JP2006079233A - Personal information leakage monitoring system, personal information leakage monitoring method, personal information leakage monitoring program, and recording medium for recording this program - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide a personal information leakage monitoring system, a personal information leakage monitoring method, a personal information leakage monitoring program, and a recording medium for recording this program, for monitoring the leakage of such personal information as names, addresses, telephone numbers and the like. <P>SOLUTION: The leakage monitoring system 1 includes a personal information database DB for storing a plurality of pieces of personal information; a CTI 11 for logging calls; a mail server 12 for sending and receiving email; a search engine 13 for searching the Internet; and a host computer 10. The host computer 10 creates dummy information at certain time intervals as personal information about non-existent people and stores this information in the personal information database DB. The CTI 11, the mail server 12 and the search engine 13 detect the leakage of the personal information from the personal information database DB by detecting the leakage of the dummy information from the Internet and a telephone network. <P>COPYRIGHT: (C)2006,JPO&NCIPI

Description

  The present invention relates to a personal information leakage monitoring system, a personal information leakage monitoring method, a personal information leakage monitoring program, and a recording medium on which the program is recorded, for monitoring leakage of personal information such as name, address, and telephone number.

  Conventionally, there has been a problem that personal information leaks due to leakage of personal information from a management system for managing personal information by copying or the like. In relation to this problem, although it is different from personal information, as described in Patent Document 1, copyright information (digital watermark) is attached to content distributed on the network and used on the network. The illegal use of the content is monitored by collecting the content and examining the digital watermark. Further, as described in Patent Document 2, a mail server that illegally uses personal information by transmitting personal information for testing to a mail server on a network and receiving a reply mail based on the personal information for testing. It is done to detect.

JP 2001-31570 A JP 2004-104271 A

  However, the above-described conventional personal information leakage monitoring system has a problem that even if personal information is leaked, the fact of leakage cannot be found.

  In order to solve the above-described problems, the leakage monitoring system of the present invention is arranged in a predetermined format, fact information requiring confidentiality, and a communication destination that is arranged in the same format as the fact information format and is not disclosed. Storage means for storing the pseudo information having the destination information indicating, and when the fact information and the pseudo information are leaked from the storage means and communication is performed to the destination indicated by the destination information included in the pseudo information, the network is And a detecting means for detecting that fact information has leaked from the storage means by receiving the communication via the communication.

  According to this configuration, when fact information and pseudo information are leaked from the storage means, since the leaked pseudo information is in the same format as the fact information, is the person who acquired this fact information or pseudo information? Since fact information and pseudo information are used without discriminating the information, communication may be performed to a communication destination indicated by the destination information included in the pseudo information. Since the destination information included in the pseudo information indicates a destination of communication that has not been made public, when this communication is received via the network, the detection means detects the reception and thereby stores the pseudo information stored in the storage means. It can be determined that information has been leaked. Here, since the fact information is stored together with the pseudo information in the storage means, it can be estimated that the fact information is leaked together with the pseudo information. Therefore, it can be known that fact information stored in the storage means has leaked. The communication received via the network may be a telephone received via a telephone network in addition to an electronic mail received via the Internet. The destination information in the case of an e-mail is an e-mail address, and the destination information in the case of a telephone is a telephone number.

  Here, it is preferable that the detection unit acquires specific information for specifying a transmission source of communication performed at the destination.

  In this way, it is possible to obtain specific information for specifying the communication transmission source. Since the destination information included in the pseudo information is information that the pseudo information that has not been disclosed should have, the transmission source can be regarded as the leakage destination of the pseudo information. As described above, since it can be estimated that the fact information is leaked together with the pseudo information, the leak destination of the fact information can be specified.

  Further, another leakage monitoring system of the present invention stores fact information that is organized in a predetermined format and requires confidentiality, and pseudo-information that is organized in the same format as the fact information and is not disclosed. If fact information and pseudo information leak from the means and storage means, and the leaked pseudo information is disclosed on the network, the fact information leaked from the storage means by searching for information on the network for pseudo information The gist of the present invention is that it comprises a detecting means for detecting.

  According to this configuration, when fact information and pseudo information are leaked from the storage means, since the leaked pseudo information is in the same format as the fact information, is the person who acquired this fact information or pseudo information? Since fact information and pseudo information are used without discriminating the information, pseudo information may be disclosed on the network. The detecting means detects the pseudo information disclosed on the network by searching the pseudo information from information on the network. Since the pseudo information is information that has not been disclosed, it is possible to determine that the pseudo information disclosed on the network has leaked the pseudo information stored in the storage unit. Here, since the fact information is stored together with the pseudo information in the storage means, it can be estimated that the pseudo information leaks and the fact information leaks. Therefore, it can be known that fact information stored in the storage means has leaked.

  Here, it is preferable that the detection means acquires specific information for specifying the location on the network where the pseudo information is found by searching the information on the network for the pseudo information.

  In this way, since it is possible to obtain specific information for specifying the location on the network where the leaked pseudo information is found, the leak destination of the fact information can be specified.

  Here, by referring to the pseudo information storage means storing the pseudo information, the pseudo information detected by the detection means, the pseudo information stored in the pseudo information storage means and the specific information, the fact information leakage state is estimated. It is preferable to further include analysis means for acquiring analysis information.

  In this way, it is possible to obtain analysis information that estimates the leakage status of fact information by using the pseudo information detected by the detection means, the pseudo information stored in the pseudo information storage means, and the specific information. Therefore, it is possible to know the leakage status of fact information.

  Here, it is preferable to further include notification means for notifying a predetermined person of fact information leakage and at least one of the leaked fact information or analysis information.

  In this way, when there is information leakage, a predetermined person such as a system administrator can be notified of the leakage. Therefore, it is possible to easily know that information has leaked. As a method of performing notification, in addition to e-mail, telephone, telegram, fax, etc., it may be recorded in a predetermined file of the leakage monitoring system or displayed on a display device provided in this system.

  Here, it is preferable that the detection means detects leakage of pseudo information every time a predetermined time elapses. If it does in this way, it can monitor by detecting fact information regularly.

  In addition, the leakage monitoring method of the present invention that achieves the above-described object is arranged in a predetermined format, the fact information that requires confidentiality, and the destination of communication that is arranged in the same format as the fact information format and is not disclosed. A storage step for storing pseudo information having destination information to be indicated, and if fact information and pseudo information are leaked from the storage means, and communication is performed to the destination of communication indicated by the destination information included in the pseudo information, the network And a detection step of detecting that fact information has leaked from the storage means by receiving communication via.

  Furthermore, the leakage monitoring method of the present invention that achieves the above-described object is arranged in a predetermined format, the fact information that requires confidentiality, and the communication destination that is arranged in the same format as the fact information format and is not disclosed. A storage step for storing pseudo information having destination information to be shown, and when fact information and pseudo information are leaked from the storage means and the leaked pseudo information is disclosed on the network, searching the network for pseudo information And a detection step of detecting that fact information has leaked from the storage means.

  Further, the present invention may be a computer program or a recording medium recording the program. In other words, the computer stores the pseudo information having the destination information indicating the destination of the communication that is organized in a predetermined format and requires the confidentiality information, and is organized in the same format as the fact information and is not disclosed. When fact information and pseudo information are leaked from the storage means and the storage means, and communication is performed to the destination of communication indicated by the destination information included in the pseudo information, the communication is received via the network, and stored. It is made to function as a detection means which detects that fact information leaked from the means.

  Further, another computer program of the present invention provides a computer that organizes a computer in a predetermined format, requires fact information that is confidential, and organizes a communication destination that is organized in the same format as the fact information and is not disclosed. By storing fact information and pseudo information from the storage means for storing the pseudo information having the destination information to be shown and leaking the pseudo information on the network, the information on the network is searched for the pseudo information. , And functioning as detection means for detecting the fact information leaking from the storage means.

  As a recording medium on which these programs are recorded, various computer-readable media such as a flexible disk, a CD-ROM, an IC card, and a punch card can be used.

  A leakage monitoring system according to an embodiment of the present invention will be described with reference to the drawings.

  FIG. 1 is a diagram illustrating a configuration of a leakage monitoring system 1 according to the present embodiment. As shown in FIG. 1, the leakage monitoring system 1 includes a monitoring device 2 and database systems SA to SC, and the monitoring device 2 can access a network including the Internet and a telephone network. ing.

The database system SA has a personal information database DBA that stores a large number of personal information (facts information). Similarly, the database system SB has a personal information database DBB, and the database system SC has a personal information database DBC. As shown in FIG. 1, the monitoring device 2 is interconnected to the database systems SA to SC via a network such as a LAN (Local Area Network). In this way, the monitoring device 2 can access the personal information databases DBA to DBC of the database systems SA to SC.
FIG. 2 shows personal information stored in the personal information database DBA. As shown in FIG. 2, the personal information database DBA stores information on “user name”, “mail address”, “phone number”, and “address” (hereinafter referred to as “attribute information”) as personal information. A management number is assigned to each personal information. For example, in the personal information database DBA shown in FIG. 2, the mail address “mail address A to mail address G” and the phone number “phone number A to phone number G” are associated with the user name “user A to user G”. , “Address A to Address G” are stored. Further, management numbers “1 to 7” are assigned to the individual information. Similarly to the personal database DBA, the personal databases DBB and DBC also store a lot of personal information having “user name”, “mail address”, “phone number”, and “address” as attribute information. It is managed with a number (not shown). The personal information databases DBA to DBC function as a database by performing processing such as writing, searching, and reading of personal information addition / update in accordance with commands from the database systems SA to SC.

  As shown in FIG. 1, the monitoring device 2 includes a host computer 10, a dummy information database DDB, a CTI (Computer Telephony Integration) 11, a mail server 12, and a search engine 13. The host computer 10 is interconnected to each component via a network such as a LAN. The host computer 10 functions as the monitoring device 2 by accessing these components and performing processing.

The dummy information database DDB stores personal information of a fictitious person who does not exist (hereinafter referred to as “dummy information (pseudo information)”).
FIG. 3 is a diagram showing dummy information stored in the dummy information database DDB. As shown in FIG. 3, the dummy information stored in the dummy information database DDB includes attribute information including “user name”, “mail address”, “phone number”, and “address” as attribute information, It has attribute information such as “destination database” indicating a database to which dummy information is written and “creation date” of dummy information. For example, in the dummy information database DDB shown in FIG. 3, in correspondence with a fictitious user name “user a to user g” that does not exist, an email address “email address a to email address g” and a telephone number “phone number a to“ The telephone number g ”and the addresses“ address a to address g ”are recorded.

  Although details will be described later, when dummy information is generated and recorded in the personal information database DB, the recorded personal information database DB is recorded in the “write destination database”, and the date and time when the dummy information is created is “creation date and time”. (See FIG. 3).

Here, since the personal information database DB storing dummy information in addition to the personal information is processed as a normal database while ignoring the dummy information, the dummy information database DDB stores a dummy information reference table DT. .
FIG. 4 shows a dummy information reference table DT for the personal information database DBA. As shown in FIG. 4, the dummy information reference table DT stores a dummy information identifier for identifying whether or not the information corresponding to the management number of the personal information database DBA is dummy information. Here, when the dummy information identifier is “1”, the personal information of the corresponding management number in the personal information database DBA is dummy information, and when the dummy information identifier is “0”, the personal information database It is assumed that the personal information corresponding to the number of the DBA is real personal information. Therefore, the database system SA accesses the monitoring device 2 when performing processing such as retrieval of personal information using the personal information database DBA. The host computer 10 of the monitoring device 2 reads the dummy information reference table DT of the dummy information database DDB and transmits it to the database system SA. The database system SA performs processing such as searching for personal information excluding the dummy information while referring to the transmitted dummy information reference table DT. The same dummy information reference table DT is stored in the dummy information database DDB for the personal information databases DBB and DBC. By doing so, even if the personal information database DB stores dummy information in addition to personal information, various processes as a database can be performed without being affected by the dummy information.

  As shown in FIG. 1, the mail server 12 is interconnected to the Internet and transmits and receives electronic mail. As for the email received by the mail server 12, as shown in FIG. 5A, “received email address”, “sender email address”, and “detected date” that is the date and time when the email was received. Is acquired and stored as leaked information.

  The search engine 13 searches for information that matches the keyword, using a specific character string as a keyword for all websites, bulletin boards, and other sites existing on the Internet. The search engine 13 acquires dummy information from the dummy information database DDB, and uses “user name”, “mail address”, “phone number”, and “address”, which are attribute information of the dummy information, as keywords as specific character strings. Use to search. When a specific character string is searched, an address of a web page including the character string is acquired. As shown in FIG. 5B, search keywords “user name”, “mail address”, “telephone number”, and “address”, which are used as a search keyword, Attribute information such as “address of found page” and “date and time of discovery” is acquired.

  As shown in FIG. 1, the CTI 11 is connected to a telephone network. Further, the CTI 11 has a plurality of telephone numbers that are used as communication destinations. When a call is made to the telephone number of the CTI 11, the CTI 11 records this call. Then, as shown in FIG. 5C, the CTI 11 includes the “phone number that received the call”, the “phone number of the called party” that made the call, and the date and time when the call was made. Attribute information about a certain “detection date” is acquired and stored as leakage information.

Next, a functional configuration of the leakage monitoring system 1 will be described.
FIG. 6 is a diagram showing the configuration of the leakage monitoring system 1. As shown in FIG. 6, the leakage monitoring system 1 includes a dummy information generation unit 20, a dummy information storage unit (pseudo information storage unit) 21, a personal information storage unit (storage unit) 22, a detection unit 23, and an analysis. Means 24 and notification means 25 are provided.

The dummy information generation means 20 generates attribute information such as “user name”, “mail address”, “phone number”, “address”, etc., for the nonexistent person as the dummy information shown in FIG. Actually, for the “user name” and “address”, the dummy information generating means 20 stores many samples (not shown). Then, the “user name” and the “address” are generated so that the dummy information generation unit 20 selects at random from the above.
For the “mail address”, the dummy information generating means 20 has a plurality of mail addresses destined for the mail server 12 described above, and is selected randomly from the plurality of mail addresses. An “email address” is generated.
Regarding “telephone number”, a plurality of telephone numbers destined for the CTI 11 are stored, and a “telephone number” is generated by randomly selecting from these. As described above, dummy information that is personal information of a nonexistent person is generated. The attribute information of “user name”, “mail address”, “phone number”, and “address”, which is a sample of dummy information, is stored in a hard disk (not shown) inside the host computer 10, The CPU (not shown) generates dummy information by accessing the hard disk and acquiring sample attribute information.

  The dummy information storage means 21 stores dummy information in the dummy information database DDB according to a command from the host computer 10. Then, in accordance with a read / write command from the host computer 10, the dummy information is read / written.

  The personal information storage means 22 stores personal information in the personal information database DB in accordance with instructions from the host computer 10. Then, processing such as reading / writing of personal information is performed in accordance with commands such as reading / writing from the database systems SA to SC.

  The detection means 23 detects leakage of information when personal information in the personal information data database DB is leaked. Specifically, the host computer 10 accesses the CTI 11 and the mail server 12, reads the leakage information stored in each of them (see, for example, FIGS. 5A to 5C), and the detection unit 23 leaks. Get information. In addition, the host computer 10 accesses the search engine 13 and acquires information matching the dummy information from the information on the Internet as leakage information. The detection unit 23 creates a leakage information list L in which leakage information acquired from each unit is collected into one file.

  After the analysis unit 24 acquires the leakage information list L created by the detection unit 23, the host computer 10 accesses the dummy information database DDB to acquire dummy information. Then, the analysis unit 24 performs analysis using the leakage information list L and the dummy information, and acquires analysis information obtained by analyzing the leakage status such as the leaked range, the number of leaked personal information, and the leaked time. Details of the analysis will be described later.

  The notification means 25 notifies the leaked dummy information and analysis information as notification information. In this embodiment, the notification information is notified by the mail server 12 sending an e-mail to the system administrator in accordance with a command from the host computer 10.

Next, the operation performed by the monitoring device 2 will be described.
7 and 10 are flowcharts showing the flow of processing performed by the monitoring apparatus 2. FIG. 7 shows a flow of processing (hereinafter referred to as “preprocessing”) mainly performed between the dummy information database DDB and the personal information database DB as a pre-stage for monitoring information leakage. FIG. 10 shows a flow of processing for monitoring information leakage (hereinafter referred to as “monitoring processing”). Hereinafter, the flow of pre-processing will be described first according to the flowchart of FIG. Note that the processing from step S100 to step S120 is processing performed by the host computer 10 as the dummy information generating means 20, and the processing from step S130 to step S150 is stored in the host computer 10, the personal information database DB, and the dummy information database DDB. This is processing performed as means 21.

  When the preprocessing is started, first, in step S100, the host computer 10 determines whether or not it is time to generate dummy information. In this embodiment, dummy information is generated once a month. If the time for generating dummy information has passed (Yes), the process proceeds to step S120. If it is before the time for generating the dummy information (No), the process proceeds to step S110.

  In step S110, the process waits for a predetermined time, and when the predetermined time has passed, the process proceeds to step S100. In this way, steps S100 and S110 are repeated until the time for generating dummy information is reached, and the processing after step S120 is performed at a predetermined time.

  In step S120, the host computer 10 generates dummy information. The stored dummy information is stored in the dummy information database DDB of the storage means 21.

  FIG. 8 is a processing example for explaining the processing shown in steps S120 to S140. As shown in the upper part of FIG. 8, in step S120, “user name”, “mail address”, “phone number”, and “address” are generated as dummy information. The time when the dummy information is generated is recorded in the “creation date” of the dummy information.

  In step S130, the host computer 10 reads dummy information from the dummy information database DDB and stores it in the personal information database DB. In the example of FIG. 8, it is newly added as personal information of the management number “3” to the personal information database DBA having the personal information of the management number “1-2” shown in the middle of the figure. As a result, the personal information stored in the personal information database DB is in the state shown in the lower part of FIG. At this time, information indicating the personal information database DB storing the dummy information as personal information is recorded in the “write destination database” of the dummy information stored in the dummy information database DDB (see the upper part of FIG. 8).

  In step S140, the host computer 10 generates a dummy information reference table DT. In the example of FIG. 8, since the dummy information is stored as personal data of the management number “3” in the personal information database DB, the dummy information reference table DT corresponds to the management number “3” in the personal information database DBA. “1” is stored in the area (see FIG. 4).

  In step S150, it is determined whether or not all personal information databases DBA to DBC have been processed. If all the personal information databases DBA to DBC have not been processed, the process returns to step S120, and the personal information database DB that has not been processed is processed. If all personal information databases DBA to DBC have been processed, the preprocessing is terminated.

  By performing the pre-processing described above, the personal information stored in the personal information databases DBA to DBC includes dummy information that is personal information of a nonexistent user in addition to original personal information about the real user. It is in a state of having. Here, it is assumed that personal information is leaked from the personal information databases DBA to DBC by some method. In such a case, the leaked personal information is illegally used such as an e-mail is sent to the e-mail address, a call is made to the telephone number, or a bulletin board on the network is posted. Sometimes. In this way, the leakage monitoring system 1 monitors leakage of personal information by acquiring leakage destination data that has been addressed to the leaked personal information and searching for leaked personal information on the network.

Next, the operation after the preprocessing is performed will be described.
FIG. 9 is a diagram illustrating processing performed by the leakage monitoring system 1. First, the personal information stored in the personal information database DB is preprocessed as described above ((1) in FIG. 9), so that personal information and dummy information are stored in the personal information database DB. . At this time, it is assumed that dummy information is stored as personal information of the management numbers “3, 6, 9” as shown in FIG.

  Next, it is assumed that personal information of the management number “4-7” is leaked from this personal information database ((2) in FIG. 9), and the third party acquires the personal information by some method ((3 in FIG. 9). )). At this time, the third party has dummy information as personal information of management number “6” together with the leaked personal information (personal information of management numbers “4, 5, 7”) (see FIG. 9). The leakage path of personal information may be leaked from the personal information database DB via the Internet, or may be leaked by storing the personal information in the personal information database DB in a recording medium and taking it out. Regardless of the leakage route, the personal information leaked by the third party is acquired.

  Next, it is assumed that the third party uses the leaked personal information by sending an e-mail addressed to an e-mail address included in the leaked personal information or making a call to a telephone number. At this time, since part of the leaked personal information is dummy information, an e-mail sent to the e-mail address of the personal information with the management number “6” reaches the mail server 12 of the leak monitoring system 1 ( (4) in FIG. 9), the mail server 12 takes a received record of the received e-mail ((5) in FIG. 9). Similarly, a call made by a third party to the telephone number of the personal information with the management number “6” reaches the CTI 11 of the leakage monitoring apparatus 2 ((6) in FIG. 9), and the CTI 11 is multiplied. A telephone call record is taken ((7) in FIG. 9).

  In addition, it is assumed that the acquired personal information is made public by a third party posting on a website on the Internet or posting on a site such as a bulletin board ((8) in FIG. 9).

As described above, personal information leaked from the personal information database DB is illegally used. Under such circumstances, the leakage monitoring system 1 performs monitoring processing for monitoring leakage of personal information.
FIG. 10 is a flowchart showing the flow of the monitoring process. Hereinafter, the operation performed by the monitoring process will be described with reference to the flowchart of FIG. In addition, the process of step S200-step S230 is a process which the host computer 10 performs as the detection means 23 using a mail server, CTI11, and a search engine. The processes in steps S240 to S250 are processes performed by the host computer 10 as the analysis unit 24. The process of step S260 is a process performed by the host computer 10 as the notification unit 25 using the mail server 12.

  When the monitoring process is started, first, in step S200, the host computer 10 determines whether it is time to monitor leakage of personal information. In the leakage monitoring system 1 of this embodiment, the monitoring process is performed twice (am and afternoon) per day. Note that a user such as a system administrator may directly operate the host computer 10 to perform processing at any time. As a result of the determination, if the monitoring time has passed, the process proceeds to step S220. If it is before the time for generating dummy information, the process proceeds to step S210.

  In step S210, the process waits for a predetermined time. When the predetermined time has passed, the process proceeds to step S200. In this way, step S200 and step S210 are repeated until the time for monitoring is reached, and the processing after step S220 is performed at a predetermined time.

  In step S220, the host computer 10 acquires leakage information. In practice, the search engine 13 of the detection means 23 uses the character strings of “user name”, “mail address”, “phone number”, and “address”, which are attribute information of dummy information, as keywords on the network. Search various sites such as homepages and databases. When the corresponding character string is searched, dummy information including the searched character string is regarded as leaked and is acquired as leaked information.

  Here, in the mail server 12 of the detection means 23, the email address of the transmission source of the email transmitted as described above, the email address of the transmission destination, and the received time are recorded as leakage information (FIG. 9). (See (5)).

  Also, the CTI 11 of the detecting means 23 records the telephone number set as described above, the telephone number of the telephone call destination, and the time when the telephone call was made as leakage information ((7) in FIG. 9). .

  The host computer 10 acquires the leakage information detected by the search engine 13, the leakage information detected by the mail server 12, and the leakage information detected by the CTI 11 of the detection unit 23. Then, the leak information is collected and one leak information list L is generated.

  FIG. 11 is a diagram showing a leakage information list L generated by integrating these pieces of information from the acquired leakage information. The leakage information list L shown in FIG. 11 is created by collecting leakage information acquired by the mail server 12, the search engine 13, and the CTI 11 shown in FIG. 5 into one list. As described above, the attribute information of the three pieces of leakage information is collected into one list, whereby the leakage information is unified by each means.

Next, in step S230, the host computer 10 determines whether or not personal information has been leaked using the leaked information list L acquired in step S220.
Here, the dummy information is personal information of a person who does not actually exist, and the information whose communication destination is the CTI 11 or the mail server 12 is information included only in the dummy information. Therefore, there is communication to the CTI 11 or the mail server 12. At this time, it can be considered that dummy information has leaked from the personal information database DB.
Similarly, when the search engine 13 searches the Internet and finds information that matches the attribute information that only the dummy information has, it can be considered that the dummy information has leaked from the personal information database DB.
Therefore, if even one leak information is included in the leak information list L, it can be considered that personal information is leaked together with dummy information from the personal information database DB. If there is leak information even in one case (Yes), the process proceeds to step S240 because personal information has been leaked. If there is no leakage information (No), there is no leakage of personal information, so the process returns to step S200 and waits until the next time for monitoring leakage information.

  Next, in step S240, the host computer 10 creates notification information according to a predetermined format from the leakage information list L.

  FIG. 12 is a diagram showing notification information. This notification list is created using the leakage information list L shown in FIG. 11 and the dummy information database DDB shown in FIG. The notification information includes “detection means”, “information leaked database”, “leakage information management number”, “leak email address”, “leak address”, “leak phone number”, “ “Detection date / time” and “creation date / time of (dummy information)” are recorded. These pieces of information are created using the leakage information list L shown in FIG. 11 and the dummy information reference table DT shown in FIG.

  Next, in step S250, analysis information is created using the notification information created in step S240 and the personal information stored in the personal information database DBA. Here, the "information leaked database", "leakage of personal information leaked", "number of leaked personal information" and "leakage time" are estimated and obtained as analysis information from multiple leaks of notification information To do.

  FIG. 13 is a diagram illustrating processing for creating analysis information. The upper part of FIG. 13 shows personal information stored in the personal information database DBA, and the lower part of FIG. 13 shows the created analysis information. Here, description will be made assuming that the analysis is performed using the notification information shown in FIG. 12 and the personal information shown in the upper part of FIG. The analysis information includes information indicating “information leaked database”, “leakage range”, “number of leaked cases”, and “leakage time”. First, in the “information leaked database”, the leaked personal information database DB is selected with reference to the notification information, and data is written.

  Next, the “management number of the leaked range” is analyzed. Here, using the leaked dummy information and the leaked information that has not been leaked, the range of the management number of personal information that may have been leaked out of the personal information in the personal information database DB is acquired. The upper part of FIG. 13 shows personal information in the personal information database DBA. As shown in the dummy information table T in FIG. 4, the personal information of the management numbers “3, 6, 9” is dummy information. Here, as shown in FIGS. 9 and 12, the management number of the leaked information is “6”, and no leakage is detected for the dummy information of the management numbers “3” and “9”. Therefore, it can be estimated that there is a possibility that personal information having a management number in the range of “4 to 8” between the dummy information that has not been leaked may have been leaked. In this way, analysis is performed by estimating personal information that may have been leaked using leaked dummy information and dummy information that has not been leaked. In addition, as described in FIG. 9, since the personal information of the management number “4-7” has actually leaked, the estimation result that the personal information of the management number “4-8” may have leaked Is reasonable.

  Next, the “number of leaked cases” is analyzed. Here, the number of personal information is obtained based on the estimated “management number of the leaked range”. In the example of FIG. 13, personal information with a management number in the range of “4 to 8” is leaked, so the “number of leaked cases” is “5”.

  Next, the “leak time” is analyzed. Here, the estimation is performed based on the “creation date” of the notification information. For example, in the example of FIG. 13, the leaked personal information is created on August 1 so that “08.01” is included in the “creation date” of the notification information. In addition, the personal information of the management number “3” created at “07.01” before and after this and the personal information created at “09.01” are not leaked. Therefore, it can be estimated that personal information leaked between “07.01 and 09.01”. As described above, the “information leaked database”, “leakage range management number”, “leakage number”, and “leakage time” are estimated from the notification information, and analysis information is created.

  When the processing in step S250 is completed, in step S260, the host computer 10 notifies the system administrator of the notification information created in step S240 and the analysis information created in step S250 via the mail server 12. That is, the leakage notification is performed by sending an e-mail describing the notification information and analysis information to the e-mail address addressed to the system administrator. When step S260 ends, the process ends.

  As described above, according to the present embodiment, the system administrator can know that personal information has been leaked from the personal information database DB, and can also be leaked by the notification information and analysis information shown in FIG. It is possible to obtain various information related to the information and information related to the leakage destination.

  The processing of this embodiment has been described above. Hereinafter, effects of the present embodiment will be described.

(1) In this embodiment, by utilizing the search engine 13, the mail server 12, and the CTI 11, it is possible to quickly know that personal information has leaked from the personal information database DB without performing any operation.
(2) In the present embodiment, personal information leaked from the personal information database DB, a leak destination, and a leak range can be quickly known without any operation.
(3) Since dummy information that is personal information of a fictitious person is used, the personal information of an actual person is not detected and determined to have been leaked. Therefore, it is possible to accurately determine that personal information has leaked from the personal information database DB of the leakage monitoring system 1.
(4) It is possible to know “the management number of the leaked range”, “the number of leaked personal information” and “the leaked time” estimated from a plurality of leaked information. The system administrator can use this information to obtain a clue for identifying the cause of the information leakage, the outflow route, and the like.
(5) The detecting means 23 detects leaked information every predetermined time. Therefore, leakage of personal information can be regularly monitored without the system administrator's operation.
(6) The dummy information generating means generates dummy information every predetermined time. Accordingly, since dummy information with a creation history remaining is generated at regular time intervals, it is possible to more accurately estimate the time when personal information was leaked.

  Although one embodiment of the present invention has been described above, the present invention is not limited to such an embodiment, and can be implemented in various forms without departing from the spirit of the present invention. Hereinafter, a modification will be described.

  (Modification 1) In the above embodiment, notification is performed by transmitting an e-mail describing notification information to the system administrator. As a first modification, the notification information and the analysis information may be recorded as a leakage information file on a hard disk (not shown) provided in the host computer 10. The system administrator can check the leakage information of the leakage information file using a display device such as a display. As a form of notification, for example, various methods may be used without departing from the purpose, such as mailing notification information, transmitting telegram or fax, or sounding an alarm.

  (Modification 2) In the above-described embodiment, the host computer 10 performs processing for monitoring leakage information by referring to the reception record of the mail server 12 and the call record of the CTI 11 at a predetermined time. As a second embodiment, when the mail server 12 receives an e-mail, it may promptly notify the host computer 10 of leakage information of the received e-mail. The CTI 11 may notify the host computer 10 of the telephone call record promptly when a call is made. In this way, monitoring processing is performed as soon as an e-mail or telephone call that may have been leaked is received, and the system administrator is notified, so that the leakage status of personal information can be monitored in real time. .

  (Modification 3) In the above embodiment, the “address of information on the network”, “leaked user name”, “mail address”, “phone number”, and “address” detected by the search engine 13 are used as notification information. The system administrator was notified. The content to be notified is not limited to this, and more various information can be notified. In addition, when the search engine 13 finds leaked information on a bulletin board on the network, in addition to the address of the page, the mail address of the poster who posted the bulletin board information and the description content of the bulletin board are copied and acquired. . Then, in addition to the notification information created including the mail address of the sender of the information on the bulletin board, the description content of the bulletin board may be attached as text data and notified to the system administrator. In this way, even if the leaked information once posted on the bulletin board is deleted after that, it is possible to know the detailed status of the leaked information and leaked contents.

  (Modification 4) In the above-described embodiment, the case where leakage of “name”, “mail address”, “phone number”, and “address” is monitored as personal information has been described. However, the present invention is not limited to personal information. Of course. For example, it may be various personal information such as a person's date of birth, occupation, age, sex, credit card number. Moreover, even if it is not personal information, for example, it is possible to monitor information leakage for various information requiring confidentiality such as company sales information, product information, or a conference record.

  (Modification 5) The present invention may be a leakage monitoring method. Moreover, it is good also as a leakage monitoring program which makes a computer perform at least 1 function among a dummy information production | generation means, a memory | storage means, a detection means, an analysis means, and a notification means. Furthermore, various recording media that can be read by a computer in which the leakage monitoring program is recorded may be used. In this way, it is possible to provide a leakage monitoring program from the recording medium and allow a general-purpose computer to function as a leakage monitoring system.

The figure which showed the structure of the whole monitoring system of one Embodiment of this invention. The figure which showed the personal information memorize | stored in the personal information database. The figure which showed the dummy information memorize | stored in the dummy information database. The figure which showed the dummy information reference table. The figure which showed leak information. (A) is a diagram showing leaked information received by the mail server, (b) is a diagram showing leaked information discovered by a search engine, and (c) is a leaked information remaining in a CTI call record. FIG. The figure which showed the functional structure of the monitoring system. The flowchart which showed the flow of the process performed with respect to a personal information database. Explanatory drawing of the process performed with respect to a personal information database. Explanatory drawing of the process which a leak system performs. The flowchart which showed the flow of the process which monitors the leakage of personal information. The figure which showed the leakage information list. The figure which showed notification information. The figure explaining the process which produces analysis information.

Explanation of symbols

DESCRIPTION OF SYMBOLS 1 ... Leakage monitoring system, 2 ... Monitoring apparatus, 10 ... Host computer, 11 ... CTI, 12 ... Mail server, 13 ... Search engine, 20 ... Dummy information generation means, 21 ... Dummy information storage means as pseudo information storage means, 22 ... Personal information storage means as storage means, 23 ... Detection means, 24 ... Analysis means, 25 ... Notification means, SA-SC ... Database system, DB (DBA-DBC) ... Personal information database, DDB ... Dummy information database, DT ... dummy information reference table, L ... leakage information list.

Claims (12)

Storage means for storing the fact information arranged in a predetermined format and requiring confidentiality, and pseudo information having destination information indicating a destination of communication that is arranged in the same format as the fact information and is not disclosed;
When the fact information and the pseudo information are leaked from the storage means and communication is performed to the destination indicated by the destination information included in the pseudo information, by receiving the communication via a network, And a detecting means for detecting that fact information has leaked from the storage means. In the leak monitoring system according to claim 1,
The leakage monitoring system according to claim 1, wherein the detection unit acquires specific information for specifying a transmission source of the communication performed at the destination. Storage means for storing fact information that is organized in a predetermined format and requires confidentiality, and pseudo information that is organized in the same format as the fact information and is not disclosed;
When the fact information and the pseudo information leak from the storage means, and the leaked pseudo information is disclosed on the network, the fact information is retrieved from the storage means by searching the information on the network for the pseudo information. A leakage monitoring system comprising: a detecting means for detecting that the battery has leaked. In the leakage monitoring system according to claim 3,
The leakage monitoring system according to claim 1, wherein the detection unit acquires specific information for specifying a location on the network where the pseudo information is found by searching information on the network for the pseudo information. In the leak monitoring system according to any one of claims 1 to 4,
Pseudo information storage means for storing the pseudo information;
By referring to the pseudo information detected by the detection means, the pseudo information stored in the pseudo information storage means, and the specific information, the leakage status of the fact information is estimated and analysis information is acquired. A leakage monitoring system further comprising an analysis means. In the leak monitoring system according to any one of claims 1 to 5,
A leak monitoring system, further comprising notification means for notifying a predetermined person of at least one of the leaked fact information or the analysis information indicating that the fact information has leaked. In the leak monitoring system according to any one of claims 1 to 6,
The leak monitoring system, wherein the detection means detects leak of the pseudo information every time a predetermined time elapses. Storing fact information arranged in a predetermined format and requiring confidentiality, and pseudo information having destination information arranged in the same format as the fact information and indicating destination of communication that is not disclosed;
When the fact information and the pseudo information are leaked from the storage means, and communication is performed to the communication destination indicated by the destination information included in the pseudo information, the communication is received via a network. And a detection step of detecting that fact information has leaked from the storage means. Storing fact information arranged in a predetermined format and requiring confidentiality, and pseudo information having destination information arranged in the same format as the fact information and indicating destination of communication that is not disclosed;
When the fact information and the pseudo information leak from the storage means, and the leaked pseudo information is disclosed on the network, the fact information is retrieved from the storage means by searching the information on the network for the pseudo information. A leakage monitoring method comprising: a detection step for detecting leakage of the liquid. Computer
Storage means for storing fact information arranged in a predetermined format and requiring confidentiality, and pseudo information having destination information indicating a destination of communication that is arranged in the same format as the fact information and is not disclosed,
When the fact information and the pseudo information are leaked from the storage means, and communication is performed to the communication destination indicated by the destination information included in the pseudo information, the communication is received via a network. Accordingly, a leakage monitoring program that functions as detection means for detecting that fact information has leaked from the storage means. Computer
Storage means for storing fact information arranged in a predetermined format and requiring confidentiality, and pseudo information having destination information indicating a destination of communication that is arranged in the same format as the fact information and is not disclosed,
When the fact information and the pseudo information leak from the storage means, and the leaked pseudo information is disclosed on the network, the fact information is retrieved from the storage means by searching the information on the network for the pseudo information. Leakage monitoring program that functions as a detection unit that detects that a leak has occurred. The computer-readable recording medium which recorded the program as described in any one of Claim 10 or 11.

Images