JP2006350813A - Personal information protection management system and method - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide a personal information protection management system capable of managing personal information while protecting it in consideration of complication of processing via a privacy proxy or via a filter based on information of D-privacy and revelation of personal information. <P>SOLUTION: A provider terminal transmits a disclosure request for user personal information necessary for offering a service to a personal information protection management device. The personal information protection management device determines whether there is the personal information included in the disclosure request exists in a database or not, and if existence of the personal information is determined, determines whether specification of the service user is difficult or not according to a predetermined threshold. When the difficulty is higher than the threshold, the personal information protection management device returns the personal information corresponding to the disclosure request. Then, use as a value of the disclosure of the personal information is calculated and payment processing of a usage fee is carried out. <P>COPYRIGHT: (C)2007,JPO&INPIT

Description

  The present invention relates to the use and provision of user personal information to an unspecified number of providers (service providers providing services to users via a communication network). The present invention relates to a personal information protection operation system and a personal information protection operation method for the purpose of ensuring anonymity.

  Future network environments are heterogeneous (Heterogeneous :) where various terminals such as mobile phones, sensors, PCs (personal computers) and information appliances are connected from the homogeneous world centered on the Internet. It is expected to change into a heterogeneous world. The basic technology for realizing such a network environment is the ubiquitous networking technology. Various kinds of terminals connected to the communication network are diversified and ubiquitous, and provide a wide-area application service suitable for the user's preference and the environment in which they are cooperating with each other.

  In a ubiquitous networking environment, various sensors and actuators are connected to a communication network, which facilitates the coordination between the physical world and application services. This is a user-supported service scenario where the network environment supports the user. For the user, the input for starting the application service is reduced, and the user can receive the service without being aware of it by combining it with personal information. it can.

FIG. 12 shows a system configuration and application examples on the premise of the above service.
Various ubiquitous terminals such as user terminals 10 and 11 such as mobile phones and PCs, provider terminals 12 and 13 and a table 14 with a display function are connected to the network 15. Various servers such as an authentication server 16 and a location information management server 17 are connected to the network 15.

  There is a sensor network 18 composed of sensors that perform human detection and body temperature measurement. Sense information (body temperature, human detection time, etc.) collected in the sensor network 18 is managed by a sense information management server 19 in the network 15. In addition, the user holds the user terminal 10, and in this user terminal 10, the terminal software is generated based on the user preference information set by the user himself / herself, information specifying the user himself / herself, and preference / vulnerability information. An access control list (ACL), GPS (Global Positioning System), location information from the location information management server 17 on the network, and the like are acquired.

The user terminal 10 is appropriately connected to the network at the destination, and uses application services provided from the provider terminals 12 and 13 via the network 15.
In addition to the Internet, the network 15 includes various types such as a home network, a sensor network 18, and an ad hoc network, and these are interconnected via a gateway 110 and the like.

Next, an outline of a system assumed in the present invention will be described using an application example.
(1) The user terminal 10 detects that the user has moved from home to the restaurant.
(2) The user standing in front of the provider is detected by the human detection sensor constituting the sensor network 18 and notified to the sense information management server 19 as sense information. The service provided by the provider terminal 13 polls the sense information management server 19 and acquires necessary personal information. The provider terminal transmits a message regarding the service to the user terminal 10.

(3) A user sits on the table 14 with a display function. The person detection sensor on the chair detects that the user has taken a seat, and simultaneously notifies the sense information management server 19 of the device ID of the table 14 with display function via the sensor network 18. The video content delivery service provided by the provider terminal 12 obtains the device ID and the person detection information by polling the sense information management server 19. Based on this information source, the video content is sent to the table 14 with display function.

Personal information is information about an individual associated with a user ID. Conventional personal information includes user information such as name, address, age, gender, medical history, family structure, preferences, intentions, and static information input by the user from the terminal (static Mainly information on personal information: S-Privacy).
However, in a ubiquitous networking environment, information that can be acquired by sensors such as a living body, temperature, and human detection, information that can be acquired in association with user actions such as position, time, electronic money and boarding records, and a history such as these Information (dynamic personal information: D-Privacy) that the system senses and acquires the behavior and behavior of the user is also included in the personal information, and the personal information regarding the privacy of these users continues to increase. it is conceivable that.

In general, in the use of personal information, anonymity and convenience are in a trade-off relationship. Therefore, in order to systemize the use of personal information, it is necessary to establish a method for appropriately evaluating anonymity.
Corresponding to this, a method has been proposed in which personal information that can be disclosed in end-to-end between a user and a provider is negotiated via a privacy proxy on the network (see Non-Patent Document 1).

  However, the premise of the prior art of Non-Patent Document 1 is that it corresponds to S-Privacy, and when this prior art is realized with D-privacy included in personal information, Since the increase and the service providing frequency increase, the number of negotiations between the user and the provider for determining whether or not information can be disclosed increases, and processing necessary for the service becomes complicated.

Further, in the proposed method in which the service activation control is performed by separating the user ID and the personal information, the service is proposed / provided using the location information as a trigger without using the user ID (see Non-Patent Documents 2 and 3). ).
However, in the above-described conventional example, there is no provision for estimation of a user by a combination of D-Privacy information other than position information and personal information.

In the method of searching for a service that matches the user's preference using the user preference filter, the user generates a user preference filter in advance based on S / D-Privacy, and there is no corresponding service on the network based on the filter. (See Non-Patent Document 4).
In this prior art, it is necessary to regenerate the filter every time the behavior changes, and the user's processing becomes complicated.

In the prior art of Non-Patent Document 4, when transmitting a filter to a network, personal information is known to an unspecified number of providers by taking a user ID and a filter transmission log.
The user who provided the personal information may become a user of the personal information as in the application usage example in which the user who cooperated with the questionnaire knows the result of the questionnaire including himself / herself. As described above, the above-described conventional technique causes the same problem not only when the user and the provider are limited, but also when the user uses personal information of another user.
Borriellor et al. [G. Borriello, LE Holmquist; "A Privacy Awareness System for Ubiquitous Computing Environments" In 4th International Conference on Ubiquitous Computing (UbiComp2002), Springer-Verlag LNCS 2498, pp. 237-245, September 2002. Akio Karashima, Noriaki Izumi, Koichi Kurumaya, Hideyuki Nakajima: “Multi-Agent Architecture for Content Distribution in Ubiquitous Environment: CONSORTS”, Information Processing Research Report Vol.2003, No.39, pp.7-14, 2003. Nakajima Hideyuki, Hashida Koichi, Mori Akira, Ito Hideo, Motomura Yoichi, Kurumaya Koichi, Yamamoto Yoshinobu, Izumi Kiyoshi, Noda Itsuki 18, No4, pp.48-56, 2001. Hiroshi Shibata, Takanari Hoshiai, “Autonomous Agent in Personalized Information Proposal Service”, IEICE Technical Report, KBSE2001-56, pp.53-60, 2001.

  Therefore, the present invention has been made in view of circumstances such as complexity of processing when using a privacy proxy, complexity of processing when using a filter, and disclosure of personal information based on D-Privacy information. It is an object to provide a personal information protection operation system and a personal information protection operation method that can be operated as a business while protecting the personal information.

To achieve the above object, according to the present invention, a user terminal of a service user, a provider terminal of a service provider, and a personal information protection operation device that manages protection and disclosure of personal information of the service user are connected via a communication network. Connected to the personal information protection operation system, wherein the user terminal includes personal information registration means for registering personal information of the user terminal in the personal information protection operation device, and the provider terminal is a user required for providing the service. The personal information protection operation device includes a database for storing personal information of a user, and the personal information included in the disclosure request includes the personal information protection operation device. Determine whether it exists in the database, and if it exists, determine whether it is difficult to identify the service user using a predetermined threshold A disclosure availability determination unit that returns personal information corresponding to the disclosure request, a usage fee calculation unit that calculates usage for the disclosure of the personal information, and the usage fee A personal information protection operation system comprising payment processing means for performing payment processing.
As a result, the usage fee is calculated and the fee is paid, so that business can be performed using personal information while protecting the privacy of the service user.

In the present invention, the personal information protection operation device includes a privilege provision management unit that manages a privilege as a consideration as provision of personal information, and the privilege provision management unit includes the service as a consideration for disclosure of the personal information. It is determined that information relating to a privilege to be provided to a user is read from a database, and the privilege information is given to the service user.
Thereby, the provider gives a privilege to the user in return for providing personal information, and the privilege can be changed according to the privilege, thereby changing the disclosure amount of the user's personal information.

Further, according to the present invention, the personal information protection operation apparatus performs storage fee calculation means for calculating a storage fee for the service user to safely store the personal information, and payment processing of the personal information storage fee of the service user. And a storage fee payment means.
As a result, it is possible to collect a maintenance cost for safely storing the personal information of the user. Therefore, it is possible to store highly confidential personal information with a high security function.

  Further, according to the present invention, the disclosure permission determination unit of the personal information protection operation apparatus is configured to use the database based on a correspondence relationship between questionnaire items and answers registered in the questionnaire information and a predetermined threshold in the database. A correspondence relationship between a questionnaire item and an answer that does not specify a user registered in is extracted and transmitted to the provider terminal.

  In addition, the present invention includes a warning unit that transmits warning information to the user terminal when the personal information protection operation apparatus detects an input to a questionnaire item that can be specified by a user registered in the database. It is characterized by.

  Further, according to the present invention, the disclosure permission determination unit determines whether or not a plurality of personal information received from the user terminal exists in the database, and if it exists, it is difficult to identify the service user. This is characterized in that it is determined by a predetermined threshold value, and if it is equal to or greater than the threshold value, personal information equal to or greater than the threshold value is transferred.

  In addition, the present invention provides personal information protection in which a user terminal of a service user, a provider terminal of a service provider, and a personal information protection operation apparatus that manages protection and disclosure of personal information of the service user are connected via a communication network. A personal information protection operation method in an operation system, in which the user terminal registers its own personal information in the personal information protection operation device, and the provider terminal issues a request for disclosure of user personal information necessary for providing a service. The personal information protection operation device stores the personal information of the user in a database, and the personal information protection operation device has the personal information included in the disclosure request in the database. And if it exists, it is determined whether or not it is difficult to identify the service user using a predetermined threshold, and the threshold In the case of the above, the personal information corresponding to the disclosure request is returned, the personal information protection operation device calculates a use that is a price for the disclosure of the personal information, and the personal information protection operation device It is a personal information protection operation method characterized by performing a fee settlement process.

  According to the present invention, personal information is protected and operated, and the personal information registered in the personal information protection operation device on the network is disclosed to the provider at a level where it is difficult to identify the individual. And it can be connected to the service provision of the provider.

  Hereinafter, a personal information protection operation system according to an embodiment of the present invention will be described with reference to the drawings. FIG. 1 is a block diagram showing a configuration of a personal information protection operation system according to the embodiment. In this figure, reference numeral 1 denotes a user terminal. Reference numeral 2 denotes a provider terminal. The user terminal 1 is, for example, a terminal provided at the user's home or carried by the user himself / herself. Then, the user receives provision of various services from the provider terminal 2. An authentication / key management server 3 authenticates the user terminal 1 and the like. Reference numeral 4 denotes a sense information management server that holds various types of information when a user is detected. Reference numeral 5 denotes a personal information protection operation server that performs personal information protection processing and transmits user personal information to the provider terminal 2 in response to a personal information transmission request from the provider terminal 2. Reference numeral 6 denotes a wireless tag that receives, for example, an ID transmitted by the user terminal 1 and transmits the ID information to the sense information management server 4. Reference numeral 7 denotes a street camera that detects the user and transmits the photographed user's identification information and the time to the sense information management server. The terminals and devices shown in FIG. 1 are connected via a communication network.

FIG. 2 is a diagram showing functional blocks of the personal information protection operation server.
Next, the personal information protection operation server will be described with reference to FIG.
In the personal information protection operation server 5, reference numeral 501 denotes a communication processing unit that transmits and receives information to and from other servers and terminals via a communication network. A control unit 502 controls each processing unit in the personal information protection operation server 5. Reference numeral 503 denotes a disclosure permission determination processing unit that determines whether or not personal information can be disclosed. Reference numeral 504 denotes a disclosure processing unit that performs processing for transmitting the disclosed personal information to the provider terminal 2 or the like. A database management unit 505 manages database information. Reference numeral 506 denotes a usage fee management unit for calculating a usage fee charged to the provider by disclosing personal information. Reference numeral 507 denotes a payment processing unit that calculates a price paid to an individual user by disclosing personal information. Reference numeral 508 denotes a database for storing various personal information.

  FIG. 3 is a diagram showing an example of a data table held in the database of the personal information protection operation server. As shown in this figure, in the database 508, personal information (S-Privacy / D-Privacy) and a user ID are recorded in association with each other. Here, the D-Privacy is rewritten by the database management unit 505 at regular time intervals or when new personal information is input by the FIFO (First In First Out) method. In FIG. 3, the information of D-Privacy is attribute 3 (place of dinner), attribute 4 (person who ate together), and attribute 5 (location of 19:00). Other attributes are personal information of S-Privacy.

Next, the processing of the disclosure permission determination processing unit 503 in the personal information protection operation server 5 will be described.
In the present invention, a decision tree learning algorithm is considered from the viewpoint of protecting personal information. The personal information to be made anonymous with respect to the provider is, for example, the name of the user. The personal information requested to be disclosed by the provider for the name of the user to be protected (that is, the personal information such as the user ID is protected by not notifying the provider of the name of the user who can identify the individual). The information gain is calculated, and if the personal information has a small information gain, the disclosure is permitted.

  “Information entropy (hereinafter abbreviated as entropy)” is used to calculate the information gain. Entropy is a quantity that quantitatively represents the degree of uncertainty before and after receiving information as an element for an information source that is a set of information. In the present invention, the expected value of the amount of information obtained by receiving certain personal information is expressed by entropy.

  In order to explain the outline of entropy, let us consider a set of 100 users composed of 50 men and women as an example. The entropy value is maximized when information such as “gender” is generated with the same probability and is defined as having the highest anonymity. Conversely, the entropy is minimized when personal information having an occurrence probability of 1 is given, and at this time, it is defined that the anonymity is the lowest. That is, if there is only one user named “Alice” out of 100 people, receiving the name Alice as information minimizes anonymity (that is, there is no anonymity). Disclosing information with minimal anonymity is a problem from the viewpoint of personal information protection.

  Using the personal information of the user as an information source for entropy calculation, the amount of uncertainties related to the identification of the user ID before and after receiving the personal information is expressed by entropy, and anonymity is quantified. As described above, personal information includes S-Privacy and D-Privacy, and is stored in the database 508 as a pair of attribute type and attribute value in association with the user ID. Attributes include gender and age.

  The advantage of using entropy is that even if the object to be anonymous is an attribute value that can identify one person, such as “Attribute 6: Name—Alice” in FIG. 3, “Attribute 1: Gender—Male” or “ A user set having a common attribute value such as “attribute 2: occupation—student” can be calculated by the same method even if it is an anonymous object.

  In the ubiquitous networking environment as shown in FIG. 1, the number of users connected to the communication network changes with time. Therefore, when applying the concept of entropy to protect personal information in a ubiquitous networking environment, the condition that the set of users, which is the premise of entropy calculation, is usually not satisfied. Therefore, it is necessary to quantify anonymity that does not depend on the user set. Therefore, the time when the change of the user set due to withdrawal / participation or movement in the ubiquitous networking environment can be ignored is Δt, the entropy is calculated in Δt time units, and the change of the user set is normalized by normalizing the calculated entropy value. To absorb.

  The normalized value is used as an anonymity evaluation scale. Since the user set changes every Δt time, the personal information protection operation server 5 rewrites the database 508 each time. The number and types of attributes, and the distribution of their attribute values differ for different user sets.

Here, various methods can be considered as a normalization method. In this embodiment, the following method is adopted. First, in the attribute to be protected, the user having the same attribute value as that of the user to be made anonymous is divided into two classes, that is, positive, and the attribute value not so is negative. In user set, entropy regarding positive and negative user to be anonymous H _O, the entropy when an attribute F has been found in the case of the H _F, the ratio of the entropy decreases by knowing the F, and D _F, which Is used as a quantitative measure of anonymity

In the above formula,
P ₊ : Probability that is positive in all user sets P ₋ : Probability that is negative in all user sets P _i : Set of attribute values of F {ν ₁ , ν ₂ , ν ₃ , ν ₄ ,. .., Ν _n }, a probability P _{i +} that is positive when F is ν _i : A set of attribute values of F is represented by {ν ₁ , ν ₂ , ν ₃ , ν ₄ ,. _n }, a set of attribute values of probability P _i− : F that is positive in a set where F is ν _i is {ν ₁ , ν ₂ , ν ₃ , ν ₄ ,..., ν _n } The probability of being negative in the set where F is ν _i .

The disclosure permission determination processing unit 503 of the personal information protection operation server 5 sets a threshold value of _DF in advance according to the security requirement condition of the application or system. If the _DF calculation result for the combination of the attribute type and the attribute value included in the disclosure request specified from the provider terminal 2 is equal to or greater than the threshold, the user's personal information corresponding to the combination of the attribute type and the attribute value is sent to the provider. If it is disclosed and the value is less than the threshold value, a process of not disclosing personal information of the user corresponding to the attribute type and attribute value is performed.

Next, the disclosure availability determination process will be described with a specific example.
First, in the embodiment described below, it is assumed that personal information is requested by a network service provider (hereinafter referred to as “service provider” or “provider”). When the personal information protection operation server 5 receives the request message (disclosure request) of the user's personal information necessary for providing the service from the provider terminal 2, the personal information protection operation server 5 searches the database 508 and searches for the personal information. The disclosure possibility determination processing unit 503 calculates the ratio of users having the personal information to the total number of registered users. If the ratio is greater than or equal to a predetermined threshold value, the personal information is transmitted to the provider terminal 2; Process that does not disclose information. Details of the processing will be described below.

  First, when the user connects the user terminal 1 to the communication network, the user registers the S-privacy that may be presented in exchange for receiving the ubiquitous service in the personal information protection operation server 5 using the terminal 1. Also, D-privacy information is acquired by the street camera 7 and the wireless tag 6 and registered in the sense information management server 4. The database management unit 505 acquires D-privacy (user ID, attribute type, attribute value) information registered from the sense information management server 4 every Δt time and registers it in the database 508.

  Next, in order to detect whether a user who uses the service is connected to the network at a predetermined opportunity, the provider terminal 2 issues a disclosure request that holds at least the attribute type and the attribute value. Send to server 5. At this time, the provider terminal 2 may transmit a disclosure request holding a plurality of attribute type / attribute value pairs.

FIG. 4 is a diagram showing a flow of disclosure request determination processing in the personal information protection operation server.
Next, referring to FIG. 4, the personal information protection operation server 5 receives the disclosure request (step S101), and the database management unit 505 has information corresponding to the attribute type / attribute value pair included in the disclosure request from the database 508. It is searched and confirmed (step S102). Next, when the database management unit 505 detects that the attribute type / attribute value pair of the corresponding disclosure request is recorded, the disclosure permission determination processing unit 503 determines the number of user terminals 1 connected to the network. In the total number of users (detected from the number of user IDs registered in the database 208), the number of users having attribute type / attribute value pairs specified in the disclosure request is calculated (step S103).

  Next, the disclosure permission / inhibition determination processing unit 503 calculates the ratio of the number of users having attribute type / attribute value pairs to the total number of users, and whether or not this ratio is greater than (or more than) a threshold set in advance by the system. (Step S104), if the result is greater than the threshold value, it is assumed that the anonymity standard defined by the system is satisfied, and the user ID holding the attribute type and attribute value specified in the disclosure request The provider terminal 2 is notified of the personal information for each user that cannot identify the user ID (step S105). On the other hand, as a result of calculating the ratio of the number of users having attribute type / attribute value pairs to the total number of users as a result of calculation, the disclosure availability determination processing unit 503 determines that the anonymity specified by the system is less than a threshold set in advance by the system. Is not satisfied and the disclosure processing unit 504 notifies the provider terminal 2 that there is no corresponding user (step S106). If the attribute type / attribute value pair specified in the disclosure request is not detected in step S102, the disclosure processing unit 504 notifies the provider terminal 2 that there is no corresponding user (step S107).

Thereby, the provider terminal 2 performs various services based on the notified personal information. Through the above processing, the user terminal 1 and the provider terminal 2 connected to the communication network ensure a predetermined anonymity level without notifying individual information that can be disclosed end-to-end individually. However, notification is possible.
Furthermore, since the personal information can be used asynchronously with the personal information registration of the user, the convenience of the personal information user (particularly D-Privacy information) of the provider or user is improved.

  Then, when the personal information is notified to the provider terminal 2, the usage fee management unit 506 calculates a fee as a compensation for providing the personal information. This calculation method is performed by, for example, processing such as reading a charge from a charge table corresponding to the attribute type, and adding and calculating only the notified attribute type. Alternatively, the usage fee management unit 506 calculates the fee each time it is used, and the payment processing unit 507 transmits the calculation result amount to a bank settlement system or the like connected via the communication network, and the compensation by providing personal information. You may make it perform a payment process.

FIG. 5 is a first diagram illustrating an example of a service using a personal information protection operation server.
As shown in FIG. 5, the personal information protection operation server 5 may include a privilege provision management unit 509 that gives a privilege such as money or a product as consideration for the operation of personal information. For example, the privilege provision management unit 509 counts the number of attribute types notified as personal information, and if the number is equal to or greater than a threshold, acquires a product identification number corresponding to the number of attribute types from the database 508 or the like, The shipping flag for the identification number and the user ID that provided the personal information are associated with each other and written in the database 508, thereby processing such that benefits such as merchandise are delivered to the user at a later date. As a result, the user can obtain benefits such as benefits as consideration for providing personal information. The disclosure range of the personal information changes depending on the content of the privilege. For example, according to a survey we conducted, there are several types of personal information that a user may disclose to obtain the benefit of a 100 yen gift certificate, but for a 1000 yen gift certificate. For example, we believe that we may disclose personal information more than double that of 100 yen. Thus, the disclosed amount of the personal information depends on the content of the privilege obtained as the consideration. In addition, this disclosure possibility determination processing unit 503 may disclose more personal information to the provider by changing the threshold value for each privilege and lowering the threshold value when the privilege is useful for the user.

FIG. 6 is a second diagram showing an example of a service using a personal information protection operation server.
The personal information protection operation server 5 may perform a questionnaire survey and a service for announcing the result. When performing this process, the provider terminal 2 includes a questionnaire creating unit 201 that creates a questionnaire for collecting personal information as shown in FIG.
When the provider instructs the provider terminal 2 to create a questionnaire, the questionnaire creating unit 201 creates a questionnaire. The created questionnaire is transmitted to the user terminal 1 via the communication network. This questionnaire may be distributed, for example, by web page data. The user inputs the questionnaire result from the questionnaire screen displayed on the display unit of the user terminal 1 and transmits it to the personal information protection operation server 5. The personal information protection operation server 5 registers the collected questionnaire in the database 508. When the questionnaire is collected, for example, the above formulas (1) to (5) indicate whether or not the questionnaire result indicates that the user is not specified for each attribute type (question content) and attribute value (answer) of the questionnaire result registered in the questionnaire. Using (3) and the threshold value, determination is made in the same manner as in step S104. Then, the disclosure permission / inhibition determination processing unit 503 extracts questionnaire items and answers for which the user is not specified, and transmits the results to the provider terminal 1.

FIG. 7 is a third diagram illustrating an example of a service using a personal information protection operation server.
In the personal information protection operation server 5, if there is a risk of specifying the user, that is, if it is below the threshold in the processing of the disclosure permission determination processing unit 503, it is determined that the individual is likely to be specified, and a warning is given when answering the questionnaire You may make it perform the process which issues. In this case, as shown in FIG. 7, the personal information protection operation server 5 newly includes a warning processing unit 510.
First, when the collection of questionnaires exceeds a predetermined amount, the disclosure possibility determination processing unit 503 extracts questionnaire items that are easy to identify individual users in advance. And when the user who is going to newly register to a questionnaire marks the item which is easy to identify, the warning process part 510 performs the process which transmits warning information to the user terminal 1. FIG. As a result, the user does not have to answer questionnaire items for which individuals are easily identified.

FIG. 8 is a fourth diagram showing an example of a service using a personal information protection operation server.
Processing for the personal information protection operation server 5 to perform a crime prevention service will be described. In this case, as shown in FIG. 8, the provider terminal 2 includes a warning processing unit 202 that transmits a warning when there is a problem in crime prevention. Further, the personal information protection operation server 5 receives a warning message from the provider, A provider message management unit 511 that transmits a warning mail to the user registered in the area 508 is provided.

  When a user encounters an event that leads to a crime such as a suspicious person or a quarrel, the personal information protection operation server uses the user terminal 1 for information related to the event, such as the location and time of encounter, and information about the individual of the whistleblower. Send to 5. The personal information protection operation server 5 uses the above formulas (1) to (3) and the threshold value as personal information that is easy to identify the reporter among the personal information notified from the reporter, as in step S104. Judgment. Then, the personal information determined to easily identify the reporter in the personal information is deleted, and the event information is notified to the provider terminal 2 that provides crime prevention related services. If the provider terminal 2 determines that the response is urgent based on the content of the event information sent, the provider terminal 2 transmits the information to a police server or the like for notification. In the case of follow-up observation, the warning processing unit 202 instructs the personal information protection operation server 5 to send a warning mail to the user. The provider message management unit 511 of the personal information protection operation server 5 reads the mail address of the user terminal 1 registered in the database 508 and transmits a warning message mail to the mail address. As a result, the user can easily report witness information of a suspicious person or the like compared to the conventional report, and the crime prevention effect in the area is improved.

FIG. 9 is a fifth diagram illustrating an example of a service using a personal information protection operation server.
The personal information protection operation server 5 may perform maintenance and management of the user's personal information as a fee system. In this case, as shown in FIG. 9, the personal information protection operation server 5 stores the personal information of the user in the database 508, and manages the storage fee calculation unit 512 for managing the personal information without leaking outside. And a storage fee payment processing unit 513 for collecting the storage fee from the user. For each user ID, the storage fee calculation unit 512 calculates the storage fee by the period × unit price, and the storage fee payment processing unit 513 transmits the calculated storage fee to the payment system connected to the communication network. To perform settlement processing. As a result, the personal information protection operation server 5 performs personal information management using a high security technique for the personal information of the user registered in the database 508. The user can also operate highly confidential personal information on the personal information protection operation server 5.

FIG. 10 is a sixth diagram illustrating an example of a service using a personal information protection operation server.
The personal information protection operation server 5 may perform a whistleblower service. First, the provider implements a fraud monitoring service entrusted by a company or a third party organization. When this process is performed, as shown in FIG. 10, a notification processing unit 203 for reporting to the fraud management department of the company A and the police is provided to the provider terminal 3 of the provider that monitors the company fraud due to the whistle-blowing.

The user who is an employee of the company A uses the user terminal 1 to notify the personal information protection operation server 5 of the information regarding the illegal activity in the company A which is known by witnessing together with the personal information of the user who is the reporter. To do. The database management unit 505 of the personal information protection operation server 5 stores the notified information in the database 508. Next, the disclosure permission determination processing unit 503 uses the above formulas (1) to (3) and the threshold value among the personal information associated with the personal information received in the report and recorded in the database 508. As in step S104, personal information that is difficult to identify the user who is the reporter is identified, and the disclosure processing unit 504 notifies the provider terminal 3 that performs fraud monitoring of the company along with the witness information as the personal information of the reporter. To do. The information fee is calculated and paid by the usage fee management unit 506 and the payment processing unit 507. If the notified provider is urgent, the notification processing unit 203 notifies the police and the like by transmitting sighting information and personal information. If there is no urgency, the notification processing unit 203 notifies the provider terminal 4 of the department that monitors the fraud of the company A with information on the fraudulent act and prompts a warning.
As a result, the employee working at the company A can uncover fraud in the company without knowing that the whistleblower is himself.

FIG. 11 is a seventh diagram illustrating an example of a service using a personal information protection operation server.
The personal information protection operation server 5 may perform an advertisement delivery service for mass users according to the preference and behavior of the masses. Specifically, it is a service for delivering a corporate advertisement such as a time service to a user who is present on a monitor installed at a meeting place. In performing this service, an advertisement monitor 8 that sends advertisements for mass users is connected to the communication network.

The user who has arrived at the meeting place uses the user terminal 1 to protect personal information, such as his profile and today's schedule, which may be disclosed to receive services from the provider if the individual is not specified. Register with server 5. The database management unit 505 of the personal information protection operation server 5 registers the received personal information of the user in the database 508. Next, the disclosure permission / inhibition determination processing unit 503 determines which of the personal information that can be disclosed, including the registered personal information, registered in the database 508, the above formulas (1) to (3) and the threshold value. The determination is made in the same manner as in step S104. The provider terminal 2 may periodically make an inquiry to the disclosure permission / inhibition determination processing unit 503, or the personal information desired by the provider is registered in advance in the disclosure request information registration unit, and the number of users having the desired personal information is determined. If the ratio is higher than a preset ratio, the provider may be notified.
At this time, the usage fee management unit 506 calculates the usage fee and notifies the fee together. When the provider uses information from the personal information protection operation server 5, the provider pays a usage fee via the payment processing unit 507. The notified provider terminal 3 considers that a user who is interested in its service is at a certain ratio or more in the meeting place, and transmits its service advertisement to the advertisement monitor 8. Alternatively, the provider message management unit 511 may transmit an advertisement mail to a certain user's terminal 1 registered in the database 508.
Thereby, even if the user in the meeting place fluctuates dynamically, it is possible to deliver an accurate advertisement suited to the user's preference and behavior.

  Further, the personal information protection operation server 5 may perform a company consulting process. In order to grasp the customer needs for the company, the provider that consults the company conducts a questionnaire on the service contents of the company to the user via the provider terminal 2. The questionnaire result is transmitted to the personal information protection operation server 5. Then, the disclosure possibility determination processing unit 503 determines whether or not the information is information on a questionnaire result for which the user is not specified for each attribute type (question content) and attribute value (answer) of the questionnaire result. Using 3) and the threshold value, the determination is made in the same manner as in step S104. Then, the disclosure permission / inhibition determination processing unit 503 extracts questionnaire item information and a response for which the user is not specified, and transmits the result to the provider terminal 1. Alternatively, the actual state of the company is grasped by whistle-blowing, and the result is notified to the provider terminal 2 that performs company consulting in a format that is difficult for the reporter to identify. A provider that conducts corporate consulting receives information on questionnaire results and whistle-blowing information from the personal information protection operation server 5 based on the processing of the usage fee management unit 506 and the payment processing unit 507 of the personal information protection operation server 5. Pay the disclosure fee. Further, the provider that conducts the company consulting consults the company A based on the result.

  According to the present invention, both concealment and operation of personal information can be realized. Therefore, each provider can collect necessary personal information and provide a service without individually collecting personal information from the user. Moreover, since it is not necessary to manage the personal information of the user for each provider, the management cost of the personal information can be reduced. Further, since the provider does not manage personal information, even if personal information is leaked, the provider's image can be avoided. It becomes possible to increase the crime prevention effect of the company by the advertisement delivery service that follows the user's action without specifying the individual, the securing of the cooperation system for the user's crime prevention, and the whistle-blowing.

  Each of the above-described servers and terminals has a computer system. The process described above is stored in a computer-readable recording medium in the form of a program, and the above process is performed by the computer reading and executing this program. Here, the computer-readable recording medium means a magnetic disk, a magneto-optical disk, a CD-ROM, a DVD-ROM, a semiconductor memory, or the like. Alternatively, the computer program may be distributed to the computer via a communication line, and the computer that has received the distribution may execute the program.

  The program may be for realizing a part of the functions described above. Furthermore, what can implement | achieve the function mentioned above in combination with the program already recorded on the computer system, and what is called a difference file (difference program) may be sufficient.

It is a block diagram which shows the structure of a personal information protection operation system. It is a figure which shows the functional block of a personal information protection operation server. It is a figure which shows the example of the data table which a database hold | maintains. It is a figure which shows the flow of a disclosure request determination process. It is a 1st figure which shows the example of the service using a personal information protection operation server. It is a 2nd figure which shows the example of the service using a personal information protection operation server. It is a 3rd figure which shows the example of the service using a personal information protection operation server. It is a 4th figure which shows the example of the service using a personal information protection operation server. It is a 5th figure which shows the example of the service using a personal information protection operation server. It is a 6th figure which shows the example of the service using a personal information protection operation server. It is a 7th figure which shows the example of the service using a personal information protection operation server. It is an 8th figure which shows the example of the service using a personal information protection operation server.

Explanation of symbols

DESCRIPTION OF SYMBOLS 1 ... User terminal 2 ... Provider terminal 3 ... Authentication and key management server 4 ... Sense information management server 5 ... Personal information protection operation server 6 ... Wireless tag 7 ... Street camera 8 ... Advertising monitor

Claims (7)

A personal information protection operation system in which a user terminal of a service user, a provider terminal of a service provider, and a personal information protection operation device that manages the protection and disclosure of personal information of the service user are connected via a communication network. ,
The user terminal is
Comprising personal information registration means for registering own personal information in the personal information protection operation device;
The provider terminal is
A disclosure request means for transmitting a disclosure request for personal information of a user necessary for providing a service to the personal information protection operation device;
The personal information protection operation device
A database for storing user personal information;
It is determined whether or not the personal information included in the disclosure request exists in the database, and if there is, it is determined whether or not it is difficult to identify the service user by a predetermined threshold, In a case where there is a disclosure permission determination means for returning personal information corresponding to the disclosure request,
Usage fee calculating means for calculating usage as a consideration for disclosure of the personal information;
A personal information protection operation system comprising: a payment processing means for performing a settlement process for the usage fee. The personal information protection operation device
A privilege provision management means for managing benefits as consideration for providing personal information,
The privilege provision management means
The information regarding the privilege provided to the service user as a consideration for the disclosure of the personal information is read from a database, and the privilege information is determined to be provided to the service user. Personal information protection operation system. The personal information protection operation device
A storage fee calculation means for calculating a storage fee for the service user to securely store personal information;
A storage fee payment method for processing payment of personal information storage fee of the service user,
The personal information protection operation system according to claim 1, further comprising: Disclosure permission determination means of the personal information protection operation device,
Based on the correspondence between the questionnaire items registered in the questionnaire information and the responses, and the predetermined threshold in the database, the questionnaire items and the responses that do not specify the user registered in the database The personal information protection operation system according to any one of claims 1 to 3, wherein a correspondence relationship is extracted and transmitted to the provider terminal. The personal information protection operation device
The personal information protection according to claim 4, further comprising: warning means for transmitting warning information to the user terminal when an input to a questionnaire item that can be identified by a user registered in the database is detected. Operational system. The disclosure permission determination means includes:
For a plurality of personal information received from the user terminal, determine whether it exists in the database, and if it exists, determine whether it is difficult to specify the service user by a predetermined threshold, The personal information protection operation system according to claim 1, wherein personal information that is equal to or greater than the threshold is transferred when the threshold is equal to or greater than the threshold. Personal information in a personal information protection operation system in which a user terminal of a service user, a provider terminal of a service provider, and a personal information protection operation device that manages the protection and disclosure of personal information of the service user are connected via a communication network A protection operation method,
The user terminal registers its own personal information in the personal information protection operation device,
The provider terminal transmits a request for disclosure of personal information of a user necessary for service provision to the personal information protection operation device,
The personal information protection operation device stores user personal information in a database,
The personal information protection operation device determines whether the personal information included in the disclosure request exists in the database, and if it exists, determines whether it is difficult to identify the service user with a predetermined threshold. Judgment, if it is greater than or equal to the threshold, return personal information corresponding to the disclosure request,
The personal information protection operation device calculates usage that is a consideration for the disclosure of the personal information,
The personal information protection operation method, wherein the personal information protection operation device performs a settlement process of the usage fee.

Images