JP2007018028A - Information protection system, information protection server, information protection method, information protection program - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To make a person who tries to make unauthorized access think that it is meaningless to steal the data with a simple configuration. <P>SOLUTION: When the input of personal information from a user terminal 40 is accepted through a communication line 41 by a personal information protecting server 20, the personal information and a plurality of pieces of dummy information are mixed and registered in a personal information database 30. The large amounts of pieces of dummy information are mixed with the real personal information, without using any tracing system in the conventional art, so that the discrimination of the real personal information can be made impossible. <P>COPYRIGHT: (C)2007,JPO&INPIT

Description

  The present invention relates to, for example, an information protection system, an information protection server, an information protection method, and an information protection program for protecting personal information. In particular, true personal information and a plurality of dummy information corresponding to the true personal information are mixed. The present invention relates to an information protection system, an information protection server, an information protection method, and an information protection program.

  In recent years, with the progress of the ubiquitous society, a large amount of data including various personal information has been collected and used for statistics, marketing, billing processing according to various paid services, and the like.

  On the other hand, in recent years, there has been an increasing interest in society for an increase in information security risks such as unintended use of personal information and information leakage. That is, in a company that handles a large amount of personal information, if personal information is leaked, the personal information may be directly or indirectly damaged by misuse.

  Therefore, defense measures to prevent leakage of personal information are necessary, but it is usually said that it is important to consider measures from four viewpoints: organizational, human, physical, and technical. .

  By the way, from an organizational point of view, the organization system for taking safety management measures for personal data, the establishment of regulations to establish safety management measures for personal data, the operation in accordance with the regulations, and the handling status of personal data are listed. It is necessary to take measures in line with items such as development of possible means, evaluation, review and improvement of personal data safety management measures, and handling of accidents or violations.

  From a human perspective, it is necessary to take measures in line with items such as the conclusion of non-disclosure agreements at the time of employment and contracts, and the implementation of awareness, education and training for employees. From a physical point of view, it is necessary to take measures in line with items such as entrance / exit (room) management, theft prevention, and physical protection of equipment and devices.

  From a technical point of view, identification and authentication in access to personal data, control of access to personal data, management of access rights to personal data, recording of access to personal data, anti-malware measures for information systems handling personal data It is necessary to take measures in accordance with items such as measures for transferring / transmitting personal data, measures for checking the operation of an information system that handles personal data, and monitoring information systems that handle personal data.

  However, if you try to take these defense measures, you will need to change the operation process that you are familiar with, and of course the number of management and confirmation procedures will increase, and these measures may not actually be implemented without omission. It's real.

  Many companies seem to naturally prevent unauthorized access from the outside through firewalls and security patches, but there are no countermeasures against information leaks from inside, as reported frequently in the news. This is often sufficient.

  In order to prevent the leakage of personal information, access rights are set for each employee who handles personal information so that only the data necessary for work can be accessed. It is necessary to manage the information so that it is possible to ascertain whether it has been made and who may have taken it out in the event of information leakage.

  Anti-virus is one of the basic measures. Some viruses destroy personal data stored in the hard disk and screen images during operation or send them to the outside. Application of anti-virus measures and security patches is indispensable so that data containing personal information and PCs referring to personal data are not threatened by attacks from malicious programs.

  Measures for data transfer are also important. Encryption is naturally necessary for networks that may be wiretapped, such as the Internet and wireless LAN, and encryption is essential for transport regardless of the media form.

  However, due to the above-mentioned defense measures, equipment and labor costs increase, which may be a heavy burden on companies, etc., and if it becomes sensitive to security, it will adversely affect work efficiency. In some cases.

  Further, since personal information leaks to the outside even if a personal computer or the like in which personal information is recorded on a hard disk or the like is stolen, it is also important to strengthen a security system for theft. However, there are two types of theft, one that is deliberately performed and the other that is negligent. In other words, too strict information management can reduce employee morale, employees may feel “untrusted”, and office procedures tend to be complicated, leading to the risk of negligence and leakage. It might be.

  In fact, such defense measures against the risk of leaking personal information are very costly and are not safe. For this reason, businesses dealing with personal information are trying to secure a high level of security by accumulating the next best measures without finding an absolute countermeasure method.

  As a defense measure for personal information, in Patent Document 1, a fraud detection server receives a packet transmitted from an information processing terminal with an information processing server as a transmission destination, and the fraud detection server analyzes information contained in the received packet. A packet having an illegal purpose is detected, a mark indicating that it is an illegal packet is added to the detected illegal packet, and the mark is added to the information processing server or decoy server having a function of discriminating the mark. An information processing server or decoy server that has received an illegal packet has proposed an illegal message detection device that performs an illegal avoidance process such as transmitting false information to an information processing terminal that has transmitted an illegal packet.

  In Patent Document 2, a security server detects whether a client access is normal or illegal, processes normal access with the server, guides unauthorized access to a dummy server, and performs fake processing for unauthorized access. We have proposed an unauthorized access prevention service system that collects and analyzes access data and implements an unauthorized access prevention service.

  In Patent Literature 3, an information processing apparatus that creates information and an information processing apparatus that totals information and communicates with each other, the means that is created by the information processing apparatus and transmits data, and the information processing apparatus performs information processing. Means for receiving data transmitted from the device, and in addition to encrypting the data and concealing the data itself, by mixing dummy data in the data to be transmitted, preventing the estimation of the situation due to the amount of data, We have proposed an encrypted data transmission system that realizes higher security communication.

In Patent Document 4, an optical card is used as an emergency countermeasure card, an optical card is used, and various data are used in the data recording portion of the card, and time spent for data analysis by mixing dummy data. Proposal of an emergency countermeasure plan to prevent unauthorized use of cards by developing new cards at that time.
JP 2002-7234 A JP 2002-41468 A JP 2004-260508 A Japanese Unexamined Patent Publication No. 09-319851

  By the way, in what was shown by patent document 1, it judges from the information itself contained in a packet the detection of unauthorized access, intrudes into an unauthorized request origin intentionally, and makes an intruder think that it succeeded, In the meantime, information related to fraud (access targets, intruder addresses, procedures, etc.) is collected, but if the source IP address of the packet is falsified and the intruder is fake or impersonated In addition, it is extremely difficult to track an intruder, and there is a problem that it is necessary to construct a tracking system, which increases capital investment.

  In addition, in the technique disclosed in Patent Document 2, unauthorized access is detected by a front security server, and access data due to unauthorized access is collected by a dummy server. If an intruder is falsified and an intruder is impersonated or someone else is impersonated, it is extremely difficult to track the intruder, and it is necessary to build a tracking system, which increases capital investment. there were.

  Further, in the method disclosed in Patent Document 3, in addition to encrypting data and concealing the data itself, dummy data is mixed in data to be transmitted to prevent estimation of the situation due to the amount of data. Since the true data exists in the record source so that it can be searched, there is a problem that it is difficult to prevent the unauthorized access to the record source.

  Moreover, in what was shown by patent document 4, it is trying to earn time spent for data analysis by mixing dummy data, but since dummy data is recorded on the optical card, dummy data There is a problem in that it is difficult to prevent the amount of data because there is a limit to the amount of data and the target for analyzing the true data is specified.

  The present invention has been made in view of such a situation, and with a simple configuration, an information protection system, an information protection server, and information that can make an unauthorized accessor think that the data is meaningless The purpose is to provide a protection method and an information protection program.

  The information protection system of the present invention is an information protection system for protecting personal information, and registers a user terminal capable of inputting personal information via a communication line and a mixture of the personal information and a plurality of dummy information. And a personal information protection server that accepts input of the personal information from the user terminal and registers the personal information and a plurality of dummy information in a mixed manner in the personal information database. And

  The personal information protection server may generate dummy information that forms the same cluster as the personal information when the plurality of dummy information are mixed.

  The same cluster may be based on at least the date of birth included in the personal information.

  The personal information protection server may add information that can be identified only by a dedicated application program to the personal information and the dummy information when the plurality of dummy information is mixed.

  In addition, a national address database in which prefecture-specific addresses are registered, a surname database in which multiple surnames are registered, a name database in which multiple names are registered, and multiple telephone numbers are registered. A phone number database, a cell phone database in which a plurality of cell phone numbers are registered, a mail address database in which a plurality of email addresses are registered, and a purchase history database in which a plurality of purchase histories are registered A personal information database registered with a mixture of true personal information and a plurality of dummy information, and the personal information protection server, when mixing the plurality of dummy information, in the national address database by prefecture A plurality of registered addresses, a plurality of last names registered in the last name database, and the name A plurality of names registered in the database, a plurality of phone numbers registered in the phone number database, a plurality of cell phone numbers registered in the cell phone database, and registered in the mail address database. A plurality of e-mail addresses and a plurality of purchase histories registered in the purchase history database, combine the information to generate the plurality of dummy information, and register the information in the personal information database. Also good.

  The personal information protection server includes a plurality of data from each of the national address database by prefecture, the surname database, the name database, the telephone number database, the mobile phone database, the e-mail address database, and the purchase history database. Data selection means for selecting information, information addition means for adding information other than those obtained from these databases, zip code, address, name, date of birth, sex, telephone number, mobile phone number from any user terminal When the information including the mail address is obtained, the information is treated as true personal information, and dummy information selection control means for performing data selection control for the data selection means and information addition control for the information addition means, A plurality of data obtained from the data selection means and the information addition means Dummy information mixing means for mixing a plurality of dummy information consisting of data in the true personal information, and the true personal information and the plurality of dummy information mixed by the dummy information mixing means in the personal information database You may make it provide the personal information registration means to register.

  Further, the data selection means selects a plurality of arbitrary addresses from the national address database according to prefectures, and the address data selection section according to national prefectures which passes the selected addresses to the dummy information mixing means; and the last name A plurality of last names selected from a database, a last name data selection unit for passing the selected last names to the dummy information mixing means, a plurality of arbitrary names from the name database, and the plurality of selected names Linked to the name data selection section to be passed to the dummy information mixing means and the address data selection section by country / prefecture, from the telephone number database corresponding to the arbitrary address selected by the address data selection section by country / prefecture A telephone number data selection unit that selects a plurality of arbitrary telephone numbers and passes the selected plurality of telephone numbers to the dummy information mixing means. A plurality of mobile phone numbers selected from the mobile phone database, a mobile phone data selection unit for passing the selected mobile phone numbers to the dummy information mixing means, and an arbitrary mail address from the mail address database. A plurality of selections, a mail address data selection unit for passing the selected plurality of mail addresses to the dummy information mixing means, a plurality of arbitrary purchase histories from the purchase history database, and the selected plurality of purchase histories as the dummy A purchase history data selection unit to be passed to the information mixing unit, and the information addition unit is linked to the last name data selection unit or the name data selection unit and is selected by the last name data selection unit or the name data selection unit Gender assignment that passes information indicating sex corresponding to an arbitrary last name or name to the dummy information mixing means A birth date adding unit that links to the last name data selection unit and passes information indicating the date of birth to the dummy information mixing unit in correspondence with an arbitrary last name selected by the last name data selection unit; You may make it have a tag information addition part which passes the tag information for identifying true personal information to the said dummy information mixing means.

  The information protection server of the present invention selects a plurality of data from the national address database by prefecture, the last name database, the name database, the telephone number database, the mobile phone database, the e-mail address database, and the purchase history database. Data selection means, information addition means for adding information other than those obtained from these databases, zip code, address, name, date of birth, gender, telephone number, mobile phone number, mail address from any user terminal When the information including the information is obtained, the information is treated as true personal information, the dummy information selection control means for performing the data selection control for the data selection means and the information addition control for the information addition means, and the data selection Consisting of a plurality of data obtained from the means and information adding means Dummy information mixing means for mixing a number of dummy information in the true personal information, and personal information for registering the true personal information and the plurality of dummy information mixed by the dummy information mixing means in the personal information database And a registration unit.

  Further, the data selection means selects a plurality of arbitrary addresses from the national address database according to prefectures, and the address data selection section according to national prefectures which passes the selected addresses to the dummy information mixing means; and the last name A plurality of last names selected from a database, a last name data selection unit for passing the selected last names to the dummy information mixing means, a plurality of arbitrary names from the name database, and the plurality of selected names Linked to the name data selection section to be passed to the dummy information mixing means and the address data selection section by country / prefecture, from the telephone number database corresponding to the arbitrary address selected by the address data selection section by country / prefecture A telephone number data selection unit that selects a plurality of arbitrary telephone numbers and passes the selected plurality of telephone numbers to the dummy information mixing means. A plurality of mobile phone numbers selected from the mobile phone database, a mobile phone data selection unit for passing the selected mobile phone numbers to the dummy information mixing means, and an arbitrary mail address from the mail address database. A plurality of selections, a mail address data selection unit for passing the selected plurality of mail addresses to the dummy information mixing means, a plurality of arbitrary purchase histories from the purchase history database, and the selected plurality of purchase histories as the dummy A purchase history data selection unit to be passed to the information mixing unit, and the information addition unit is linked to the name data selection unit, and indicates gender corresponding to an arbitrary name selected by the name data selection unit A gender adding unit that passes the information to the dummy information mixing means, and the last name data selecting unit or the name data selecting unit A birth date adding unit for linking and passing information indicating the date of birth in correspondence with any last name or any name selected by the last name data selection unit or the name data selection unit to the dummy information mixing unit; You may make it have a tag information addition part which passes the tag information for identifying true personal information to the said dummy information mixing means.

  The information protection method of the present invention is an information protection method for protecting personal information, the step of accepting input of personal information from a user terminal connected to a communication line, and when accepting input of the personal information, The personal information and a plurality of dummy information are mixed and registered in the personal information database.

  In addition, when the plurality of dummy information are mixed, a step of generating dummy information that forms the same cluster as the personal information may be included.

  The same cluster may be based on at least the date of birth included in the personal information.

  Further, when the plurality of dummy information are mixed, there may be a step of adding information that can be identified only by a dedicated application program to the personal information and the dummy information.

  In addition, when the plurality of dummy information are mixed, a plurality of addresses registered in the national address database, a plurality of last names registered in the last name database, and a plurality of names registered in the name database Name, multiple phone numbers registered in the phone number database, multiple mobile phone numbers registered in the mobile phone database, multiple email addresses registered in the email address database, and purchase history database A plurality of registered purchase histories may be selected, and the information may be combined to generate the plurality of dummy information, which may be registered in the personal information database.

  In addition, information other than the data obtained from the national address database by prefecture, the last name database, the name database, the telephone number database, the mobile phone database, the e-mail address database, and the purchase history database is added. When information including process, postal code, address, name, date of birth, gender, telephone number, mobile phone number, email address is obtained from any user terminal, the information is treated as true personal information and data A process in which selection control of information and information addition control are performed, a process in which a plurality of dummy information including a plurality of selected data and added information are mixed in the true personal information, A step of registering the true personal information and the plurality of dummy information in the personal information database; It may be.

  A step of linking to the selection of name data from the name database and adding information indicating sex corresponding to the selected arbitrary name; and selection of last name data from the last name database; To link to the selection of name data from the name database and add information indicating the date of birth corresponding to the selected last name or name, and to identify the true personal information The tag information may be added.

  An information protection program of the present invention is an information protection program showing a step for executing an information protection method for protecting personal information, and a step of accepting input of personal information from a user terminal connected to a communication line; When the input of the personal information is accepted, the personal information and a plurality of dummy information are mixed and registered in the personal information database.

  In addition, when the plurality of dummy information are mixed, a step of generating dummy information that forms the same cluster as the personal information may be included.

  The same cluster may be based on at least the date of birth included in the personal information.

  Further, when the plurality of dummy information are mixed, there may be a step of adding information that can be identified only by a dedicated application program to the personal information and the dummy information.

  In addition, when the plurality of dummy information are mixed, a plurality of addresses registered in the national address database, a plurality of last names registered in the last name database, and a plurality of names registered in the name database Name, multiple phone numbers registered in the phone number database, multiple mobile phone numbers registered in the mobile phone database, multiple email addresses registered in the email address database, and purchase history database A plurality of registered purchase histories may be selected, and the information may be combined to generate the plurality of dummy information, which may be registered in the personal information database.

  In addition, information other than the data obtained from the national address database by prefecture, the last name database, the name database, the telephone number database, the mobile phone database, the e-mail address database, and the purchase history database is added. When information including process, postal code, address, name, date of birth, gender, telephone number, mobile phone number, email address is obtained from any user terminal, the information is treated as true personal information and data A process in which selection control of information and information addition control are performed, a process in which a plurality of dummy information including a plurality of selected data and added information are mixed in the true personal information, A step of registering the true personal information and the plurality of dummy information in the personal information database; It may be.

  A step of linking to the selection of name data from the name database and adding information indicating sex corresponding to the selected arbitrary name; and selection of last name data from the last name database; To link to the selection of name data from the name database and add information indicating the date of birth corresponding to the selected last name or name, and to identify the true personal information The tag information may be added.

  In this embodiment, when the personal information protection server accepts input of personal information from the user terminal via the communication line, the personal information and a plurality of dummy information are mixed and registered in the personal information database. In addition, it eliminates the need for a conventional tracking system, etc., and makes it easy to distinguish true personal information by mixing a large amount of dummy information with true personal information. , I tried to make unauthorized users think that the data was meaningless even if they were stolen.

  FIG. 1 is a diagram showing an embodiment of an information protection system of the present invention. The information protection system shown in FIG. 1 is owned by, for example, a company that handles a large amount of personal information, and includes a personal information handling terminal 10, a personal information protection server 20, a personal information database 30, and a national address database 31 by prefecture. A surname database 32, a name database 33, a telephone number database 34, a mobile phone database 35, a mail address database 36, and a purchase history database 37. Reference numeral 40 in the figure denotes a user terminal that is connected to a communication line 41 such as the Internet and can browse information on the Internet.

  The personal information handling terminal 10 is operated at least when setting the function of the personal information protection server 20 or answering an inquiry from the user terminal 40, and is a terminal such as a desktop personal computer or a notebook personal computer. .

  The personal information protection server 20 registers a large amount of personal information in the personal information database 30 and, for each true personal information, a national prefecture address database 31, a surname database 32, a name database 33, and a telephone number database 34. , A large amount of dummy information obtained by combining the respective information obtained from the mobile phone database 35, the mail address database 36, and the purchase history database 37 is mixed. As shown in FIG. An information mixing unit 22, a personal information registration unit 23, a data selection unit 24, and an information addition unit 25 are provided.

  The dummy information selection control unit 21 as the dummy information selection control means sends a zip code, as shown in FIG. 3B, to each item of the input form as shown in FIG. When an address, name, date of birth, gender, telephone number, mobile phone number, and e-mail address are input and sent, the information in the input form is treated as true personal information, and data selection to the data selection unit 24 is selected. Control and information addition control for the information addition unit 25 are performed.

  In addition, when the dummy information selection control unit 21 mixes dummy information using the data from the data selection unit 24 and the information from the information addition unit 25 with respect to the dummy information mixing unit 22, Control is performed so as to generate dummy information for the same cluster. Here, the same cluster may be based on, for example, the date of birth included in the personal information.

  Here, the data selection unit 24 as a data selection means includes a national address data selection unit 24a, a surname data selection unit 24b, a name data selection unit 24c, a telephone number data selection unit 24d, a mobile phone data selection unit 24e, It has a mail address data selection unit 24f and a purchase history data selection unit 24g.

  The nationwide prefectural address data selection unit 24 a selects a plurality of arbitrary addresses from the nationwide prefectural address database 31 and passes the selected plurality of addresses to the dummy information mixing unit 22. The last name data selection unit 24 b selects a plurality of arbitrary last names from the last name database 32 and passes the selected last names to the dummy information mixing unit 22.

  The name data selection unit 24 c selects a plurality of arbitrary names from the name database 33, and passes the selected names to the dummy information mixing unit 22. The telephone number data selection unit 24d is linked to the nationwide prefectural address data selection unit 24a, and corresponds to any address selected by the nationwide prefectural address data selection unit 24a from the telephone number database 34. And a plurality of the selected telephone numbers are passed to the dummy information mixing unit 22.

  The mobile phone data selection unit 24e selects a plurality of arbitrary mobile phone numbers from the mobile phone database 35, and passes the selected plurality of mobile phone numbers to the dummy information mixing unit 22. Here, since the mobile phone number does not have a number corresponding to the station number indicating the area, any mobile phone number can be selected. The mail address data selection unit 24 f selects a plurality of arbitrary mail addresses from the mail address database 36 and passes the selected plurality of mail addresses to the dummy information mixing unit 22.

  The purchase history data selection unit 24 g selects a plurality of arbitrary purchase histories from the purchase history database 37 and passes the selected plurality of purchase histories to the dummy information mixing unit 22.

  The information adding unit 25 as information adding means includes a gender adding unit 25a, a birth date adding unit 25b, and a tag information adding unit 25c. The gender adding unit 25a links to the name data selecting unit 24c, and passes the information indicating the gender to the dummy information mixing unit 22 in association with an arbitrary name selected by the name data selecting unit 24c.

  The birth date adding unit 25b is linked to, for example, the last name data selection unit 24b, and passes information indicating the birth date to the dummy information mixing unit 22 in correspondence with an arbitrary last name selected by the last name data selection unit 24b. The birth date adding unit 25b may be linked to the name data selecting unit 24c. The tag information adding unit 25c passes the tag information for identifying the above-described true personal information to the dummy information mixing unit 22.

  The dummy information mixing unit 22 serving as the dummy information mixing unit mixes a plurality of pieces of dummy information obtained from the data selection unit 24 and the information addition unit 25 with the true personal information described above, and passes the mixed information to the personal information registration unit 23. The personal information registration unit 23 as personal information registration means registers the true personal information obtained from the dummy information mixing unit 22 and a plurality of dummy information in the personal information database 30.

  Here, in the personal information database 30, as shown in FIG. 4, for example, address information 30a, name information 30b, telephone number information 30c, mobile phone number information 30d, mail address information 30e, gender information 30f, date of birth information Personal information including 30 g, purchase history information 30 h, and tag information 30 i is registered. The personal information in FIG. 4 is shown for one individual, and true personal information and dummy information are distinguished by the presence or absence of tag information indicating “true”, for example.

  The address information 30a is randomly selected from the address database 31 by prefecture as described above, and the name information 30b is randomly selected from the last name database 32 and the name database 33 as described above. The telephone number information 30c is randomly selected from the telephone number database 34 as described above, and the cellular phone number information 30d is randomly selected from the cellular telephone database 35 as described above. The email address information 30e is randomly selected from the email address database 36 as described above, and the purchase history information 30h is randomly selected from the purchase history database 37 as described above. is there.

  These address information 30a, name information 30b, phone number information 30c, mobile phone number information 30d, mail address information 30e, and purchase history information 30h are information that actually exists to make it difficult to distinguish from true personal information. Shall be used. In the telephone number information 30c, the cellular phone number information 30d, and the mail address information 30e, the numerical strings of the respective information may be replaced at random or may be changed at random.

  The tag information 30i is information that can be identified only by a dedicated application program that creates dummy information, and cannot be identified by display or the like. On the other hand, address information 30a, name information 30b, phone number information 30c, mobile phone number information 30d, mail address information 30e, gender information 30f, date of birth information 30g, and purchase history information 30h other than tag information 30i are personal information. Although the information is displayed on the handling terminal 10, the tag information 30i is not displayed, so that it is impossible for the operator who operates the personal information handling terminal 10 to identify which information is true personal information.

  The larger the amount of such dummy information with respect to true personal information, the more effective the defense against unauthorized access. Therefore, for example, dummy information corresponding to the data of about 3000 cities, towns and villages in Japan, the existence ratio of Japanese surnames, and the like is created. In this case, assuming that the population of Japan is 1,000 times, dummy information for about 125 billion people is created for the entire true personal information.

  In this way, dummy information for 125 billion people is created, so that even if an unauthorized access person steals personal information in which a large amount of dummy information is mixed, true customer information is extracted. In order to do this, it is necessary to develop an application that analyzes personal information in which a large amount of dummy information is mixed and extracts the tag information 30i. As a result, it is meaningless to steal an unauthorized accessor. Can be thought of.

  As shown in FIG. 5, the prefecture-specific address database 31 includes a prefecture selection table 31a and an address detail selection table 31b. In the prefecture selection table 31a, for example, <Hokkaido / Tohoku>, <Kanto>, <Koshinetsu / Hokuriku>, <Tokai>, <Kinki>, <China>, <Shikoku>, <Kyushu / Okinawa> Information is provided that allows you to select a prefecture that is divided into each prefecture.

  In addition, these <Hokkaido / Tohoku>, <Kanto>, <Koshinetsu / Hokuriku>, <Tokai>, <Kinki>, <China>, <Shikoku>, and <Kyushu / Okinawa> have an identification number. 1. to 9. are provided, and each prefecture has a subordinate identification number such as 1.-1, 1.-2. Is provided.

  The address detail selection table 31b is provided with information that enables selection of address details corresponding to any prefecture. Then, when Hokkaido is arbitrarily selected as one of the prefectures from the prefecture selection table 31a, details of the address of Hokkaido as the prefecture selected from the address details selection table 31b (for example, Kitami City, Hokkaido ... 2 chome ...) is arbitrarily selected.

  Further, for example, an item indicating the frequency of use may be provided in the address detail selection table 31b, and the item of the frequency of use may be counted up whenever the details of the address are selected. In this way, by providing the item of use frequency, when the details of the address are selected, the address of the item that is not frequently used can be selected, and the details of the address are selected almost evenly. It becomes possible to make it.

  The last name database 32 is provided with a last name selection table 32a for selecting last names as shown in FIG. 6, for example. Each last name has an identification number. And this identification number. There is an item for the last name corresponding to and the usage frequency of the last name. And any surname is an arbitrary identification number. By selecting the item with the frequency of use to be counted up every time it is selected in the item, it is possible to select the last name of the item that is less frequently used, and the selection of the last name is performed almost evenly. It becomes possible to make it.

  As shown in FIGS. 7A and 7B, the name database 33 includes a male name selection table 33a and a female name selection table 33b. Each name has an identification number. And this identification number. There are provided items corresponding to names and the frequency of use of the names. And any one of the names has an arbitrary identification number. By selecting the item with the frequency of use every time it is selected in, the name of the item with the low frequency of use can be selected, and the names are selected almost evenly. It becomes possible to make it.

  As shown in FIG. 8, the telephone number database 34 is provided with a telephone number selection table 34a corresponding to the address detail selection table 31b of the above-mentioned nationwide prefecture-specific address database 31. In other words, since the station number of the telephone number is assigned for each region, it is possible to make it difficult to distinguish from the true telephone number by selecting a telephone number having a station number corresponding to the address. .

  Each telephone number has an identification number. And this identification number. The telephone number corresponding to the item and the frequency of use of the telephone number are provided. One of the telephone numbers is an arbitrary identification number. By making the frequency of use frequency count up each time it is selected in, it is possible to select the phone number of the item with low frequency of use, and the selection of phone numbers is almost equal. Can be performed.

  As shown in FIG. 9, the mobile phone database 35 is provided with a mobile phone number selection table 35a. In the mobile phone number selection table 35a, a plurality of mobile phone numbers are registered for each number that can identify mobile phone numbers such as 090, 080, 070, and the like. And this identification number. There are provided a mobile phone number corresponding to, and a frequency of use of the mobile phone number. One of the mobile phone numbers is an arbitrary identification number. By selecting the mobile phone number for the item that is used less frequently, the mobile phone number for the item that is used less frequently can be selected. It is possible to perform almost evenly.

  As shown in FIG. 10, the mail address database 36 includes a mail address selection table 36a. In the mail address selection table 36a, a plurality of mail addresses that are considered to be currently usable are registered, and each mail address has an identification number. And an item of the frequency of use of the mail address. One of the e-mail addresses has an arbitrary identification number. By selecting the item with the frequency of use every time it is selected in, it is possible to select the email address of the item with a low usage frequency, and the selection of the email address is almost equal. Can be performed.

  In the purchase history database 37, as shown in FIG. 11, a purchase history selection table 37a is provided. In the purchase history selection table 37a, various purchase histories such as product purchases and service use are registered. And the item of the usage frequency of the purchase history is provided. One of the purchase histories has an arbitrary identification number. By selecting the item with the frequency of use every time it is selected in, the purchase history of the item with the low frequency of use can be selected, and the selection of the purchase history is almost equal. Can be performed.

Next, an information protection method will be described.
First, as shown in FIG. 12, from any user terminal 40 to the personal information protection server 20, for example, each item of the input form as shown in FIG. When the number, address, name, date of birth, gender, telephone number, mobile phone number, and e-mail address are input and transmitted (step S1), the dummy information selection control unit 21 determines that the information in the input form is true. Personal information in which true personal information and a plurality of dummy information are mixed together by performing data selection control on the data selection unit 24 and information addition control on the information addition unit 25. Data creation is performed.

  That is, a plurality of arbitrary addresses are selected from the nationwide prefecture address database 31 by the nationwide prefecture address data selection unit 24a (step S2), and the selected plurality of addresses are passed to the dummy information mixing unit 22.

  Also, a plurality of arbitrary last names are selected from the last name database 32 by the last name data selection unit 24b (step S3), and the selected plurality of last names are passed to the dummy information mixing unit 22. The name data selection unit 24c selects a plurality of arbitrary names from the name database 33 (step S4), and passes the selected names to the dummy information mixing unit 22.

  The telephone number data selection unit 24d selects a plurality of arbitrary telephone numbers from the telephone number database 34 (step S5), and passes the selected plurality of telephone numbers to the dummy information mixing unit 22. Here, since the telephone number includes an area code related to the region, if the telephone number related to the address selected by the national address data selection unit 24a is not selected, the true personal information is a dummy. The effect of mixing information will fade. In other words, if a telephone number that is not related to the selected address is selected, even if dummy information is mixed, true personal information will be overlooked.

  Therefore, when a plurality of arbitrary telephone numbers are selected from the telephone number database 34 by the telephone number data selection section 24d, the telephone number data selection section 24d is linked to the national prefecture address data selection section 24a. A plurality of arbitrary telephone numbers are selected from the telephone number database 34 corresponding to the arbitrary address selected by 24a.

  In addition, the mobile phone data selection unit 24e selects a plurality of arbitrary mobile phone numbers from the mobile phone database 35 (step S6), and passes the selected plurality of mobile phone numbers to the dummy information mixing unit 22. Here, unlike the above-described telephone number, the mobile phone number does not have a number corresponding to a station number indicating a region, and therefore an arbitrary mobile phone number is selected.

  The mail address data selection unit 24f selects a plurality of arbitrary mail addresses from the mail address database 36 (step S7), and passes the selected plurality of mail addresses to the dummy information mixing unit 22.

  Further, a plurality of arbitrary purchase histories are selected from the purchase history database 37 by the purchase history data selection unit 24g (step S8), and the selected plurality of purchase histories are transferred to the dummy information mixing unit 22.

  Then, the dummy information mixing unit 22 starts to create a plurality of dummy information to be mixed in the true personal information based on the various information obtained from the data selection unit 24 and the information adding unit 25 described above (step S9). Here, the personal information including the dummy information includes, for example, address information 30a, name information 30b, telephone number information 30c, mobile phone number information 30d, mail address information 30e, gender information 30f, year of birth, as described in FIG. It consists of date information 30g, purchase history information 30h, and tag information 30i.

  Therefore, the address information selection unit 24a and the surname data selection unit 24b according to the prefectures described above are used for the address information 30a, name information 30b, phone number information 30c, mobile phone number information 30d, mail address information 30e, and purchase history information 30h. The name data selection unit 24c, the telephone number data selection unit 24d, the mobile phone data selection unit 24e, the mail address data selection unit 24f, and the information obtained from the purchase history data selection unit 24g (step S10).

  On the other hand, the other sex information 30f, date of birth information 30g, and tag information 30i are obtained by obtaining information from the sex addition unit 25a, the date of birth addition unit 25b, and the tag information addition unit 25c of the information addition unit 25. Individual dummy information is completed (step S11). However, regarding the gender information 30f, if the gender corresponding to the name is not obtained, the effect of mixing the dummy information with the true personal information is diminished. In other words, if the name selected by the name data selection unit 24c is a boy and the gender is “female”, true personal information will be overlooked even if dummy information is mixed.

  Therefore, the gender adding unit 25a is linked to the name data selecting unit 24c, and information indicating the gender corresponding to an arbitrary name selected by the name data selecting unit 24c is passed to the dummy information mixing unit 22.

  Regarding the date of birth information 30g, if the date of birth is too far away, the effect of mixing dummy information with true personal information will fade, so the date of birth of the true personal information Any date of birth that has a certain range may be used.

  The information from the tag information adding unit 25c may be information that can be identified only by a dedicated application program that creates dummy information, and may be information that cannot be identified depending on display or the like. Or any combination thereof.

  When the dummy information mixing unit 22 mixes a plurality of pieces of dummy information in the true personal information in this way, the personal information registration unit 23 converts the personal information including the plurality of dummy information shown in FIG. 30 (step S12).

  Then, according to the procedure as described above, each item of the input form in FIG. 3A described above from any one of the user terminals 40 has a zip code, address, name, date of birth, Each time a gender, a telephone number, a mobile phone number, and an e-mail address are input and transmitted, a plurality of dummy information is mixed with true personal information as in (Step S2) to (Step S11). Personal information in which a plurality of dummy information is mixed is registered in the personal information database 30 as in S12).

  Thus, in this embodiment, when the personal information protection server 20 accepts input of personal information from the user terminal 40 via the communication line 41, the personal information and a plurality of dummy information are mixed to Since it is registered in the information database 30, a conventional tracking system or the like is not required, and a simple configuration can be obtained. In addition, a large amount of dummy information is mixed with true personal information. It is possible to make it impossible to discriminate personal information, and to make unauthorized users think that the data is meaningless even if it is stolen.

  That is, in this embodiment, when a user newly registers his / her personal information using an input form, dummy personal information that is a cluster similar to that user is automatically generated for about 1,000 people, for example. It is registered in the personal information database 30. Therefore, every time personal information of a new user is registered, dummy personal information of, for example, about 1,000 people is registered at the same time, and a huge amount of true personal information is stored in the personal information database 30. And dummy personal information are mixed.

  In this case, even if information leaks from the personal information database 30, it is necessary to identify true personal information and a large amount of dummy personal information. As long as there is no dedicated application software that mixes, it is impossible to determine true personal information.

  Moreover, even if it is known that true customer information is included, as long as there is a large amount of dummy personal information that cannot be distinguished from it, the economic value is greatly impaired, and misuse such as resale can be prevented. it can.

  For this reason, the willingness of criminals to steal customer information of companies that employ the information protection system in this embodiment is lost, and as a result, the effectiveness of personal information as a defensive measure is lost. You can expect a lot.

  Moreover, since personal information belonging to the same cluster as the user is registered after being diluted 1,000 times, for example, the user himself does not stand out, and the truth is not known even when the operator handles the information. For this reason, by transmitting such information in advance, an effect of lowering psychological hurdles when registering personal information can be expected.

  As a result, traditionally, a large-scale security mechanism is required, such as whether the entire system is physically isolated for each room or whether it is equipped with a tracking system, etc., and confidentiality is maintained with all personnel who handle personal information. Although it was required to thoroughly implement contracts and personal information protection education, if a large amount of dummy information is mixed with true personal information in advance as in this embodiment, even if personal information is leaked, it will be damaged. Since the amount of money can be reduced, a relatively reasonable security mechanism can be achieved.

  This eliminates the need for stricter information management than necessary, so it does not reduce employee morale, does not make employees feel untrustworthy, reduces operational efficiency, and reduces employee motivation. It can be said that the negative effect is not derived. Furthermore, the complexity of office procedures is eliminated, and the risk of negligence and leakage is reduced.

  Moreover, since it can appeal that the protection of personal information is perfect for the company which employ | adopted the information protection system in this embodiment, a registered member can be increased as a result.

  For example, when the company uses true personal information for statistics and marketing, the tag information attached to the true personal information is identified by the above-described dedicated application software, thereby extracting the true personal information. As a result, there is no difficulty in handling true personal information.

  If it is absolutely necessary to back up only the true customer information, only that information can be extracted with dedicated application software and stored strictly.

  In the present embodiment, the country-specific address database 31 in which a plurality of addresses are registered, the last name database 32 in which a plurality of last names are registered, the name database 33 in which a plurality of names are registered, A phone number database 34 in which a plurality of phone numbers are registered, a cell phone database 35 in which a plurality of cell phone numbers are registered, a mail address database 36 in which a plurality of email addresses are registered, and a plurality of purchase histories Has been described, and the case where each data is selected from these databases has been described. However, the present invention is not limited to this, and a plurality of data generated by selecting each data from these databases in advance is generated. Prepare the dummy information mentioned above, and mix the dummy information with the true personal information You can, may be selected a plurality of dummy information prepared in advance.

  In the present embodiment, as described with reference to FIG. 4, the personal information is, for example, address information 30a, name information 30b, phone number information 30c, mobile phone number information 30d, mail address information 30e, gender information 30f, date of birth. The case of the day information 30g and the purchase history information 30h has been described. However, the present invention is not limited to this example, and attribute data such as family structure, annual income, educational background, and customer rank can be included. In that case, the attribute data may be a tag that can be uniquely identified by the company, and may be identified only by the dedicated application software described above.

  Further, the monitoring data may be included in the dummy information described above. Here, the monitoring data refers to dummy information that the company intentionally hides in the personal information in advance in order to quickly detect the fact when the personal information is abused. At that time, it can be either mixed in all personal information at a fixed rate or mixed in all dummy information. In particular, it is possible to increase the probability that an abuse can be detected by mixing the decoy data cluster as a decoy at a larger rate.

  Here, when creating decoy (decoy) personal information, in the personal information database 30, clusters belonging to good customers and important customers appear to be particularly useful (so-called “good”) data from the point of abuse. Therefore, it is only necessary to intentionally create a large number of decoy data in such a cluster and mix them.

  Also, when this decoy data is mixed, information that seems to be more profitable (for example, a person with a high annual income or living alone) instead of randomly using it when a person who steals personal information is misused. It is considered that the information will be used in order from the oldest), so it is advisable to mix biased personal information in advance for such clusters.

  As an example of including monitoring data, for example, a specific person in charge of a company is determined, and another fictitious name of the person in charge is set. However, the address, phone number, etc. will be real, and if personal information is misused, if there is a notice of reminder by direct mail or telephone etc. to the fictitious person in the real address or phone number, It is possible to detect that personal information of the company has been leaked by some route.

  The present invention can be applied to all systems that manage a large amount of information.

It is a figure which shows one Embodiment of the information protection system of this invention. It is a block diagram which shows the detail of the personal information protection server of FIG. It is a figure for demonstrating the case where personal information is input by the user terminal of FIG. It is a figure for demonstrating the true personal information and dummy information which are registered into the personal information database of FIG. It is a figure for demonstrating the detail of the national address database classified by prefecture of FIG. It is a figure for demonstrating the detail of the last name database of FIG. It is a figure for demonstrating the detail of the name database of FIG. It is a figure for demonstrating the detail of the telephone number database of FIG. It is a figure for demonstrating the detail of the mobile telephone database of FIG. It is a figure for demonstrating the detail of the mail address database of FIG. It is a figure for demonstrating the detail of the purchase history database of FIG. 2 is a flowchart for explaining an information protection method by the information protection system of FIG. 1.

Explanation of symbols

DESCRIPTION OF SYMBOLS 10 Personal information handling terminal 20 Personal information protection server 21 Dummy information selection control part 22 Dummy information mixing part 23 Personal information registration part 24 Data selection part 24a Address data selection part 24b according to the prefecture of the whole country 24b Surname data selection part 24c Name data selection part 24d Telephone number data selection unit 24e Mobile phone data selection unit 24f Email address data selection unit 24g Purchase history data selection unit 25 Information addition unit 25a Gender addition unit 25b Date of birth addition unit 25c Tag information addition unit 30 Personal information database 30a Address information 30b Name information 30c Phone number information 30d Mobile phone number information 30e E-mail address information 30f Gender information 30g Date of birth information 30h Purchase history information 30i Tag information 31 National address database by prefecture 31a Prefectural selection table 31b Detailed selection table 32 Last name database 32a Last name selection table 33 Name database 33a Male name selection table 33b Female name selection table 34 Telephone number database 34a Telephone number selection table 35 Mobile phone database 35a Mobile phone number selection table 36 Email address database 36a Email address Selection table 37 Purchasing history database 37a Purchasing history selection table 40 User terminal 41 Communication line

Claims (23)

An information protection system for protecting personal information,
A user terminal capable of inputting personal information via a communication line;
A personal information database in which the personal information and a plurality of dummy information are registered together;
An information protection system comprising: a personal information protection server that receives input of the personal information from the user terminal and registers the personal information and a plurality of dummy information in a mixed manner in the personal information database.   2. The information protection system according to claim 1, wherein the personal information protection server generates dummy information that forms the same cluster as the personal information when the plurality of dummy information are mixed.   The information protection system according to claim 2, wherein the same cluster is based on at least a date of birth included in the personal information.   The personal information protection server, when mixing the plurality of dummy information, adds information that can be identified only by a dedicated application program to the personal information and the dummy information. Information protection system described in 1. A nationwide prefecture address database where addresses by country are registered,
Last name database with multiple last names registered,
A name database with multiple names registered,
A phone number database in which multiple phone numbers are registered;
A mobile phone database in which multiple mobile phone numbers are registered;
An email address database in which multiple email addresses are registered,
A purchase history database in which multiple purchase histories are registered,
A personal information database in which true personal information and a plurality of dummy information are registered together;
The personal information protection server, when mixing the plurality of dummy information, a plurality of addresses registered in the country-specific address database, a plurality of last names registered in the last name database, and the name database A plurality of names registered in the phone number database, a plurality of phone numbers registered in the phone number database, a plurality of cell phone numbers registered in the cell phone database, and registered in the mail address database. Selecting a plurality of email addresses and a plurality of purchase histories registered in the purchase history database, combining the information to generate the plurality of dummy information, and registering the information in the personal information database, The information protection system according to any one of claims 1 to 4. The personal information protection server
Data selection means for selecting a plurality of data from each of the national address database by prefecture, the surname database, the name database, the phone number database, the mobile phone database, the email address database, and the purchase history database;
Information adding means for adding information other than those obtained from these databases;
When information including a zip code, address, name, date of birth, gender, telephone number, mobile phone number, mail address is obtained from any user terminal, the information is treated as true personal information, and the data selection means Dummy information selection control means for performing data selection control for information and information addition control for the information addition means,
Dummy information mixing means for mixing a plurality of dummy information consisting of a plurality of data obtained from the data selection means and the information addition means in the true personal information;
6. The information protection system according to claim 5, further comprising personal information registration means for registering the true personal information and the plurality of dummy information mixed by the dummy information mixing means in the personal information database. . The data selection means includes
A plurality of arbitrary addresses are selected from the national address database by prefecture, and the address data selection unit by country that passes the selected addresses to the dummy information mixing means;
A plurality of last names selected from the last name database, a last name data selection unit that passes the selected last names to the dummy information mixing means,
A name data selection unit that selects a plurality of arbitrary names from the name database and passes the selected plurality of names to the dummy information mixing unit;
Link to the national address data selection unit by prefecture, select a plurality of arbitrary telephone numbers from the telephone number database corresponding to the arbitrary address selected by the national address data selection unit by country, the selected Telephone number data selection means for passing a plurality of telephone numbers to the dummy information mixing means;
A mobile phone data selection unit that selects a plurality of mobile phone numbers from the mobile phone database and passes the selected mobile phone numbers to the dummy information mixing unit;
A plurality of arbitrary mail addresses from the mail address database, a mail address data selection unit for passing the selected plurality of mail addresses to the dummy information mixing means;
A plurality of arbitrary purchase histories from the purchase history database, and a purchase history data selection unit that passes the selected purchase histories to the dummy information mixing means,
The information adding means is linked to the last name data selection unit or the name data selection unit, and information indicating gender corresponding to an arbitrary last name or name selected by the last name data selection unit or the name data selection unit A gender addition section to be passed to the dummy information mixing means;
A birth date adding unit that links to the last name data selection unit and passes information indicating the date of birth to the dummy information mixing unit in correspondence with an arbitrary last name selected by the last name data selection unit;
The information protection system according to claim 6, further comprising: a tag information adding unit that passes tag information for identifying the true personal information to the dummy information mixing unit. Data selection means for selecting a plurality of data from the national address database by prefecture, the surname database, the name database, the phone number database, the mobile phone database, the e-mail address database, and the purchase history database;
Information adding means for adding information other than those obtained from these databases;
When information including a zip code, address, name, date of birth, gender, telephone number, mobile phone number, mail address is obtained from any user terminal, the information is treated as true personal information, and the data selection means Dummy information selection control means for performing data selection control for information and information addition control for the information addition means,
Dummy information mixing means for mixing a plurality of dummy information consisting of a plurality of data obtained from the data selection means and the information addition means in the true personal information;
An information protection server comprising: personal information registration means for registering the true personal information and the plurality of dummy information mixed by the dummy information mixing means in the personal information database. The data selection means includes
A plurality of arbitrary addresses are selected from the national address database by prefecture, and the address data selection unit by country that passes the selected addresses to the dummy information mixing means;
A plurality of last names selected from the last name database, a last name data selection unit that passes the selected last names to the dummy information mixing means,
A name data selection unit that selects a plurality of arbitrary names from the name database and passes the selected plurality of names to the dummy information mixing unit;
Link to the national address data selection unit by prefecture, select a plurality of arbitrary telephone numbers from the telephone number database corresponding to the arbitrary address selected by the national address data selection unit by country, the selected Telephone number data selection means for passing a plurality of telephone numbers to the dummy information mixing means;
A mobile phone data selection unit that selects a plurality of mobile phone numbers from the mobile phone database and passes the selected mobile phone numbers to the dummy information mixing unit;
A plurality of arbitrary mail addresses from the mail address database, a mail address data selection unit for passing the selected plurality of mail addresses to the dummy information mixing means;
A plurality of arbitrary purchase histories from the purchase history database, and a purchase history data selection unit that passes the selected purchase histories to the dummy information mixing means,
The information adding means includes
A gender adding unit that links to the name data selection unit and passes information indicating sex to the arbitrary information selected by the name data selection unit to the dummy information mixing unit;
Linked to the last name data selection unit or the name data selection unit, information indicating the date of birth corresponding to any last name or any name selected by the last name data selection unit or the name data selection unit, the dummy information Date of birth addition part to be passed to the mixed means,
The information protection server according to claim 8, further comprising: a tag information adding unit that passes tag information for identifying the true personal information to the dummy information mixing unit. An information protection method for protecting personal information,
A step of accepting input of personal information from a user terminal connected to a communication line;
And a step of registering the personal information and a plurality of dummy information in a mixed manner in the personal information database when the input of the personal information is accepted.   11. The information protection method according to claim 10, further comprising the step of generating dummy information that forms the same cluster as the personal information when the plurality of dummy information is mixed.   The information protection method according to claim 11, wherein the same cluster is based on at least a date of birth included in the personal information.   13. The method according to claim 10, further comprising a step of adding information that can be identified only by a dedicated application program to the personal information and the dummy information when the plurality of dummy information is mixed. Information protection methods. When the plurality of dummy information is mixed, a plurality of addresses registered in the national address database by prefecture, a plurality of last names registered in the last name database, and a plurality of names registered in the name database Multiple phone numbers registered in the phone number database, multiple cell phone numbers registered in the cell phone database, multiple email addresses registered in the email address database, and registered in the purchase history database A plurality of purchasing histories selected, and
The information protection method according to claim 10, further comprising a step of combining the information to generate the plurality of dummy information and registering the dummy information in the personal information database. A step of adding information other than the data obtained from each of the national address database, the surname database, the name database, the phone number database, the mobile phone database, the e-mail address database, and the purchase history database; ,
When information including postal code, address, name, date of birth, gender, telephone number, mobile phone number, and email address is obtained from any user terminal, the information is treated as true personal information, and data selection control is performed. And a process in which additional control of information is performed,
A plurality of dummy information comprising a plurality of selected data and added information is mixed in the true personal information; and
15. The information protection method according to claim 14, further comprising a step of registering the mixed personal information and the plurality of dummy information in the personal information database. Linking to the selection of name data from the name database and adding information indicating gender corresponding to the selected arbitrary name;
Linked to selection of last name data from the last name database or selection of name data from the name database, information indicating the date of birth is added corresponding to the selected last name or arbitrary name. Process,
The information protection method according to claim 15, further comprising a step of adding tag information for identifying the true personal information. An information protection program showing a process for executing an information protection method for protecting personal information,
A step of accepting input of personal information from a user terminal connected to a communication line;
When the input of the personal information is accepted, the information protection program includes a step of registering the personal information and a plurality of dummy information mixedly in the personal information database.   18. The information protection program according to claim 17, further comprising a step of generating dummy information that forms the same cluster as the personal information when the plurality of dummy information is mixed.   The information protection program according to claim 18, wherein the same cluster is based on at least a date of birth included in the personal information.   20. The method according to claim 17, further comprising a step of adding information that can be identified only by a dedicated application program to the personal information and the dummy information when the plurality of dummy information are mixed. Information protection program. When the plurality of dummy information is mixed, a plurality of addresses registered in the national address database by prefecture, a plurality of last names registered in the last name database, and a plurality of names registered in the name database Multiple phone numbers registered in the phone number database, multiple cell phone numbers registered in the cell phone database, multiple email addresses registered in the email address database, and registered in the purchase history database A plurality of purchasing histories selected, and
21. The information protection program according to claim 17, further comprising a step of combining the information to generate the plurality of dummy information and registering the dummy information in the personal information database. A step of adding information other than the data obtained from each of the national address database, the surname database, the name database, the phone number database, the mobile phone database, the e-mail address database, and the purchase history database; ,
When information including postal code, address, name, date of birth, gender, telephone number, mobile phone number, and email address is obtained from any user terminal, the information is treated as true personal information, and data selection control is performed. And a process in which additional control of information is performed,
A plurality of dummy information comprising a plurality of selected data and added information is mixed in the true personal information; and
The information protection program according to claim 21, further comprising a step of registering the true personal information and the plurality of dummy information mixed in the personal information database. Linking to the selection of name data from the name database and adding information indicating gender corresponding to the selected arbitrary name;
Linked to selection of last name data from the last name database or selection of name data from the name database, information indicating the date of birth is added corresponding to the selected last name or arbitrary name. Process,
The information protection program according to claim 22, further comprising a step of adding tag information for identifying the true personal information.

Images