JP2009181207A - Information management device, program and information management method - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide technology for specifying safe information (a variable value) efficiently avoiding identification risk when a change occurs in a database storing personal information. <P>SOLUTION: When updating a personal information table stored in a personal information storage area 112, a safe variable value group extraction part 122 specifies a record having an updated variable value from the personal information table, and decides whether or not the updated variable value is the safe variable value avoiding the identification risk in the specified record. <P>COPYRIGHT: (C)2009,JPO&INPIT

Description

  The present invention relates to a technique for safely managing personal information.

  In recent years, when social demands for privacy protection are increasing, it has become indispensable to consider privacy in the information systems of companies that handle personal information. In this regard, it is desirable to anonymize personal information when providing personal information to a third party.

  A typical means of anonymizing personal information is to remove information that can identify an individual from the personal information or to make identifiable information ambiguous. An example of the former is a process of removing a name and an address, and an example of the latter is a process of converting an address into prefecture units, converting an age into increments of 10 years, and the like.

  However, even if such anonymization processing is performed, it may be possible to identify a specific individual from the anonymized personal information by collating with other information that can be obtained about the individual. That is, even if an accurate name or address is not disclosed, there is a possibility that an individual can be identified by a combination of variables (items) such as sex and age constituting anonymous personal information. Therefore, when anonymizing personal information, it is desirable to consider safety from the viewpoint of such identification risk.

  Non-Patent Document 1 describes a combination of variables with low identification risk (safety variables) in each record for a record set in which one person's personal information is expressed as a single record of multiple items. A technique for determining the group) is disclosed.

Yoshinori Sato, Akihiko Kawasaki, “Examination of Personal Information Anonymization System that Guarantees Identification Risk”, Information Processing Society of Japan Symposium Series, Vol.2007, No.1, “Multimedia, Distributed, Collaboration and Mobile (DICOMO2007) Symposium ”, Pp.1182-1189, issued 29th June 2007

  In the technique described in Non-Patent Document 1, in order to determine whether or not a set of variables in a record, that is, a set of variable values, is safe, what is the variable value set in the entire record set constituting personal information? A process is performed to count whether or not there are cases.

  In the technique described in Non-Patent Document 1, when a database in which personal information is stored is updated, a safety variable group is specified in conjunction with the database update in order to guarantee the identification risk of anonymized personal information. It is necessary to redo all the processing, and depending on the number of data stored in the database, the calculation load is very heavy and inconvenient.

  Accordingly, the present invention provides a technique capable of specifying safe information (variable values) that can efficiently avoid identification risk when a change occurs in a database storing personal information. Objective.

  In order to solve the above problems, the present invention extracts a safe variable value group from personal information related to the changed information when the database is changed.

  For example, according to the present invention, a personal information table having one record of personal information storing information corresponding to one or more items, and the number of the personal information storing the same information for each item are predetermined. An information management device having a storage unit for storing a safety information group table stored in one record for each piece of personal information as safety information, and a control unit, the control unit Is the same information as the information after the change for each item in the specified personal information and the process of specifying the personal information in which the updated information is stored when the personal information table is updated And a process of storing the changed information as safety information in the safety information group table when the counted number is equal to or greater than the predetermined number. To do, And butterflies.

  As described above, according to the present invention, it is possible to specify safe information (variable values) that can efficiently avoid an identification risk when a change occurs in a database storing personal information.

  FIG. 1 is a schematic diagram of an information system 100 according to the first embodiment of the present invention.

  As shown in the figure, the information system 100 includes a personal information management apparatus 110 and an information terminal 140, which can transmit and receive information to and from each other via a network 150.

  FIG. 2 is a schematic diagram of the personal information management apparatus 110.

  As illustrated, the personal information management device 110 includes a storage unit 111, a control unit 120, an input unit 125, an output unit 126, and a transmission / reception unit 127.

  The storage unit 111 includes a personal information storage area 112, a safety variable value group update personal information storage area 113, a safety variable value group extraction parameter storage area 114, a safety variable value group storage area 115, and an update status management information storage. An area 116, an anonymization condition information storage area 117, an anonymous personal information storage area 118, and an anonymization execution date and time management information storage area 119 are provided.

  In the personal information storage area 112, personal information managed by the information system 100 is stored.

  For example, in this embodiment, a personal information table 112 a as shown in FIG. 3 (schematic diagram of the personal information table 112 a) is stored in the personal information storage area 112.

  As shown in the figure, the personal information table 112a includes an ID field 112b, a gender field 112c, an age field 112d, a zip code field 112e, a store visit frequency field 112f, a store visit date field 112g, and a purchase amount field 112h. The personal information of each individual is stored for each record by storing information corresponding to the item specified in each field in each record.

  The ID field 112b stores identification information for identifying each record (each individual). Here, in this embodiment, a natural number starting from “1” is assigned to each record in order from the top of the personal information table 112a. However, the present invention is not limited to such a form. .

  The gender field 112c stores information for identifying the gender of each individual.

  Information specifying the age of each individual is stored in the age field 112d.

  The zip code field 112e stores information for specifying the zip code of each individual address.

  In the store visit frequency field 112f, information for specifying the store visit frequency of each individual is stored. Here, the store visit frequency may be the number of visits to a specific store in a specific period, or may be a value determined by a specific rule from the number of visits to a specific store in a specific period.

  In the store visit date field 112g, information specifying the date on which each individual last visited the store is stored.

  The purchase price column 112h stores information for specifying the purchase price of the item purchased by each individual at a specific store. Here, the purchase price may be the total purchase price of the goods in a specific period, or may be the purchase price of the goods purchased last in a specific store.

  Returning to FIG. 2, in the safety variable value group update personal information storage area 113, a personal information table used when the safety variable value group extraction unit 112 described later extracts the safety variable value group is stored.

  The personal information table stored in the personal information storage area 113 at the time of updating the safety variable value group has the same fields as the personal information table 112a shown in FIG. 3, but the information stored in each record is the safety information described later. This is information stored when the variable value group extraction unit 112 extracts a safe variable value group.

  The safety variable value group extraction parameter storage area 114 stores information for specifying a parameter that becomes a threshold when the safety variable value group extraction unit 112 described later extracts a safety variable value group.

  For example, in the present embodiment, a safety variable value group extraction parameter table 114a as shown in FIG. 4 (schematic diagram of the safety variable value group extraction parameter table 114a) is stored in the safety variable value group extraction parameter storage area 114.

  As shown in the figure, the safety variable value group extraction parameter table 114a has a parameter field 114b, and a parameter that becomes a threshold value when a safety variable value group extraction unit 112 described later extracts a safety variable value group. Stored. For this parameter, the operator of the personal information management apparatus 110 may store an appropriate value via the input unit 125.

  Returning to FIG. 2, in the safety variable value group storage area 115, among the personal information stored in the personal information storage area 112, a later-described safety variable value group extraction unit 112 determines that the variable value is a safe variable value. Stores information that identifies the variable value.

  For example, in the present embodiment, a safety variable value group table 115a as shown in FIG. 5 (schematic diagram of the safety variable value group table 115a) is stored in the safety variable value group storage area 115.

  As shown in the drawing, the safety variable value group table 115a includes an ID field 115b and a safety variable value group field 115c.

  In the ID field 115b, information specifying the ID assigned to each record of the personal information table 112a shown in FIG. 3 is stored.

  Of the variable values stored in the record of the personal information table 112a specified by the ID field 115b, the safe variable value group extraction unit 122 described later determines that the safe variable value group field 115c is a safe variable value. The variable value name (field name) and information specifying the variable value are stored.

  Returning to FIG. 2, the update status management information storage area 116 stores information specifying when the personal information table 112a is updated and when the safety variable value group table 115a is updated.

  For example, in the present embodiment, an update status management table 116a as shown in FIG. 6 (schematic diagram of the update status management table 116a) is stored in the update status management information storage area 116.

  As illustrated, the update status management table 116a includes an ID field 116b, a record update date / time field 116c, a safety variable value group update date / time field 116d, and an update type field 116e.

  In the ID field 116b, information for specifying an ID assigned to each record of the personal information table 112a and the safe variable value group table 115a is stored.

  The record update date / time field 116c stores information for specifying the date and time when the record of the personal information table 112a specified by the ID field 116b is updated.

  The information which specifies the date and time when the record of the safety variable value group update date / time field 116d and the record of the safety variable value group table 115a specified by the ID field 116b is updated is stored.

  The update type field 116e stores information for specifying the update type when the record of the personal information table 112a specified by the ID field 116b is updated. Here, in the present embodiment, either “addition” of the record or “change” of the record is stored as the update type.

  Returning to FIG. 2, the anonymization condition information storage area 117 stores information for specifying conditions for anonymizing the personal information stored in the personal information storage area 112.

  For example, in this embodiment, an anonymization condition table 117a as shown in FIG. 7 (schematic diagram of anonymization condition table 117a) is stored in anonymization condition information storage area 117.

  As shown in the figure, the anonymization condition table 117a includes a gender field 117b, an age field 117c, a zip code field 117d, a store visit frequency field 117e, a store visit date field 117f, and a purchase amount field 117g.

  The gender field 117b stores information for specifying a condition (method) for anonymizing the information stored in the gender field 112c of the personal information table 112a. For example, here, the information (male or female) stored in the gender field 112c of the personal information table 112a is converted to gender unknown.

  The age field 117c stores information for specifying a condition (method) for anonymizing the information stored in the age field 112d of the personal information table 112a. For example, here, the information (age) stored in the age field 112d of the personal information table 112a is set in increments of 10 years (for example, age from 30 to 39 years is converted to 30 years). .

  The postal code field 117d stores information for specifying a condition (method) for anonymizing the information stored in the postal code field 112e of the personal information table 112a. For example, here, the conversion is performed so that only the upper three digits of the information stored in the postal code field 112e of the personal information table 112a are left.

  The store visit frequency field 117e stores information for specifying a condition (method) for anonymizing the information stored in the store visit frequency field 112f of the personal information table 112a. For example, here, the information stored in the store visit frequency field 112f of the personal information table 112a is distributed to one of 10 or more and 10 or less.

  The visit date field 117f stores information for specifying a condition (method) for anonymizing the information stored in the visit date field 112g of the personal information table 112a. For example, here, the information (year / month / day) stored in the visit date field 112g of the personal information table 112a is converted to only the year and month.

  The purchase amount field 117g stores information for specifying a condition (method) for anonymizing the information stored in the purchase amount field 112h of the personal information table 112a. For example, here, the information stored in the purchase amount field 112h of the personal information table 112a is converted into increments of 1000 yen.

  Returning to FIG. 2, the anonymous personal information storage area 118 stores information for identifying anonymized personal information.

  For example, in this embodiment, an anonymous personal information table 118 a as shown in FIG. 8 (schematic diagram of the anonymous personal information table 118 a) is stored in the anonymous personal information storage area 118.

  As illustrated, the anonymous personal information table 118a includes an ID field 118b, a gender field 118c, an age field 118d, a postal code field 118e, a store visit frequency field 118f, a store visit date field 118g, and a purchase amount field 118h. In each record, among the information stored in the corresponding record of the personal information table 112a stored in the personal information storage area 112, the safe variable value group extraction unit 122 described later determines that it is safe. And the anonymous variable value obtained by anonymizing the variable value determined by the safe variable value group extraction unit 122, which will be described later, based on the anonymization condition table 117a.

  Returning to FIG. 2, the anonymization execution date and time management information storage area 119 stores information for specifying when the personal information stored in the personal information storage area 112 is anonymized.

  For example, in the present embodiment, an anonymization execution date / time table 119a as shown in FIG. 9 (schematic diagram of anonymization execution date / time table 119a) is stored in the anonymization execution date / time management information storage area 119.

  As illustrated, the anonymization execution date / time table 119a includes an ID field 119b and an anonymization date / time field 119c.

  In the ID field 119b, information corresponding to the ID assigned to each record of the personal information table 112a is stored.

  The anonymization date / time field 119c stores information for specifying the date and time when the variable value stored in the record of the personal information table 112a specified by the ID field 119b is anonymized.

  Returning to FIG. 2, the control unit 120 includes an information processing unit 121, a safe variable value group extraction unit 122, an update information management unit 123, and an anonymization processing unit 124.

  The information processing unit 121 receives an input of personal information via the input unit 125, generates a personal information table 112a, and stores it in the personal information storage area 112.

  Further, the information processing unit 121 displays the personal information table 112a stored in the personal information storage area 112 in a predetermined display format on the output unit 126, and adds a new information to the personal information table 112a via the input unit 125. A process of updating personal information is performed by adding a record and changing a variable value stored in the record of the personal information table 112a.

  For each field of the personal information table 112a, the safe variable value group extraction unit 122 performs a process of counting (adding) the number of the same variable value stored in the field for each variable value.

  Then, the safety variable value group extraction unit 122 compares the value counted for each variable value with the parameter stored in the safety variable value group extraction parameter storage area 114, and sets a value greater than the parameter to the safety variable value. Judge.

  Further, the safety variable value group extraction unit 122 extracts a safety variable value for each record of the personal information table 112a, generates a safety variable value group table 115a, and stores it in the safety variable value group storage area 115. Process.

  In addition, even when the personal information table 112a is updated, the safety variable value group extraction unit 122 sets the same variable value in each field of the personal information table 112a for each variable value related to the updated variable value. By counting whether it is stored and comparing it with a parameter, it is determined whether or not it is a safe variable value, and processing for updating the safe variable value group table 115a is performed.

  When the information processing unit 121 updates the personal information table 112a, the update information management unit 123 stores the updated record in the update information management table 116a stored in the update status management information storage area 116. A process of storing information for specifying the ID, the update date and time, and the update type is performed.

  Further, when the safety variable notification group table 115 is updated in the safety variable value group extraction unit 122, the update information management unit 123 updates the safety variable value group update date / time field 116d of the record corresponding to the updated record ID. The information for specifying the date of update date is stored.

  The anonymization processing unit 124 uses the anonymization condition table stored in the anonymization condition information storage area 117 as the variable value stored in each record of the personal information table 112a stored in the personal information storage area 112. According to 117a, the process which anonymizes is performed.

  Specifically, the anonymization processing unit 124 identifies a variable value other than the safety variable value stored in the safety variable value group table 115a among the variable values stored in each record of the personal information table 112a. Then, the specified variable value is anonymized according to the condition (method) stored in the corresponding field of the anonymization condition table 117a.

  The input unit 125 receives input of information.

  The output unit 126 outputs information.

  The transmission / reception unit 127 is an interface for transmitting / receiving information via the network 150.

  The personal information management apparatus 110 described above includes, for example, an external storage such as a CPU (Central Processing Unit) 161, a memory 162, and an HDD (Hard Disk Drive) as shown in FIG. 10 (schematic diagram of the computer 160). Device 163, reader 165 for reading information from portable storage medium 164 such as CD-ROM (Compact Disk Read Only Memory) and DVD-ROM (Digital Versatile Disk Read Only Memory), and input such as keyboard and mouse This can be realized by a general computer 160 including a device 166, an output device 167 such as a display, and a communication device 168 such as a NIC (Network Interface Card) for connecting to a communication network.

  For example, the storage unit 111 can be realized by the CPU 161 using the memory 162 or the external storage device 163, and the control unit 120 loads a predetermined program stored in the external storage device 163 into the memory 162. The input unit 125 can be realized by the CPU 161 using the input device 166, and the output unit 126 can be realized by the CPU 161 using the output device 167. The transmission / reception unit 127 can be realized by the CPU 161 using the communication device 168.

  The predetermined program is downloaded from the storage medium 164 via the reading device 165 or from the network via the communication device 168 to the external storage device 163, and then loaded onto the memory 162 and executed by the CPU 161. You may do it. Alternatively, the program may be directly loaded on the memory 162 from the storage medium 164 via the reading device 165 or from the network via the communication device 168 and executed by the CPU 161.

  FIG. 11 is a schematic diagram of the information terminal 140.

  As illustrated, the information terminal 140 includes a storage unit 141, a personal information storage area 142, a control unit 143, a personal information analysis unit 144, an input unit 145, an output unit 146, and a transmission / reception unit 147. Prepare.

  The storage unit 141 includes a personal information storage area 142.

  In the personal information storage area 142, an anonymous personal information table 118a received from the personal information management apparatus 110 via the transmission / reception unit 147 is stored.

  The control unit 143 includes a personal information analysis unit 144.

  The personal information analysis unit 144 performs processing for analyzing the anonymous personal information table 118a stored in the personal information storage area 142 and outputting the analysis result to the output unit 146 in a predetermined display format.

  For example, in the present embodiment, the personal information analysis unit 144 performs RFM analysis. RFM analysis is generally known as an analysis method that classifies or ranks customers based on three indicators: Recency (Recency: Recent Purchase Date), Frequency (Total Purchase Count), and Monetary (Total Purchase Amount). Is.

  12 (schematic diagram of the analysis result display screen 144a) is obtained by performing an RFM analysis from the information stored in the anonymous personal information table 118a, so that the male excellent customer list (the male customer who is determined to be an excellent customer) 6 is an analysis result display screen displaying a list of record IDs storing personal information. By comparing such a customer list with the anonymous personal information table 118a and the original data used to create the anonymous personal information table 118a, for example, a purchase history, it is possible to grasp a purchase pattern targeting good customers. become.

  The input unit 145 receives information input.

  The output unit 146 outputs information.

  The transmission / reception unit 147 is an interface for transmitting / receiving information via the network 150.

  The information terminal 140 described above can be realized by a general computer 160 as shown in FIG. 10, for example.

  For example, the storage unit 141 can be realized by the CPU 161 using the memory 162 or the external storage device 163, and the control unit 143 loads a predetermined program stored in the external storage device 163 into the memory 162. The input unit 145 can be realized by the CPU 161 using the input device 166, and the output unit 146 can be realized by the CPU 161 using the output device 167. The transmission / reception unit 147 can be realized by the CPU 161 using the communication device 168.

  The predetermined program is downloaded from the storage medium 164 via the reading device 165 or from the network via the communication device 168 to the external storage device 163, and then loaded onto the memory 162 and executed by the CPU 161. You may do it. Alternatively, the program may be directly loaded on the memory 162 from the storage medium 164 via the reading device 165 or from the network via the communication device 168 and executed by the CPU 161.

  FIG. 13 is a sequence diagram showing processing in the information system 100.

  First, the information processing unit 121 of the personal information management apparatus 110 outputs the personal information table 112a stored in the personal information storage area 112 to the output unit 126, and the operator of the personal information management apparatus 110 via the input unit 125 via the input unit 125. The personal information table 112a is updated (S10).

  Then, when a new record is added to the personal information table 112a or a variable value of an existing record in the personal information table 112a is changed, the information processing unit 121 is added or updated to the update information management unit 123. The record ID and update type (change or addition) are notified.

  Upon receiving such notification, the update information management unit 123 updates the update status management table 116a stored in the update status management information storage area 116 (S11).

  Specifically, the update information management unit 123 adds a new record to the update status management table 116a, stores the notified ID in the ID field 116b, stores the update type in the update type field 116e, The date and time when the notification is received from the processing unit is stored in the record update date and time field.

  Next, the safety variable value group extraction unit 122 of the personal information management apparatus 110 has reached a predetermined number of times (for example, the number of notifications when the personal information table 112a is updated from the information processing unit 121). Or when the predetermined time is reached), the safety variable value group table 122a is updated (S12).

  Specifically, the safety variable value group extraction unit 122 obtains a copy of the personal information table 112a stored in the personal information storage area from the information processing unit 121 and sets it as an update personal information table.

  In the following, the number of each field excluding the ID field of the update personal information table is M, and the variable value of each field excluding the ID field is assigned a natural number of 0 to M−1 for each record. It shall be. Further, it is assumed that the number of each record excluding the field name in the updating personal information table is N, and that each record is assigned a natural number of 0 to N-1. Each variable value of the update personal information table is stored in the two-dimensional array D [N] [M], and the i (0 ≦ i ≦ N−1) line j (0 ≦ j) in the update personal information table. ≦ M−1) The variable value in the column is referred to by D [i] [j].

  Then, if the safety variable value group extraction unit 122 has not yet performed the extraction process of the safety variable value group on the personal information table 112a, the safety variable value group extraction unit 122 is the same as that field for each field of the update personal information table. The number of variable values stored is counted for each variable value and compared with the parameter stored in the safe variable value group extraction parameter storage area 114, and a value greater than that parameter is determined as the safe variable value. Then, for each record in the updating personal information table, a process is performed for extracting the safe variable value, generating the safe variable value group table 115a, and storing it in the safe variable value group storage area 115.

  On the other hand, when the safety variable value group extraction unit 122 has already performed the extraction process of the safety variable value group on the personal information table 112a, each of the variable values related to the variable values updated in the personal information table 112a. The number of the same variable value stored in each field of the personal information table for update is counted and compared with the parameter to determine whether it is a safe variable value. Processing to update the group table 115a is performed. Details of this process will be described with reference to FIG.

  Further, when the safety variable value group extraction unit 122 updates the safety variable value group table, the safety variable value group extraction unit 122 stores the update personal information table in the safety value group update personal information storage area 113.

  In addition, when the safety variable value group extraction unit 122 updates the safety variable value group table 115a, the update information management unit 123 updates the variable ID in the personal information table 112a corresponding to the record ID updated. The safety variable value group update date and time field 116d of the record of the status management table 116a stores the date and time when the safety variable value group extraction unit 122 performs the update.

  Next, the anonymization processing unit 124 of the personal information management apparatus 110 performs the anonymous personal information table at a predetermined timing (for example, after the safety variable value group extraction unit 122 updates the safety variable value group table 122a). Update processing of 118a is performed (S13).

  Specifically, the anonymization processing unit 124 includes a list of information stored in the ID field 116b from the update status management table 116a stored in the update status management information storage area 116, and a safety variable value group update date / time field. A list of information stored in 116d is acquired.

  Then, the anonymization processing unit 124 compares the acquired safety variable value update date and time with the anonymization date and time stored in the anonymization execution date and time management information storage area 119 between corresponding ID records, The ID of the record whose value group update date is newer than the anonymization date is specified.

  Next, the anonymization processing unit 124 acquires a safety variable value group corresponding to the identified ID from the safety variable value group table 115a stored in the safety variable value group storage area 115, and further anonymization processing unit 124 acquires personal information corresponding to the identified ID from the personal information table 112 a stored in the personal information storage area 112.

  Then, the anonymization processing unit 124 converts the acquired personal information having no variable value corresponding to the safe variable value group according to the anonymization condition table 117a, and records corresponding IDs in the anonymous personal information table 118 Stored in the corresponding field.

  In addition, the information processing unit 121 has an anonymous personal information table stored in the anonymous personal information storage area 118 via the transmission / reception unit 127 at a specific timing (for example, when there is a request from the information terminal 140). 118a is transmitted to the information terminal 140 (S14).

  In the information terminal 140 that has received such an anonymous personal information table 118a, the personal information analysis unit 144 stores the received anonymous personal information table 118a in the personal information storage area 142 and at a specific timing (for example, the information terminal 140), the information stored in the anonymous personal information table 115a is analyzed according to a predetermined rule (S15). For example, sex, visit to the store A list of data representing excellent customers extracted on the basis of the date, store visit frequency, and purchase price is output to the output unit 146 (S16).

  FIG. 14 is a flowchart showing the safety variable value group table update process.

  First, the safety variable value group extraction unit 122 of the personal information management apparatus 110 reads the safety variable value group extraction parameter from the safety variable value group extraction parameter storage area 114, and reads the personal information table 112a from the personal information storage area 112. The update personal information table is used (S20).

  Next, the safety variable value group extraction unit 122 initializes a counter variable i for referring to each record of the update status management table 116a one by one (S21).

  Next, the safety variable value group extraction unit 122 determines whether or not the counter variable i is less than N (S22). If it is less than N (Yes in Step S22), the process proceeds to Step S23, while the counter variable i If the variable i is not less than N (No in step S22), the process proceeds to step S32. Here, N is the number of rows (number of records) in the update status management table 116a excluding the header row.

  In step S23, the safety variable value group extraction unit 122 refers to the i-th row of the update status management table 116a, and determines whether the record update date is newer than the safety variable value group update date. For example, in the example of the update status management table 116a, when i = 0, the data of ID = 1 is referred to, the record update date / time “2007/5/3 10:30”, and the safety variable value group update date / time “2007 / 5/4 0:00 ”.

  When it is determined that the record update date / time is newer than the safety variable value group update date / time (Yes in step S23), the safety variable value group extraction unit 122 corresponds to the ID of the i-th row of the update status management table 116a. Regarding the record of the updating personal information table, it is considered that the safety variable value group needs to be updated, and the process proceeds to step S24. On the other hand, if the record update date / time is not newer than the safety variable value group update date / time (No in step S23), the update is regarded as unnecessary and the process proceeds to step S31.

  Next, in step S24, the safety variable value group extraction unit 122 refers to the update type field 116e of the record in the i-th row of the update status management table 116a, and determines whether or not the update type is changed.

  If the update type is determined to be changed (Yes in step S24), the process proceeds to step S25. On the other hand, if the update type is not determined to be changed (No in step S24), the process proceeds to step S27. .

  In step S25, the safety variable value group extraction unit 122 updates the i-th record of the safety variable value group update personal information table stored in the safety variable value group update personal information storage area 113, and the update personal information table. The i-th record is compared, and the variable value of the updating personal information table whose value does not match, that is, the variable value whose value has been updated is specified. The identified m variable values and the variable number of the variable name are respectively stored in the array Value [] and the array VarName [] having m elements. m is an integer of 1 or more and M or less.

  Next, the safety variable value group extraction unit 122 extracts the ID of the record having the same variable value as the variable value specified in step S25 for each field of the updating personal information table, and extracts the ID for every field. To identify a set of non-overlapping IDs (S26). Specifically, in each of k = 0, 1,..., N−1, the condition D [k] [VarName [0]] = Value [0] or D [k] [VarName [1]] = Value [1] or... Find a set of IDs that do not overlap in a record that satisfies D [k] [VarName [m-1]] = Value [m-1].

  In step S27, the safety variable value group extraction unit 122 assigns, for each field of the update personal information table, the ID of the record having the same variable value as each variable value of the i-th record of the update personal information table. A set of non-overlapping IDs is specified by extracting and totaling the IDs extracted for each field. Specifically, all the values of the i-th record of the data 301 'are stored in the array Value [] and the array VarName [], and a set of IDs that do not overlap is obtained by the same processing as in step S26.

  Next, the safety variable value group extraction unit 122 performs a process of extracting a safety variable value group for the record in the updating personal information table corresponding to the ID specified in Step S26 or Step S27 (S28). An outline of processing for one record data in step S28 is as follows.

  First, the safe variable value group extraction unit 122 selects one variable value group (variable value group) included in one record data. The variable value group means a set of variable name = variable value, and the data of FIG. 8 will be described as an example. {Gender = male} or {gender = male, age = 33} or {gender = male, age = 33, postal code 215}, and the like. The safety variable value group extraction unit 122 selects one such variable value group.

  Next, the safe variable value group extraction unit 122 counts the number of record data (the number of equivalent records) having the above-described set of variable values in the update personal information table.

  Next, if the number of equivalence records is equal to or greater than the parameter value stored in the safety variable value group extraction parameter storage area 114, the safety variable value group extraction unit 122 selects the selected variable value group as a safety variable value. Adopt as a group.

  And the safe variable value group extraction part 122 repeats the above process with respect to the variable value group which has not counted the number of equivalence records.

  However, due to the nature of the safety variable value group, the number of safety variable value groups present in one record is not limited to one, and there may be two or more. In the present embodiment, one safety variable value set is selected for each record. One typical process for this is disclosed in Non-Patent Document 1. In the algorithm disclosed in Non-Patent Document 1, a priority order of variable value combinations is determined in advance, and variable value groups are sequentially counted according to the priority order. As a result of counting, a variable value group having the highest priority among the variable value groups satisfying the parameters and having the largest number of variable values included in the set is extracted as the maximum safe variable value group of the record.

  Next, the safety variable value group extraction unit 122 stores the safety variable value group extracted in step S28 in the record of ID = i of the safety variable value group table 115 stored in the proposed garden variable value group storage area 115. (S29).

  Next, the safety variable value group extraction unit 122 stores the date and time when the safety variable value is updated in the safety variable value group update date and time field 116d of the record with ID = i in the update status management table 116 (S30).

  Then, the safety variable value group extraction unit 122 increments the counter variable i by 1 (S31), returns to step S22, and repeats the process.

  In step S32, the safety variable value group extracting unit 122 stores the updating personal information table in the safety variable value group updating personal information storage area 113 as a safety variable value group updating personal information table.

  The above is the details of the safety variable value group table update process.

  In a conventionally known method such as the technique described in Non-Patent Document 1, even when one record in the personal information table 112a is updated or a new record is added, all the information in the personal information table 112a is updated. It was necessary to recalculate the safety variable value group for the record. In contrast, in the present embodiment, the personal information table at the time of updating the safety variable value group is stored, and when the record of the personal information table 112a is updated, the safety variable is limited to the record related to the updated variable value. A value group can be obtained.

  In addition, when a new record is added to the personal information table 112a, it is possible to obtain a safe variable value group only for records related to the variable value of the added record.

  Thus, according to the present embodiment, the update process of the safe variable value group table 115a can be performed more efficiently than in the conventional technique.

  In the present embodiment, when the safety variable value group table 115a is first generated, the prior art described in Non-Patent Document 1 or the like is applied, and the present invention is applied when the safety variable value group table 115a is updated. Although an example is shown, a method of selectively using the safe variable value group extraction process based on the number of updated or added records can be easily realized on the principle of the present invention. For example, the number of records whose record update date is newer than the safety variable value group extraction date is counted. If this number is smaller than a predetermined number, for example, 100,000, the safety variable value group update process shown in FIG. 14 is executed. And if it is larger than 100,000 cases, the prior art may be used.

  In the embodiment described above, the information system 100 includes the personal information management device 110 and the information terminal 140. However, the present invention is not limited to such an aspect. For example, processing performed by the personal information management device 110 With respect to the above, it may be performed in a distributed manner by a plurality of apparatuses.

For example, as in the information system 100 ′ shown in FIG. 15 (schematic diagram showing a modification of the information system 100), the personal information storage device 170, the identification risk management device 171 and the business information management are used instead of the personal information management device 110. The apparatus 172 may be provided, and the processing performed by the personal information management apparatus 110 in these apparatuses may be performed in a distributed manner. In particular,
A personal information storage area 112 is provided in the storage unit of the personal information storage device 170, an information processing unit 121 is provided in the control unit of the personal information storage device 170, and a storage unit of the identification risk management device 171 is provided in the storage unit. , A safety variable value group update personal information storage area 113, a safety variable value group extraction parameter storage area 114, a safety variable value group storage area 115, and an update status management information storage area 116 are provided to control the identification risk management device 171. Are provided with a safety variable value group extraction unit 122 and an update information management unit 123, and an anonymization condition information storage region 117, an anonymous personal information storage region 118, and anonymization are stored in the storage unit of the business information management device 172. An execution date and time management information storage area 119 is provided, and an anonymization processing unit 124 is provided in the control unit of the business information management device 172, and information is stored in these devices. By Yibin transceiver, it is possible to perform the same processing as the personal information management device 110.

  Next, an information system according to the second embodiment of the present invention will be described. Here, in the second embodiment of the present invention, since the personal information management device 210 is different from the first embodiment, items related to the personal information management device 210 will be described below.

  In the second embodiment, an anonymous personal information table can be generated in the same manner as in the first embodiment by selection of an information system administrator, and an access control personal information table is also generated as described later. To be able to. This selection may be set in the personal information management apparatus 210 via the input unit 125.

  FIG. 16 is a schematic diagram of the personal information management apparatus 210.

  As illustrated, the personal information management apparatus 210 includes a storage unit 211, a control unit 220, an input unit 125, an output unit 126, and a transmission / reception unit 127. The storage unit 211 and the control unit 220 are the first. Since these are different from the embodiment, the matters related to these will be described below.

  The storage unit 211 includes a personal information storage area 112, a safety variable value group update personal information storage area 113, a safety variable value group extraction parameter storage area 114, a safety variable value group storage area 115, and an update status management information storage. An area 116, an anonymization condition information storage area 117, an anonymous personal information storage area 118, an anonymization execution date and time management information storage area 119, and an access control information storage area 228 are provided, which is compared with the first embodiment. Since the access control information storage area 228 is different, the access control information storage area 228 will be described below.

  In the access control information storage area 228, whether or not each variable value stored in the personal information table 112a stored in the personal information storage area 112 is accessible is specified for each user who uses the information terminal 140. Information to be stored is stored.

  For example, in this embodiment, for each user who uses the information terminal 140, an access control table 228a as shown in FIG. 17 (schematic diagram of the access control table 228a) is stored in the access control information storage area 228.

  As shown, the access control table 228a includes an ID field 228b, a gender field 228c, an age field 228d, a postal code field 228e, a store visit frequency field 228f, a store visit date field 228g, and a purchase amount field 228h. .

  The ID field 228b stores an ID corresponding to the ID stored in the ID field 112b of the personal information table 112a.

  The gender field 228c, the age field 228d, the postal code field 228e, the store visit frequency field 228f, the store visit date field 228g, and the purchase amount field 228h of the record specified by the ID field 228b include the corresponding record and the personal information table 112a. The information (variable value) stored in the field stores information for specifying whether or not the user using the information terminal 140 is accessible.

  Here, in the present embodiment, when the symbol “◯” is stored, it indicates that it is accessible, and when the symbol “x” is stored, it indicates that it is not accessible. However, the present invention is not limited to such an embodiment.

  Returning to FIG. 16, the control unit 220 includes an information processing unit 121, a safe variable value group extraction unit 122, an update information management unit 123, an anonymization processing unit 124, and an access control unit 229. Since the access control unit 229 is different from that of the embodiment, the access control unit 229 will be described below.

  The access control unit 229 performs processing for generating the access control table 228a from the safety variable value group table 115a stored in the safety variable value group storage area 115.

  Specifically, referring to the safety variable value group table 115a, in the personal information table 112a stored in the personal information storage area 112, the variable value included in the safety variable value group has “O” in the column. Is stored, and “×” is stored in the variable value column not included in the safety variable value group, thereby generating the access control table 228a. The access control unit 229 performs processing for storing the generated access control table 228a in the access control information storage area 228.

  Further, when the safety variable value table 115a is updated, the access control unit 229 performs processing for updating the value of the record in the access control table 228a corresponding to the record in which the safety variable value table 115a is updated.

  Furthermore, the access control unit 229 stores the variable value of the personal information table 112a only in the column that can be accessed in the access control table 228a corresponding to the user of the information terminal 140 in response to the access request from the information terminal 140. The generated access control personal information table is transmitted to the information terminal 140.

  The personal information management apparatus 210 described above can be realized by a general computer 160 as shown in FIG.

  For example, the storage unit 211 can be realized by the CPU 161 using the memory 162 or the external storage device 163, and the control unit 220 loads a predetermined program stored in the external storage device 163 into the memory 162. The input unit 125 can be realized by the CPU 161 using the input device 166, and the output unit 126 can be realized by the CPU 161 using the output device 167. The transmission / reception unit 127 can be realized by the CPU 161 using the communication device 168.

  The predetermined program is downloaded from the storage medium 164 via the reading device 165 or from the network via the communication device 168 to the external storage device 163, and then loaded onto the memory 162 and executed by the CPU 161. You may do it. Alternatively, the program may be directly loaded on the memory 162 from the storage medium 164 via the reading device 165 or from the network via the communication device 168 and executed by the CPU 161.

  FIG. 18 is a sequence diagram illustrating processing in the information system according to the second embodiment.

  The processes in steps S40 to S42 are the same as the processes in steps S10 to S12 in FIG. 13 in the first embodiment, and thus the description thereof is omitted.

  In step S43, the access control unit 229 updates the access control table 228a.

  Specifically, the access control unit 229 reads the safety variable value group table 115a from the safety variable value group storage area 115.

  Then, the access control unit 229 stores “◯” in the field of the access control table 228a corresponding to the safety variable value stored in the safety variable value group table 115a, and stores “X” in the other cases. Thus, the access control table 228a is updated.

  Next, the access control unit 229 generates an access control personal information table at a predetermined timing (for example, when there is an access (acquisition) request from the information terminal 140a) (S44).

  Specifically, the access control unit 229 acquires the personal information table 112a from the personal information storage area 112, and sets the variable value of the column corresponding to the column in which the “x” value of the access control table 228a is stored. By deleting from the personal information table 112a, an access control personal information table is generated.

  Then, the access control unit 229 transmits the generated access control personal information table to the information terminal 140 via the transmission / reception unit 127.

  In the information terminal 140 that has received such an access control personal information table, the personal information analysis unit 144 stores the received access control personal information table in the personal information storage area 142 and at a specific timing (for example, the information terminal 140), the information stored in the access control personal information table is analyzed according to a predetermined rule (S46). For example, sex, visit to the store A list of data representing excellent customers extracted on the basis of the date, store visit frequency, and purchase price is output to the output unit 146 (S47).

  As described above, by generating the access control table 228a for each user, a limited privileged user allows reference to all variable values in the personal information table 112a, and a general user has a safety variable value with low identification risk. The operation of permitting reference to only the variable value corresponding to the group becomes possible.

  In the embodiment described above, the access control table 228a is generated for each user. However, the present invention is not limited to such an aspect. For example, for each analysis method in which analysis is performed by the information terminal 140 or the information terminal The access control table 228a may be generated every 140.

  In the embodiment described above, the parameter stored in the safety variable value group extraction parameter storage area 114 is set to a different value for each user (or analysis method, information terminal 140) (the safety variable value for each user or the like). The access control table 228a may be generated by generating the group extraction parameter table 114a). By doing in this way, the judgment criteria of safety can be changed for every user (or analysis method, information terminal 140).

  Next, an information system which is a third embodiment of the present invention will be described. Here, in the third embodiment of the present invention, since the personal information management device 310 is different from the first embodiment, items related to the personal information management device 310 will be described below.

  FIG. 19 is a schematic diagram of the personal information management apparatus 310.

  As illustrated, the personal information management apparatus 310 includes a storage unit 311, a control unit 320, an input unit 125, an output unit 126, and a transmission / reception unit 127, and the storage unit 311 and the control unit 320 are first. Since these are different from the embodiment, the matters related to these will be described below.

  The storage unit 311 includes a personal information storage area 112, a safety variable value group update time personal information storage area 113, a safety variable value group extraction parameter storage area 114, a safety variable value group storage area 115, and an update status management information storage. An area 116, an anonymization condition information storage area 117, an anonymous personal information storage area 118, an anonymization execution date and time management information storage area 119, and a log information storage area 330 are provided, and compared with the first embodiment. Since the log information storage area 330 is different, the log information storage area 330 will be described below.

  The log information storage area 330 stores information for identifying the history of access from the information terminal 140 to the personal information management apparatus 310.

  For example, in the present embodiment, a log table 330 a as shown in FIG. 20 (schematic diagram of the log table 330 a) is stored in the log information storage area 330.

  As illustrated, the log table 330a includes a date / time field 330b, a user field 330c, a reference condition field 330d, a reference record field 330e, and a reference variable field 330f.

  The date / time field 330b stores information for specifying the date / time when the information terminal 140 is accessed.

  In the user field 330c, identification information (user ID) for identifying a user who has accessed from the information terminal 140 is stored. Here, in this embodiment, when accessing the personal information management apparatus 310 from the information terminal 140, it is assumed that the user ID is included in the access request. For this reason, a user who uses the information terminal 140 inputs a user ID via the input unit 145 before accessing the personal information management apparatus 310.

  The reference condition field 330d specifies a reference condition (search condition) when a user who has accessed the personal information management apparatus 310 from the information terminal 140 searches the personal information table 112a stored in the personal information storage area 112. Information is stored.

  The reference record field 330e stores information for specifying the ID of the record in the personal information table 112a referred to by the user who has accessed the personal information management apparatus 310 from the information terminal 140.

  The reference variable field 330f stores information for specifying a field name (variable name) of a variable value of the personal information table 112a referred to by a user who has accessed the personal information management apparatus 310 from the information terminal 140.

  Returning to FIG. 19, the control unit 320 includes an information processing unit 121, a safety variable value group extraction unit 122, an update information management unit 123, an anonymization processing unit 124, a log information generation unit 331, and a log information output unit. 332 and the log information generation unit 331 and the log information output unit 332 are different from those of the first embodiment. Therefore, the log information generation unit 331 and the log information output unit 332 will be described below.

  Each time the information terminal 140 accesses the personal information management device 310 from the information terminal 140, the log information generation unit 331 adds a new record to the log table 330a stored in the log information storage area 330 and stores necessary information. To do.

  The log information output unit 332 refers to the safety variable value group table 115a at a specific timing (for example, when an input of a log information reference instruction is received via the input unit 125), so that the log information storage area 330 In the log table 330a stored in the table, a record indicating that a variable value other than the variable values belonging to the safety variable value group is referred to is extracted, for example, FIG. 21 (showing the log information output screen 332a) A process of generating an output screen 332a having a predetermined display format as shown in the schematic diagram and outputting it to the output unit 126 is performed.

  The personal information management apparatus 310 described above can be realized by a general computer 160 as shown in FIG.

  For example, the storage unit 311 can be realized by the CPU 161 using the memory 162 or the external storage device 163, and the control unit 320 loads a predetermined program stored in the external storage device 163 into the memory 162. The input unit 125 can be realized by the CPU 161 using the input device 166, and the output unit 126 can be realized by the CPU 161 using the output device 167. The transmission / reception unit 127 can be realized by the CPU 161 using the communication device 168.

  The predetermined program is downloaded from the storage medium 164 via the reading device 165 or from the network via the communication device 168 to the external storage device 163, and then loaded onto the memory 162 and executed by the CPU 161. You may do it. Alternatively, the program may be directly loaded on the memory 162 from the storage medium 164 via the reading device 165 or from the network via the communication device 168 and executed by the CPU 161.

  FIG. 22 is a sequence diagram illustrating processing in the information system according to the third embodiment.

  The processing in steps S50 to S52 is the same as the processing in steps S10 to S12 in FIG. 13 in the first embodiment, and thus the description thereof is omitted.

  In step S53, the information terminal 140 refers to necessary information from the personal information management device 310 and acquires necessary personal information (S53).

  Then, the log information generation unit 331 monitors the process in step S53, acquires necessary log information (S54), and stores the acquired log information in the log table 330a stored in the log information storage area 330. As a result, the log table 330 is updated (S55).

  Then, the log information output unit 332 indicates that a variable value other than the variable values belonging to the safety variable value group is referred to in the log table 330a stored in the log information storage area 330 at a specific timing. The record is extracted to generate a log information output screen 332a (S56) and output to the output unit 126 (S57).

  In the information terminal 140 that acquired the personal information, the personal information analysis unit 144 stores the received personal information in the personal information storage area 142 and at a specific timing (for example, the input unit 145 from the operator of the information terminal 140). (E.g., when an analysis instruction is input via the user), and personal information is analyzed according to a predetermined rule (S58). For example, a good customer who is extracted based on gender, date of visit, store visit frequency, and purchase price is selected. A list of data to be represented is output to the output unit 146 (S59).

  As described above, in the present embodiment, the access status when a record with a high identification risk in the personal information table 112a is referred to is output preferentially, so that the use status of personal information that may identify an individual is prioritized. It can be used for auditing whether or not appropriate use of personal information is performed.

  In the embodiment described above, the safety variable value group extraction unit 122 updates the safety variable value group table 115a from the record of the personal information table 112a having the updated variable value of the personal information table 112a. For example, the safety variable value group table 115a is updated using a record of the personal information table 112a having a variable value before update (variable value before change) of the personal information table 112a. It may be.

Schematic diagram of an information system. Schematic of a personal information management device. Schematic of a personal information table. The schematic diagram of a safety variable value group extraction parameter table. Schematic diagram of a safety variable value group table. Schematic diagram of an update status management table. Schematic diagram of anonymization condition table. Schematic of an anonymous personal information table. The schematic diagram of an anonymization execution date table. Schematic diagram of a computer. Schematic diagram of an information terminal. Schematic of analysis result display screen. The sequence diagram which shows the process in an information system. The flowchart which shows a safety variable value group table update process. Schematic which shows the modification of an information system. Schematic of a personal information management device. Schematic of an access control table. The sequence diagram which shows the process in the information system in 2nd embodiment. Schematic of a personal information management device. Schematic diagram of the log table. Schematic which shows the output screen of log information. The sequence diagram which shows the process in the information system in 3rd embodiment.

Explanation of symbols

100, 100 ′ Information system 110, 210, 310 Personal information management device 111 Storage unit 112 Personal information storage area 113 Safety variable value group update personal information storage area 114 Safety variable value group extraction parameter storage area 115 Safety variable value group storage area 116 Update status management information storage area 117 Anonymization condition information storage area 118 Anonymous personal information storage area 119 Anonymization execution date and time management information storage area 228 Access control information storage area 228
330 log information storage area 120 control unit 121 information processing unit 122 safety variable value group extraction unit 123 update information management unit 124 anonymization processing unit 229 access control unit 331 log information generation unit 332 log information output unit 125 input unit 126 output unit 127 Transceiver 140 Information terminal

Claims (15)

A personal information table having one record of personal information storing information corresponding to one or more items;
For each item, a safety information group table stored in one record for each personal information, as safety information, the number of the personal information in which the same information is stored is a predetermined number or more,
An information management device having a storage unit for storing
The controller is
When the personal information table is updated, a process for identifying personal information in which updated information is stored;
In the identified personal information, for each item, a process of counting the number of stored information the same as the information after the change,
When the total number is equal to or greater than the predetermined number, performing the process of storing the changed information as safety information in the safety information group table,
An information management device characterized by the above. The information management device according to claim 1,
The controller is
Of the information stored in the personal information table, the information that is not stored in the safety information group table is converted to other information according to a predetermined rule, thereby anonymizing the personal information table Process to generate personalized personal information table,
An information management device characterized by the above. The information management device according to claim 1 or 2,
The controller is
An access-restricted personal information table that cannot access specific information in the personal information table by deleting information that is not stored in the safety information group table among information stored in the personal information table. Performing the process to generate,
An information management device characterized by the above. The information management device according to claim 2 or 3,
The controller is
When there is a request for acquisition of personal information from another device, performing the process of outputting the anonymized personal information table or the access restricted personal information table to the other device;
An information management device characterized by the above. An information management device according to any one of claims 1 to 4,
The controller is
Processing to obtain history information referring to information stored in the personal information table from another device;
Performing a process of outputting history information, which is information that is not stored in the safety information group table, in a predetermined output format, which is referred to by other devices,
An information management device characterized by the above. Computer
A personal information table having one record of personal information storing information corresponding to one or more items;
For each item, a safety information group table stored in one record for each personal information, as safety information, the number of the personal information in which the same information is stored is a predetermined number or more,
A program for functioning as storage means and control means for storing
In the control means,
When the personal information table is updated, a process for identifying personal information in which updated information is stored;
In the identified personal information, for each item, a process of counting the number of stored information that is the same as the information after the change,
When the total number is equal to or greater than the predetermined number, the information after the change is stored as safety information in the safety information group table, and
A program characterized by The program according to claim 6,
In the control means,
Of the information stored in the personal information table, the information that is not stored in the safety information group table is converted to other information according to a predetermined rule, thereby anonymizing the personal information table To generate a personalized personal information table,
A program characterized by The program according to claim 6 or 7,
In the control means,
An access-restricted personal information table that cannot access specific information in the personal information table by deleting information that is not stored in the safety information group table among information stored in the personal information table. Let the process to generate,
A program characterized by The program according to claim 7 or 8,
In the control means,
When there is a request for acquisition of personal information from another device, the processing for outputting the anonymized personal information table or the access restricted personal information table to the other device is performed.
A program characterized by A program according to any one of claims 6 to 9,
In the control means,
Processing to obtain history information referring to information stored in the personal information table from another device;
Processing to output history information, which is information that is not stored in the safety information group table, in a predetermined output format, which is referred to by other devices,
A program characterized by A personal information table having one record of personal information storing information corresponding to one or more items;
For each item, a safety information group table stored in one record for each personal information, as safety information, the number of the personal information in which the same information is stored is a predetermined number or more,
An information management method performed by an information management apparatus having a storage unit for storing the information and a control unit,
A process in which the control unit performs a process of identifying personal information in which updated information is stored when the personal information table is updated;
In the specified personal information, for each item, the control unit performs a process of counting the number of stored information that is the same as the changed information;
A step of performing a process of storing the changed information as safety information in the safety information group table when the total number of the control unit is equal to or greater than the predetermined number;
Information management method characterized by An information management method according to claim 11,
The control unit converts the information stored in the personal information table, which is not stored in the safety information group table, into other information according to a predetermined rule, thereby the personal information table Providing a process of generating an anonymized personal information table that has been anonymized,
Information management method characterized by The information management method according to claim 11 or 12,
Access by which the control unit cannot access specific information in the personal information table by deleting information that is not stored in the safety information group table from information stored in the personal information table Providing a process of generating a restricted personal information table;
Information management method characterized by An information management method according to claim 12 or 13,
The controller includes a process of performing processing to output the anonymized personal information table or the access restricted personal information table to the other device when there is a request for acquiring personal information from the other device. ,
Information management method characterized by The information management method according to any one of claims 11 to 14,
A process in which the control unit performs a process of acquiring history information referring to information stored in the personal information table from another device;
A step of performing a process in which the control unit outputs history information, which is information not stored in the safety information group table, in a predetermined output format. ,
Information management method characterized by

Images