JP2007073040A - Information management method and information management system - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide an information management method and an information management system capable of preventing leakage of information by managing further properly confidential information such as personal information. <P>SOLUTION: After a user terminal 1 and a mobile terminal 2 are related to each other by a token TK, the mobile terminal 2 encrypts personal information by using public key information of a service provision server 3; a personal information management server 4 records/manages the encrypted personal information by leaving it encrypted; and the service provision server 3 acquires the personal information remaining encrypted from the personal information management server 4 when the personal information is required, and decrypts and utilizes the personal information by using a secret key of the service provision server 3. <P>COPYRIGHT: (C)2007,JPO&INPIT

Description

  The present invention relates to an information management method and an information management system for preventing leakage of confidential information such as personal information.

  The protection of personal information has become a major problem in recent years, as the Personal Information Protection Law was enacted in April 2005, and the problem of leakage of personal information in companies has become clear one after another. On the other hand, opportunities for exchanging personal information on a network such as the Internet are increasing by online shopping and the like. Once personal information is leaked on the Internet or the like, it is difficult to delete the personal information completely. Therefore, a method capable of safely handling personal information is required.

  Unlike companies that often take security measures, the environment of general users at home is exposed to the risk of personal information being leaked by P2P file exchange software or spyware, and anti-virus software is used. However, it does not necessarily prevent the leakage of personal information. Therefore, there is a need for a technique that can safely exchange personal information without changing the current terminal environment of general users.

  Conventionally, in online shopping, an online shop has a store on a WEB server of an NSP (Network Service Provider), and a user selects a product on a WEB browser and inputs personal information and credit card information. Personal information and credit card information input on the WEB browser are encrypted and transferred to the NSP WEB server. Next, personal information and credit card information are combined and stored on the NSP WEB server and transferred to a credit card company. The credit card company uses the credit card information transferred from the NSP's WEB server to make a payment, tells the online shop whether the payment can be made, and the transaction is completed. In other words, conventionally, personal information and credit card information input at the user's terminal are encrypted and transmitted to the NSP WEB server for recording and management. However, the information necessary for the NSP is originally only information on whether or not payment is possible with the credit card information provided by the credit card company, and credit card information should not be necessary. That is, conventionally, there is a disadvantage that the credit card information which is originally unnecessary is handled by the NSP.

  Conventionally, when a user performs shopping, personal information and credit card information must be input and transmitted for each NSP with which the online shop is contracted, which makes it troublesome to input personal information and credit card information. There was a disadvantage of being. Furthermore, there is a disadvantage that personal information is spread and leaked at a higher risk than the number of NSPs that input / transmit personal information.

As a prior art for solving the above disadvantages, there is a communication protocol called SET (Secure Electronic Transaction) disclosed in Non-Patent Document 1. In SET, the credit card information of the user is not disclosed on the NSP, and the credit card information can be safely transferred to the credit card company.
MasterCard and Visa, "SET Secure Electronic Transaction Specification, Book 1: Business Description," ver1.0, 1997.

  However, the above-described SET has a disadvantage that it is necessary to install dedicated application software on the user's terminal, and the OS and browser are limited.

  In general, personal information input by a user from a terminal or the like is encrypted and transmitted to an NSP WEB server. In other words, the NSP can guarantee the safety from the WEB browser of the user terminal to the WEB server of the NSP, and the safety from the user input device to the WEB browser on the user terminal is guaranteed. There is a disadvantage of not. That is, there is a disadvantage that the user's input itself is monitored by spyware or the like, and personal information is thereby leaked. This cannot be solved even by the above-described SET.

  An object of the present invention is to provide an information management method and an information management system for better managing confidential information such as personal information and preventing leakage in order to eliminate the disadvantages described above.

  In order to achieve the above-described object, an information management method according to a first aspect of the present invention includes a first user agent, a second user agent, and a service providing that provides a service to the first user agent via a network. An information management method for an information management system comprising: a server; and an information management server that records information corresponding to the first user agent and the second user agent, wherein the information management server includes the first user agent A first step of generating and recording authentication data based on an identifier of a user agent and an identifier of the service providing server; and the information management server uses the authentication data generated in the first step. A second step of associating the first user agent with the second user agent; and A third step in which a server transmits a public key associated with the service providing server to the second user agent via the information management server; and the second user agent A fourth step of encrypting information corresponding to the first user agent and the second user agent using the public key transmitted in the step 3, and the information management server comprising the fourth key A fifth step of recording information corresponding to the first user agent and the second user agent encrypted in a step, and the service providing server includes the encrypted first user agent and second user agent A sixth step of acquiring information corresponding to the user agent from the information management server, and the service providing server A seventh step of decrypting the encrypted information corresponding to the first user agent and the second user agent obtained in the sixth step using a secret key associated with the serving server; Have.

  The information management method of the second invention provides a service via a network to the first user agent, the second user agent, and the first user agent, and the first user agent and the second user agent An information management method for an information management system having a network server for recording information corresponding to the user agent, wherein the network server generates and records authentication data based on the identifier of the first user agent A first step, a second step in which the network server associates the first user agent with the second user agent using the authentication data generated in the first step, and the network The server obtains the public key associated with the network server with the second user. The third step of transmitting to the agent, and the second user agent, using the public key transmitted in the third step, to the first user agent and the second user agent A fourth step of encrypting corresponding information; and a fifth step of recording information corresponding to the first user agent and the second user agent encrypted in the fourth step by the network server. And the service providing server stores the encrypted first user agent and second user agent recorded in the fifth step using a secret key associated with the service providing server. A sixth step of decoding the corresponding information.

  An information management system according to a third aspect of the present invention includes a first user agent, a second user agent, a service providing server that provides a service to the first user agent via a network, the first user agent, An information management server for recording information corresponding to a second user agent, wherein the second user agent encrypts the information using a public key associated with the service providing server, and The information management server records the information encrypted by the second user agent as encrypted, and the service providing server records the encrypted first information recorded in the information management server. Obtain information corresponding to the user agent and the second user agent, and Tagged with a private key to decrypt the information.

  According to the present invention, it is possible to provide an information management method and an information management system for better managing confidential information such as personal information and preventing leakage.

Hereinafter, the personal information management system 100 of this embodiment will be described.
FIG. 1 is a block diagram showing a configuration of a personal information management system (information management system) 100.
As shown in FIG. 1, a personal information management system 100 includes a user terminal 1 (first user agent), a portable terminal 2 (second user agent), a service providing server 3, a personal information management server (information management server) 4, Consists of.

  The user terminal 1 is a terminal device such as a personal computer, and is based on the service providing server 3 and SSL (Secure Sockets Layer) / TLS (Transport Layer Security) based on PKI (Public Key Infrastructure). Perform encrypted communication. The user terminal 1 has a browsing application such as a WEB browser, and the user accesses various services developed on the service providing server 3 by using the browsing application. Here, the various services are, for example, online shopping.

The mobile terminal 2 is a mobile phone having a camera function capable of reading a two-dimensional code. As the two-dimensional code, for example, any of QR code, PDF417, DataMatrix, MaxiCode, etc. may be used.
The mobile terminal 2 performs encrypted communication with the personal information management server 4 using SSL / TLS.

The mobile terminal 2 has a user ID database (DB). The user ID DB includes a user ID unique to each user, a user terminal number (UTN) unique to the mobile terminal, and a PIN as a password (password). (Personal Identify Number) code is stored.
The UTN is an individual identification ID unique to the mobile phone body or an individual identification ID (identification ID unique to a mobile phone subscriber) such as a SIM (Subscriber Identity Module) card or UIM (User Identity Module) card. The ID unique to the mobile terminal is not limited to UTN, and various forms of IDs can be adopted. However, even if the user switches the mobile phone, the individual identification ID that can be carried by the user (described in the above-described card) The individual identification ID) is desirable.
The password is not limited to the PIN code, but may be a code set by the user, a personal identification number, or the like as long as the user can set the mobile terminal 2 and can be registered in the personal information management server 4.

  Further, the mobile terminal 2 further includes a personal information DB, and the user has previously stored personal information (name, address, telephone number, credit card number, credit card) before using the personal information management system in this embodiment. Information such as type and expiration date is recorded in the personal information DB. There may be a plurality of personal information that can be recorded in the personal information DB. That is, two or more pieces of personal information with the same name and different addresses can be recorded in the personal information DB. In this case, when personal information is required, the user can select which personal information is used on the portable terminal 2.

The service providing server 3 is a server device managed by an NSP (network service provider) that mediates the connection of the user terminal 1 to the network such as the Internet, and encrypted with the user terminal 1 and the PIMSP 3 by the SSL / TLS method, respectively. We are communicating. Specifically, the user terminal 1 is connected to a network such as the Internet through a telephone line, an ISDN line, a data communication dedicated line, or the like.
Further, the service providing server 3 has a user DB and records user information (user ID, encrypted personal information, etc.) of each service provided by the service providing server 3.
In FIG. 1, only one service providing server 3 is provided in the personal information management system 100, but the present invention is not limited to this. That is, the personal information management system 100 may have a plurality of service providing servers 3. In this case, the plurality of service providing servers 3 are independently connected to the user terminal 1 and the personal information management server 4.

The personal information management server 4 is a server device managed by a personal information management service provider (hereinafter referred to as PIMSP).
The personal information management server 4 records and manages personal information (including credit card information) and access logs of users who use the user terminal 1 and the mobile terminal 2.
The personal information management server 4 has a user information DB, a token DB, and an encrypted personal information DB.
In the user information DB, a user ID unique to the user and a UTN and PIN code unique to the mobile terminal 2 are associated and recorded in advance.
The token DB records the token TK generated by the personal information management server 4. The token TK will be described later.
The encrypted personal information DB records the encrypted personal information in association with the user information and the token TK.
Note that it is desirable that only one personal information management server 4 be provided in the personal information management system 100. The reason is that the personal information management server 4 manages the personal information collectively and reduces the risk of personal information leakage.

Next, an operation example of the personal information management system 100 will be described.
The sequence diagram shown in FIG. 2 shows the process until the user terminal 1 accesses the service providing server 3 and acquires a token.

Step ST1-1:
The user terminal 1 accesses the service providing server 3 and activates a WEB browser according to a user operation. As a result, the page information is received from the service providing server 3, decrypted, and displayed on the WEB browser. At this time, the service providing server 3 acquires the identification ID (hereinafter referred to as UA1ID) of the user terminal 1 as cookie information.

Step ST1-2:
The service providing server 3 is different from the personal information management server 4 in terms of the service providing server identification ID (hereinafter referred to as NSPID) and the user terminal 1 identifier (the UA1ID described above, but they may be the same. (Explain) Send UA1ID and request the issuance of token TK. The token is authentication data with a time limit.

Step ST1-3:
The personal information management server 4 generates a token TK using the NSPID and UA1ID transmitted from the service providing server 3 in step ST1-2 as parameters.
An example of the token TK is shown in FIG.
As shown in FIG. 3, the token TK is a character string, and includes a character string such as a communication protocol name, NSPID, a command name, and a token entity part. The token entity part is a character string obtained by encrypting information such as a token issuance date and time, a token expiration date, etc. using a hash function or the like.

Step ST1-4:
The personal information management server 4 transmits the token TK issued in step ST1-3 to the service providing server 3, and holds the UA1ID and the NSPID in association with the token TK.
Step ST1-5:
The service providing server 3 transmits to the user terminal 1 page information for displaying the token TK received in step ST1-4 on the WEB browser.

Step ST1-6:
The user terminal 1 displays a WEB page including the token TK on the WEB browser based on the page information transmitted from the service providing server 3 in step ST1-5.
Note that the user terminal 1 displays the token TK, which is a one-dimensional character string as described above, as a two-dimensional code. As a method for the user terminal 1 to display the token TK in the form of a two-dimensional code, for example, the URL (Uniform Resource Locator) of the two-dimensional code output server is described in the page information transmitted from the service providing server 3 in advance. Then, when the user terminal 1 interprets the page information and creates a WEB page, there is a method of accessing the URL, converting the token TK into a two-dimensional code, and displaying it on the WEB page.

FIG. 4 is a sequence diagram illustrating an operation example from reading of a token by the mobile terminal 2 to association of the user terminal 1 and the mobile terminal 2 by the personal information management server 4.
Step ST2-1:
The portable terminal 2 reads the token TK displayed in the format of the two-dimensional code displayed on the user terminal 1 in step ST1-6, and decodes (converts it into a one-dimensional character string).

Step ST2-2:
The portable terminal 2 transmits the token TK read and understood in step ST2-1 to the personal information management server 4 together with the user ID, UTN, and PIN code recorded in the user ID DB.

Step ST2-3:
The personal information management server 4 determines whether or not to grant authentication based on the user ID, UTN, PIN code and token TK transmitted in step ST2-2, and if yes, proceeds to step ST2-4. If so, the process proceeds to step ST2-5.
That is, the personal information management server 4 confirms whether or not the user ID, UTN, and PIN code transmitted from the portable terminal 2 in step ST2-2 are those recorded in advance in the user information DB, and records them in advance. If it is the same as the token TK transmitted together with the user ID, UTN and PIN code, the token DB is searched. Here, if the expiration date of the token TK transmitted together with the user ID, UTN and PIN code has not yet expired, the personal information management server 4 can search the token DB for the same token TK as the token TK and search for it. If YES, the authentication is permitted and the process proceeds to step ST2-4.
On the other hand, the personal information management server 4 determines that the transmitted user ID, UTN, and PIN code are not recorded in the user information DB, the expiration date of the received token TK has passed, or the received token TK is the token DB If not recorded, the authentication is impossible and the process proceeds to step ST2-5.

Step ST2-4:
The personal information management server 4 associates the portable terminal 2 that transmitted the matched token TK in step ST2-3 with the user terminal 1 corresponding to the UA1ID associated with the token, and associates the association with the token TK together with the token TK. Record in DB.
Step ST2-5:
If authentication is possible in step ST2-3, the personal information management server 4 transmits to the service providing server 3 that the user terminal 1 and the portable terminal 2 are associated in step ST2-4, and authentication is impossible. If it is, the fact that the user terminal 1 and the portable terminal 2 are not associated is transmitted to the service providing server 3.
Step ST2-5 ′:
If authentication is possible in step ST2-3, the personal information management server 4 transmits to the mobile terminal 2 that the user terminal 1 and the mobile terminal 2 are associated in step ST2-4. If there is, the fact that the user terminal 1 and the portable terminal 2 are not associated is transmitted to the portable terminal 2.
Step ST2-5 and step ST2-5 ′ are executed almost simultaneously.

FIG. 5 is a sequence diagram illustrating an operation example from when the personal information request, the privacy policy, and the public key certificate of the service providing server 3 are transmitted to the mobile terminal 2 and confirmed by the user on the mobile terminal 2.
Step ST3-1:
The service providing server 3 receives the fact that the user terminal 1 and the portable terminal 2 are associated, transmitted in step ST2-5, and personal information of the user using the user terminal 1 and the portable terminal 2 Is transmitted to the personal information management server 4.

Step ST3-2:
The personal information management server 4 transmits the personal information request transmitted in step ST3-1, the public key certificate of the service providing server 3 that transmitted the personal information request, and the privacy policy of the service providing server 3 to the portable terminal 2.
Here, the public key certificate of the service providing server 3 is a certificate issued by a certificate authority based on a public key infrastructure PKI (Public Key Infrastructure) or a private certificate authority inside PIMSP, and is determined for each service provider server 3. The personal information management server 4 holds the public key certificate of the service providing server 3 in advance.
The privacy policy information notifies the user how the service providing server 3 uses the personal information requested by the personal information request. For example, the service providing server 3 notifies the user of the personal information. Information is browsed only by the personal information management server 4 and not by the service providing server 3 itself.

Step ST3-3:
The portable terminal 2 displays the personal information request, the privacy policy information, and the public key certificate of the service providing server 3 transmitted from the personal information management server 4 in step ST3-2.
Step ST3-4:
The user browses and confirms the personal information request, privacy policy information, and public key certificate displayed in step ST3-3, and selects whether or not the portable terminal 2 can agree.

FIG. 6 is a sequence diagram illustrating an operation example from when the user selects personal information transmitted by the mobile terminal 2 until the service providing server 3 notifies the user terminal 1 that the personal information has been acquired.
Step ST4-1:
In order to transmit the personal information requested by the personal information request on the portable terminal 2, the user selects which personal information in the personal information DB is to be transmitted. If only one piece of personal information is recorded in the personal information DB, there is no need to select this step. If personal information is not recorded in advance in the personal information DB, the user may record personal information in the personal information DB at this time.

Step ST4-2:
The portable terminal 2 encrypts the personal information selected in step ST4-1 using the public key received in step ST3-2.
Step ST4-3:
The portable terminal 2 transmits the personal information encrypted in step ST4-2 to the personal information management server 4.

Step ST4-4:
The personal information management server 4 records the encrypted personal information transmitted in step ST4-3 in the encrypted personal information DB.
Step ST4-5:
The personal information management server 4 notifies the service providing server 3 that the personal information requested by the personal information request has been acquired.

Step ST4-6:
The service providing server 3 notifies the user terminal 1 that the personal information management server 4 has acquired personal information.

FIG. 7 is a sequence diagram showing an operation example until the service providing server 3 obtains personal information.
Step ST5-1:
The service providing server 3 transmits use purpose information describing the use purpose of the requested personal information and identification information (user ID) of the personal information to the personal information management server 4.
Step ST5-2:
The personal information management server 4 verifies whether the service providing server can access the personal information by comparing the usage purpose information transmitted in step ST5-1 with the privacy policy information, and if possible, proceeds to step ST5-3. move on. If impossible, the process is terminated.

Step ST5-3:
The personal information management server 4 transmits the requested personal information to the service providing server 3 while being encrypted.
Step ST5-4:
The service providing server 3 decrypts the encrypted personal information transmitted in step ST5-3 using a secret key corresponding to the service providing server 3. After decryption and use of personal information, the service providing server 3 deletes the decrypted personal information.

  As described above, in the personal information management system 100 of this embodiment, the mobile terminal 2 uses the public key information of the service providing server 3 to encrypt personal information, and the personal information management server 4 is encrypted. The personal information is recorded and managed in an encrypted state, and the service providing server 3 acquires the personal information as encrypted from the personal information managing server 4 when the personal information is needed, and the service providing server 3 Decrypt using the private key and use personal information. That is, since the personal information management server 4 collectively manages the personal information while being encrypted, the risk of personal information leakage can be kept low.

  Also, in the personal information management system 100 of the present embodiment, the personal information management server 4 records and manages personal information that is still encrypted with the public key associated with the service providing server. Since personalized information cannot be decrypted without using the corresponding service providing server's private key (very difficult), the personal information management server 4 itself decrypts personal information recorded and managed by itself. The contents cannot be used, and security is high. Also, even if a third party can obtain encrypted personal information, it is almost impossible to decrypt and decrypt it, so in this sense it can be said that security is high.

  Furthermore, in the personal information management system 100 of the present embodiment, the token TK issued by the personal information management server 4 using the identification IDs of the user terminal 1 and the service providing server 3 as a parameter is used as the service providing server 3, the user terminal 1, the mobile phone. Transfer to the personal information management server 4 again via the terminal 2, verify whether the token before transfer and the transferred token match, and if they match, associate the user terminal 1 with the portable terminal 2 It is carried out. There is a possibility that spyware or the like is stored in the user terminal 1 and it is not necessarily a safe environment for handling personal information. However, in the case of mobile phones, spyware has almost never been found in the country so far. In addition, since the telephone number is originally managed, the access restriction is firm and the security is high. Therefore, it can be said that the mobile terminal 2 is a relatively safe environment when handling personal information. For this reason, by accessing the personal information management system 100 from the user, such as the input of personal information, on the mobile terminal 2, the user terminal 1 and the mobile terminal 2 are associated with each other by the above-described method. Can improve security.

  Furthermore, in the personal information management system 100 of the present embodiment, when a token TK is transferred from the user terminal 1 to the mobile terminal 2, a two-dimensional code such as a two-dimensional code is used, and therefore, displayed on the user terminal 1. In addition, there is no mistake in inputting the token TK into the portable terminal 2 (character string typing mistake, etc.), and usability is improved.

  Furthermore, in the personal information management system 100 of this embodiment, when the personal information management server 4 transmits the encrypted personal information to the service providing server 3, the privacy policy information (individual personal information output by the service providing server 3) Since the service providing server 3 determines whether or not the personal information can be accessed on the basis of information describing how to handle the information), the security is high.

  Further, in the personal information management system 100 of the present embodiment, the encrypted personal information is recorded and managed in the personal information management server 4 together with information that can identify the user such as a user ID. Can be reused. That is, when using the service of the same service providing server 3 as the service providing server 3 previously used by the user, if the personal information is required again, the encryption recorded and managed in the personal information management server 4 is used. The service providing server 3 can decrypt and use the converted personal information. This saves the trouble of re-inputting personal information, improves usability, reduces the chance of personal information leakage when inputting personal information, and improves security.

By using the personal information management system 100 of this embodiment described above, for example, a system that enables online shopping anonymously can be realized.
For example, company A that manages online shopping sites, company B that performs payment with a credit card, company C that provides home delivery services, and products that have received a product and purchaser identifier (user ID) from company A and printed a destination label Suppose that there is an intermediate company D that is pasted on and handed over to company C. Here, each of the companies corresponds to the service providing server 3 in the present embodiment described above.
The user inputs personal information about his / her name and address using the mobile terminal 2 at the time of purchasing the product, but the user's personal information is encrypted using the public keys of the B company and the D company, and the personal information Recorded and managed by the management server 4. Company B obtains encrypted personal information encrypted with Company B's public key, decrypts it with Company B's private key, and determines whether payment is possible by reading the credit card information in the personal information. If the payment is possible, the company A is informed that the payment is possible. Company A delivers the product purchased by the user to Company D along with the user ID. The company D obtains the encrypted personal information corresponding to the user ID encrypted with the company D public key from the personal information management server 4 and decrypts it with the company D private key, and sends the user name and address to the destination. Fill in the label, paste it on the product and give it to company C. Eventually, company C delivers a product to the user.

That is, since the company A identifies the user by the user ID, the user can purchase the merchandise without being informed of the credit card information while remaining anonymous when viewed from the company A. Only necessary personal information is known to each of Company B and Company D. The personal information management server 4 can know where the encrypted personal information has been transferred, but cannot decrypt the encrypted personal information and view the contents.
Further, if the printer that prints at D company is limited, and the printer has a function that can implement the merged printing of the address corresponding to the public key encryption of D company, the PC of D company It is possible to even print a destination label without directly handling personal information above, thereby reducing the risk of personal information leakage.

Furthermore, a personal information management system 100a is shown as a modification of the personal information management system 100 of the above-described embodiment.
FIG. 8 is a block diagram showing a configuration of the personal information management system 100a.
As shown in FIG. 8, the personal information management system 100 a includes a user terminal 1, a mobile terminal 2, and a network server 5.

About the user terminal 1 and the portable terminal 2, since it is the same as that of the user terminal 1 and the portable terminal 2 demonstrated by embodiment mentioned above, description is abbreviate | omitted.
The network server 5 is a combination of the service providing server 3 and the personal information management server 4 in the above-described embodiment.
Accordingly, the network server 5 includes a server device managed by the NSP that mediates the connection of the user terminal 1 to the network such as the Internet, and a server device managed by the PIMSP. Communication encrypted by the TLS method or the like is performed. The network server 5 includes a user DB, a user information DB, a token DB, and an encrypted personal information DB. Since each database is the same as in the above-described embodiment, a description thereof will be omitted.

  In this modification, the server (service providing server) managed by the NSP and the server (personal information management server) managed by PIMSP are one, so that communication between them is necessary. Different from the above-described embodiment. In the above-described embodiment, a configuration having a plurality of service providing servers is also assumed. However, in this modification, it is not assumed that there are a plurality of servers managed by the NSP (cooperation between NSPs). Not expected).

Hereinafter, an operation example in the personal information management system 100a of this modification will be briefly described.
First, the user terminal 1 accesses the network server 5 according to the user's operation, receives and decodes the page information, and displays the WEB page on the WEB browser. At this time, the network server 5 acquires the UA1ID of the user terminal 1 as cookie information. The network server 5 generates a token TK based on NSPID and UA1ID, and holds the UA1ID and NSPID in association with the token TK. The network server 5 transmits to the user terminal 1 page information for displaying the generated token TK on the WEB browser, and the user terminal 1 that has received this transmits the WEB page including the two-dimensional code obtained by converting the token TK to the WEB browser. Display above.

  Next, after the token TK displayed in the two-dimensional code format displayed on the user terminal 1 is read by the portable terminal 2 and converted into a one-dimensional character string, the user recorded in the user ID DB together with the read token TK The ID, UTN, and PIN code are transmitted to the network server 5. The network server 5 determines whether or not to give authentication based on the received user ID, UTN, PIN code, and token TK. If a token TK that matches the received token TK exists in the token DB, it is determined that authentication is possible, and the mobile terminal 2 that has transmitted the matched token TK and the user terminal 1 that corresponds to the UA1ID associated with the token Is recorded in the token DB together with the token TK, and if the authentication is impossible, it is recorded that the user terminal 1 and the portable terminal 2 are not associated with each other. At the same time, if authentication is possible, the fact that the user terminal 1 and the mobile terminal 2 are associated is transmitted to the mobile terminal 2, and if authentication is added, the user terminal 1 and the mobile terminal 2 The fact that it is not associated is transmitted to the portable terminal 2.

  Next, when the user terminal 1 and the mobile terminal 2 are associated, the network server 5 requests a personal information request for requesting personal information of the user who uses the user terminal 1 and the mobile terminal 2, personal information The public key certificate of the NSP that transmitted the request and the privacy policy of the NSP are transmitted to the mobile terminal 2. The mobile terminal 2 displays the received personal information request, privacy policy information, and NSP public key certificate, and based on this, the user browses and confirms the personal information request, privacy policy information, and public key certificate. Then, whether or not to agree is selected on the portable terminal 2. If the user agrees, the portable terminal 2 encrypts the personal information using the received public key, and transmits the encrypted personal information to the network server 5. The network server 5 records the received encrypted personal information in the encrypted personal information DB, and notifies the user terminal 1 that the personal information has been acquired.

  Thereafter, the network server 5 decrypts and uses the encrypted personal information when necessary.

  That is, according to the personal information management system 100a of the present modification, the server managed by the NSP and the server managed by the PIMSP are in one server. In this case, the server managed by PIMSP can use the personal information without the step of determining whether the server managed by the NSP can access the personal information by comparing the usage purpose information with the privacy policy information. Compared to the above-described embodiment, time and labor associated with using personal information are reduced.

The present invention is not limited to the embodiment described above.
That is, when implementing the present invention, various modifications, combinations, sub-combinations, and alternatives may be made with respect to the components of the above-described embodiments within the technical scope of the present invention or an equivalent scope thereof.

In the embodiment described above, the information to be handled is personal information, but any information may be used as long as it is confidential information that is not desirable to be leaked.
In the above-described embodiment, the mobile terminal 2 reads the two-dimensional code displayed by the user terminal 1, but the present invention is not limited to this. That is, in the present invention, any form may be used as long as the authentication data output from the user terminal 1 (first user agent) is input to the portable terminal 2 (second user agent). For example, using a technique such as acoustic OFDM, the mobile terminal 2 may listen to the authentication sound output from the user terminal 1.

FIG. 1 is a block diagram showing the configuration of the personal information management system 100. FIG. 2 is a sequence diagram showing the process until the user terminal 1 accesses the service providing server 3 and acquires a token. FIG. 3 is a diagram illustrating an example of the token TK. FIG. 4 is a sequence diagram illustrating an operation example from reading of a token by the mobile terminal 2 to association of the user terminal 1 and the mobile terminal 2 by the personal information management server 4. FIG. 5 is a sequence diagram illustrating an operation example from when the personal information request, the privacy policy, and the public key certificate of the service providing server 3 are transmitted to the mobile terminal 2 and confirmed by the user on the mobile terminal 2. FIG. 6 is a sequence diagram illustrating an operation example from when the user selects personal information transmitted by the mobile terminal 2 until the service providing server 3 notifies the user terminal 1 that the personal information has been acquired. FIG. 7 is a sequence diagram showing an operation example until the service providing server 3 obtains personal information. FIG. 8 is a block diagram showing a configuration of a personal information management system 100a according to a modification.

Explanation of symbols

  DESCRIPTION OF SYMBOLS 100 ... Personal information management system, 100a ... Personal information management system, 1 ... User terminal, 2 ... Portable terminal, 3 ... Service provision server, 4 ... Personal information management server, 5 ... Network server

Claims (7)

A first user agent, a second user agent, a service providing server for providing a service to the first user agent via a network, and information corresponding to the first user agent and the second user agent; An information management method for an information management system having an information management server for recording
A first step in which the information management server generates and records authentication data based on an identifier of the first user agent and an identifier of the service providing server;
A second step in which the information management server associates the first user agent with the second user agent using the authentication data generated in the first step;
A third step in which the service providing server transmits a public key associated with the service providing server to the second user agent via the information management server;
The second user agent encrypts information corresponding to the first user agent and the second user agent using the public key transmitted in the third step;
A fifth step in which the information management server records information corresponding to the first user agent and the second user agent encrypted in the fourth step;
A sixth step in which the service providing server acquires from the information management server information corresponding to the encrypted first user agent and second user agent;
Information corresponding to the encrypted first user agent and second user agent acquired by the service providing server in the sixth step using a secret key associated with the service providing server. A seventh step of decrypting
An information management method. The second step includes
An eighth step in which the first user agent outputs the authentication data;
A ninth step of inputting the authentication data output from the first user agent in the eighth step to the second user agent;
The information management server searches whether the authentication data recorded in the first step is the same as the authentication data input to the second user agent in the ninth step. A tenth step of associating the first user agent with the second user agent when there is a match;
The information management method according to claim 1. The information management method according to claim 2, wherein in the eighth step, the first user agent displays a two-dimensional code based on the authentication data. The sixth step includes
An eleventh step in which the service providing server generates privacy policy information indicating how to use the acquired information and transmits the privacy policy information to the second user agent via the information management server;
The second user agent may cause the service providing server to acquire information corresponding to the first user agent and the second user agent based on the privacy policy information transmitted in the eleventh step. A twelfth step of determining whether or not it is good;
In the twelfth step, when it is determined by the second user agent that the information corresponding to the first user agent and the second user agent may be acquired by the service providing server, information management A thirteenth step in which the server transmits information corresponding to the first user agent and the second user agent to the service providing server;
The information management method according to any one of claims 1 to 3, further comprising: Provide a first user agent, a second user agent, and a service to the first user agent via a network, and record information corresponding to the first user agent and the second user agent. An information management method for an information management system having a network server,
A first step in which the network server generates and records authentication data based on the identifier of the first user agent;
A second step in which the network server associates the first user agent with the second user agent using the authentication data generated in the first step;
A third step in which the network server transmits a public key associated with the network server to the second user agent;
The second user agent encrypts information corresponding to the first user agent and the second user agent using the public key transmitted in the third step;
A fifth step in which the network server records information corresponding to the first user agent and the second user agent encrypted in the fourth step;
Information corresponding to the encrypted first user agent and second user agent recorded in the fifth step by the service providing server using a secret key associated with the service providing server. A sixth step of decrypting
An information management method. A first user agent;
A second user agent;
A service providing server for providing a service via a network to the first user agent;
An information management server for recording information corresponding to the first user agent and the second user agent;
Have
The second user agent encrypts the information using a public key associated with the service providing server;
The information management server records the information encrypted by the second user agent as encrypted;
The service providing server acquires encrypted information corresponding to the first user agent and the second user agent recorded in the information management server, and obtains a secret key associated with the service providing server. An information management system that uses and decrypts the information. The information management server generates authentication data based on an identifier of the first user agent and an identifier of the service providing server, and uses the generated authentication data to generate the first user agent and the first user agent. The information management system according to claim 6, wherein the information management system associates two user agents with each other.

Images