JP2005258495A - Database system with function for recording and disclosing personal information access record - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To solve the problem that a person concerned of personal information has no way to recognize the usage situation since the way to use the personal information has to be left to an organization for managing a database while the personal information is managed with the use of the database of an enterprise or a local government, etc. <P>SOLUTION: A database table 102 is defined as the table to determine whether stored data is the personal information or not. When access is requested to data which is the personal information from an arbitrary client 101, a database server 105 records the situation such as an access date, the ID of an access user, and the kind of accessed data as personal information access records 104. At the same time, an effect that the personal information is used is reported to the person concerned 106 of the personal information. Or the person concerned 106 of the personal information can check the access records to his/her own personal information whenever he/she wants. <P>COPYRIGHT: (C)2005,JPO&NCIPI

Description

  The present invention relates to a database for the purpose of proper use of personal information.

  In a conventional information system using a database, access to stored data is restricted by a password or an access method to prevent unauthorized use.

  Various information is stored in the database, including personal information. For example, companies such as banks, securities companies, electric power companies, and gas companies manage customer addresses, names, telephone numbers, and transaction histories in a database. In addition, there are cases where a card issuing company manages member information and a resident register in a local government. The leakage of personal information is a major credit problem for companies and organizations, and organizations that store personal information are required to manage them appropriately.

  When restricting access to a database, determine who can use the data and what operations are allowed, mainly within the organization that operates the database. In general, personal information is accessed by persons who are in charge of a specific task in a company or organization, such as a person who responds to an inquiry, a person who sends mail, or a person in charge of a government office. Such a user is given a user ID and password for identifying an individual. Generally, a database system identifies a user with a user ID and a password. The database system employs a mechanism that allows data reference / update within the range permitted by the user. In addition to this, there are cases where the applications that can be used and the time periods in which they can be used are limited, and the situation in which data can be referenced and updated is further limited. In addition, there is a method of keeping a reference / update record to data so that it can be checked for suspicious access.

  These are mechanisms for forcing a company / organization managing a database system to access information held by the database system based on a policy determined by the company / organization.

  On the other hand, as disclosed in Japanese Patent Application Laid-Open No. 2002-14862, there is one that allows an access authority for personal information to be controlled by a party of personal information based on one's own will. However, an administrator of the database system and a user having a valid reason must be given access authority to personal information.

JP 2002-14862 A

  The above-described prior art mainly shows management means inside an organization that operates a database, and there is a problem that it is impossible for a party of personal information to determine whether or not appropriate management is performed. As described in Japanese Patent Laid-Open No. 2002-14862, even when the parties themselves can control the access authority, it is still impossible to determine whether or not the authorized organization is using it appropriately.

  When the party of personal information is a customer, the customer is usually not involved in the operation of the database. In other words, it was left to the organization that manages the database how their information was managed and used. Even if the personal information protection policy is clearly stated by the organization, there is no way for the parties to confirm whether it is operating properly according to the policy. On the other hand, it is not the organization that manages the data but the parties to the personal information that has been illegally used that is directly damaged by the illegal use of information.

  An object of the present invention is to enable a party of personal information to investigate a situation in which personal information in a database is used. In addition, by disclosing the access record of personal information to the parties, deterrence against unauthorized use of personal information within a company / organization can be expected.

  In order to achieve the above purpose, the database system can determine whether the stored data is personal information, record the access status to personal information, and notify or disclose it to the parties. is there.

  It enables the parties to be notified of the access status of the personal information by e-mail or other methods every time the personal information is accessed or at an arbitrary interval.

  Furthermore, it has means for disclosing the access status to the personal information to the parties using a homepage or other methods.

  According to the present invention, whether or not the stored data is personal information is managed by the database system, and the access status to the data is recorded and notified to the parties, so that appropriate use of the personal information can be realized.

  From the point of view of the parties, it is relatively safe to teach personal information to others by clarifying how personal information is used. Since the parties themselves can check, fraud deterrence against the database management organization works. Even if you suffer a disadvantage due to unauthorized use of personal information, you can investigate the management status and usage status of personal information yourself and pursue the responsibility of the operating organization.

  For database management organizations, it can be differentiated from the products of others by appealing the appropriateness of personal information management. Adding value through the appropriateness of personal information management is an advantage over competitors that offer similar services. In addition, even when management of personal information using a database is necessary to improve the efficiency of operations in the government or the like, the use of the present invention makes it easier to obtain the understanding of residents.

  Hereinafter, embodiments of the present invention will be described in detail with reference to the drawings. FIG. 1 shows the configuration of a database system according to an embodiment of the present invention. In this embodiment, it is composed of a client 101 connected via a network, a database server 105, and a terminal 106 used by a party of personal information. The client 101 is a program and device that accesses the database server 105 and performs a specific job using data. The client 101 may be on the same device as the database server 105. The database server 105 is a program and device that manages the database 103 and returns data in response to a request from the client 101. The database server 105 has means for determining whether the stored data is personal information, and has a function of notifying or disclosing to the parties when the personal information is accessed. The terminal 106 is a device in which a party receives an access record to personal information, and is a device having mail software, a Web browser, and other means capable of sending and receiving e-mail. A mobile phone or pager can also be used as the terminal 106.

  The database table 102 is an example of a table that stores personal information and other data. This database table includes columns of a personal code for identifying an individual, a mail address for contacting a party, an address and account number corresponding to personal information, and a classification code not corresponding to personal information. When defining a database table, determine whether each column corresponds to personal information.

  The personal information access record 104 is a record of the access status when data corresponding to personal information is accessed. In this embodiment, the personal code, the access date and time, the type of data accessed, whether it was actually transmitted, the ID of the accessing user, the accessed application, etc. are recorded.

  2 and 3 are further detailed examples of the embodiment shown in FIG.

  The client 101 includes an application program 201 and a database client program 202. The application program 201 is a program for performing a specific job. The database client program 202 is a program for accessing the database server 105 and acquiring information, and is called from the application program 201.

  The database server 105 includes a communication unit 203, an SQL analysis unit 204, a dictionary information management unit 205, a database processing unit 206, a personal information access recording unit 207, a personal information access notification unit 208, and a file tampering prevention unit 209. The database server 105 also manages the dictionary file 210, the database file 211, and the personal information access record file 212 using an external storage device and memory. The communication unit 203 processes a communication function with the database client program 202. The SQL analysis unit 204 analyzes the SQL issued from the application program 201 and the database client program 202. The dictionary information management unit 205 manages the types and attributes of information stored in the database. This information is recorded in the dictionary file 210. Whether each data stored in the database corresponds to personal information is also managed by the dictionary information management unit 205 and the dictionary file 210. The database processing unit 206 inputs and outputs data from the database file 211 in accordance with the SQL analysis result. When there is an access request for data corresponding to personal information, the personal information access recording unit 207 records the situation in the personal information access record file 212. When there is a request for access to data corresponding to personal information, the personal information access notification unit 208 notifies the parties to that effect by e-mail or other means. The file tampering prevention unit 209 controls the content of the personal information access record file 212 using encryption or the like so that it is not changed by an application other than the database server. By preventing the personal information access record file from being falsified, the reliability of the data disclosed to the parties is improved.

  The terminal 106 used by the party has a mail transmission / reception program 213. As a result, a notification that the personal information has been accessed is received by e-mail or other methods.

  FIG. 3 shows details of the structure of the database table of the embodiment. These pieces of information are managed by the dictionary information management unit 205 and the dictionary file 210.

  The database table shown in FIG. 3 includes columns 302 to 310.

  Reference numeral 301 denotes management information of the column “personal code” constituting the database table. By giving the attribute of “personal information classification” as column management information, it is determined whether or not the data stored therein is personal information. The personal information classification of the column “personal code” is NO, and it is determined that the information stored in this column is not personal information. On the other hand, since the personal information classification of the column “mail address” is YES, it is determined that the information stored in this column is personal information. The information in the column “mail address” is also used as a contact for notifying the parties of the personal information access status.

  For each column 302 to 310, it is determined whether or not it is personal information according to the management information. Whether or not it is personal information is specified when the database table is created.

  Hereinafter, an embodiment will be described in which data is requested from the client 101 and the personal information access is notified to the parties. The control in the database server will be described using the flowchart of FIG. It is assumed that user authentication using a user ID and password has already been performed.

  In step 401, an SQL processing request from a client is received via a network or the like.

  In step 402, the syntax of SQL is analyzed to determine what information is necessary to obtain the result, and in which database file the information is stored.

  In step 403, it is determined whether or not personal information is necessary by executing SQL. When a search or update of “address” is requested in SQL for the database table shown in FIG. 3, it is determined that there is a request for access to personal information because the personal information category of “address” is YES. On the other hand, when “personal code” is requested, the personal information classification of “personal code” is NO, so it is determined that the request is not for access to personal information. When the total number of personal codes, that is, the total number of customers, is requested by SQL, it is determined that the “personal code” is not personal information and is not a request for access to personal information. When the number of customers over 20 years of age is requested, “birth date” will be used as a condition, and the personal information classification of “birth date” will be followed.

  In step 404, the status of the access request to the personal information is recorded in the personal information access record file 212. For example, the personal code, the access date and time, the type of accessed data, and the like. Furthermore, information on the determination process in step 403 is also recorded. For example, it is recorded whether the data itself is requested or specified as a narrowing condition.

  In step 405, it is determined whether there is an appropriate authority to execute SQL.

  In step 406, the database file is accessed based on the analyzed result, and SQL is processed.

  In step 407, an error process is performed when the user who has requested SQL execution does not have appropriate authority.

  In step 408, the SQL execution result is transmitted to the client via a network or the like.

  In step 409, the same determination as in step 405 is performed.

  In step 410, how the personal information access request is processed is recorded in the personal information access record file 212. It records whether the request has been properly processed by a request from a user having an appropriate authority, whether the request has been processed from a user having no authority and has not been processed, or whether the request has not been processed due to a hardware failure or the like.

  In step 411, the party of the used personal information is notified to that effect by e-mail or other methods. In the personal information access notification unit, when notifying by e-mail or the like, the personal information access notification unit processes it into an expression easy to understand for the parties.

  An example of the email notified to the parties is shown in FIG. Reference numeral 501 denotes an example in which personal information is accessed for maintenance. Reference numeral 502 indicates that access has been made for direct mail sending work. If notification is made by e-mail every time personal information is accessed, the number of times increases and there is a risk of annoyance, and e-mails are sent periodically, such as once a month. Alternatively, notification conditions can be selected, such as not being notified by e-mail for access by maintenance. It is possible to change the notification conditions according to the request of the parties, for example, notification is required when personal information data is sent directly to the client, but not when it is used only for counting the number of records.

  Here, a method for determining the appropriateness of database operation will be described using direct mail sending work as an example. The identification number (access number) in the personal information access record file 212 is included in the e-mail, and the same number is also described in the direct mail. The party can determine whether or not an appropriate operation is performed by comparing the access number notified by the e-mail with the access number described in the direct mail. For example, if the access numbers of E-mail and direct mail do not match, or if direct mail is not sent, unintended personal information access is suspected. In addition, when a plurality of direct mails are distributed with the same access number, there is a possibility that personal information is managed twice.

  Furthermore, it is possible to further increase certainty by providing a mechanism in which a part of personal information (memorandum) can be freely changed by a party from a homepage or the like. For example, in the case where the memorandum is recorded in the direct mail, if the memorandum of the direct mail does not match the latest memorandum, the personal information is double-managed by the database operating organization, or the personal information accessed in the past Can be determined to be diverted.

  FIG. 6 is an example of a method for disclosing personal information access to a party. This is a method of examining an access record at a convenient time for a party using a Web browser.

  Reference numeral 601 denotes a Web browser, which is used by a party to check an access record to its own personal information. Reference numeral 602 denotes a Web server that processes a homepage browsing request from the Web browser 601. Reference numeral 603 denotes an application server that generates a page that discloses an access record to personal information in accordance with a request from a party. The application server 603 is called from the web server 602. Further, the application server 603 retrieves the access record of personal information by calling the database server 604. The database server 604 maintains a database table 606 that stores personal information access records. By storing the personal information access record 605 in the database table 606, the personal information access record can be searched by SQL. The party can check the access record to his / her personal information by referring to the home page with the Web browser 601.

  In the notification by e-mail, if the access frequency to the personal information increases, it is difficult to transmit all access records to the parties, and a part of the operation record is omitted. When combined with the embodiment of FIG. 6, the omitted access record can be supplemented. In addition, the access record can be examined retroactively.

It is a structure of the database system of one Example of this invention. This is a configuration of a client, a database server, and a program processing unit in the terminal that constitute the database system. It is a data structure of the database table managed by the database server of one Example of this invention. It is a flowchart from reception of SQL to notification of personal information access status to a party. It is a notification example of personal information access. This is a system configuration when a party views a personal information access record on a homepage.

Explanation of symbols

DESCRIPTION OF SYMBOLS 101 ... Client, 102 ... Database table, 103 ... Database, 104 ... Personal information access record, 105 ... Database server, 106 ... Terminal.

Claims (6)

  It has a means to identify whether each stored data is personal information, keeps contact information of the personal information to the party, and when the data corresponding to the personal information is accessed A database system having a function of notifying or disclosing the fact to a party.   2. The database system according to claim 1, further comprising means for recording an access status such as an access date / time, an access person, and a type of accessed information when data corresponding to personal information is accessed.   The database system according to claim 1, wherein when data corresponding to personal information is accessed, it is determined whether the data is requested or only used as a search narrowing condition, and notification to the parties or A database system provided with means used as a disclosure condition.   2. The database system according to claim 1, further comprising means for notifying a party of access to personal information by e-mail or other methods.   2. The database system according to claim 1, further comprising means for disclosing an access status to personal information to a party through a home page or other methods. A memory characterized by converting each processing procedure according to any one of claims 1, 2, 3, 4, and 5 into a program, and storing the converted processing program. Medium.

Images