210 according to Embodiment 2. FIG. It is a flowchart which shows the flow of the identification ID generation apparatus 210 concerning the mounting form 2. FIG. 10 is an explanatory diagram showing an outline of mounting in a third embodiment. FIG. 10 is an explanatory diagram showing an outline of mounting in a fourth embodiment. FIG. 10 is an explanatory diagram showing an outline of a conversion table according to the fifth embodiment. FIG. 10 is an explanatory diagram showing an outline of mounting in a fifth embodiment.

Explanation of symbols

  10 users, 20 third parties, 100 biometric information, 200 service terminals, 201 receiving unit, 202 biometrics information input unit, 203 identification ID generation unit, 204 transmission unit, 205 identification ID generation rule storage unit, 210 identification ID generation Device, 300 database system, 400 network

Claims (5)

An anonymous database system comprising a service terminal and a database system connected to the service terminal,
The service terminal
Biometric information input means for inputting user biometric information;
An identification ID generation rule storage means for storing an identification ID generation rule when generating an identification ID;
An identification ID generating means for generating an identification ID based on the biometric information and the identification ID generation rule;
Registration information input means for inputting information for registration in the database system;
Information registration means for registering in the database system a pair of the identification ID generated by the identification ID generation means and the information input to the registration information input means;
When biometric information is input to the biometric information input means, the information registered in the database system is searched using the same identification ID as the identification ID generated by the identification ID generation means from the biometric information. An anonymous database system comprising: an information display means for displaying the information. The service terminal
An identification ID generation rule input means for inputting an identification ID generation rule;
An identification ID generation rule changing means for changing the identification ID generation rule stored in the identification ID generation rule storage means to the identification ID generation rule input to the identification ID generation rule input means; The anonymous database system according to claim 1. A plurality of the database systems are provided,
At least two of the plurality of database systems have a common identification ID generation rule, and the common identification ID generation rule is set to the identification ID generation rule input means of the service terminal. The anonymous database system according to claim 2, wherein the anonymous database system is input. A plurality of the database systems are provided,
The service terminal
A migration information transfer means for designating a database system in which information to be migrated is registered from among the plurality of database systems, transferring and extracting the information to be migrated from the designated database system;
A migration destination identification ID generation means for generating an identification ID for the migration destination database system using the identification ID generation rule in the migration destination database system;
The anonymous database system according to claim 2 or 3, further comprising transfer information registration means for registering the extracted information and the generated identification ID as a pair in the migration destination database system. . The biometric information input means of the service terminal inputs first biometric information used at normal time and other one or more second biometric information other than that,
The identification ID is for generating first and second identification IDs from the first and second biometric information,
One of the service terminal and the database system is
A conversion table for storing the first identification ID and the second identification ID in association with each other;
When the second biometric information is input, a search is performed to determine whether an identification ID generated therefrom is present in the second identification ID stored in the conversion table. In the case of using the conversion table, it further comprises: an identification ID conversion unit that converts the second identification ID into the first identification ID corresponding to the second identification ID and outputs the converted second identification ID. The anonymous database system according to any one of claims 1 to 4, wherein the anonymous database system is characterized.

Images