JP2010257376A - Confidential information masking system - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To prevent confidential information from being leaked, by masking the information without a user being aware of information output in a confidential information file. <P>SOLUTION: The confidential information masking system includes a data processor for masking the confidential information included in a target text file. The data processor includes: a means for recording, as conversion information, a one-to-one correlation between a unmasked full size character, and another full size character to be replaced after masking, into a database; a means for reading the file; a means for generating a masking result file by masking to convert each of the full size characters included in the read file, into another full size characters, by referring to the conversion information of the database; and a means for outputting the masking result file. <P>COPYRIGHT: (C)2011,JPO&INPIT

Description

  The present invention relates to a system for preventing leakage of confidential information such as personal information, and in particular to a log file provided externally for investigation, and more generally to masking confidential information against a text format file. The present invention relates to a masking system for preventing leakage.

  In recent years, there is a technique for preventing leakage of personal information by masking personal information when outputting data including personal information as one of countermeasures against information leakage of confidential information. For example, in Patent Document 1, when an administrator copies an information medium on which personal information such as a license or a credit card is copied, a personal image representing personal information is masked and printed, thereby leaking personal information. Is preventing.

  Further, in Patent Document 2, when data that needs to be protected is transmitted / received in a communication terminal device such as a multifunction peripheral, personal information is obtained by masking and outputting information such as the sender and sender of the transmission / reception log information. This prevents the leakage of information that should be protected.

JP 2008-259114 A JP 2008-047960 A

  The licenses and credit cards that are subject to protection in the above prior art are personal information, and it is easily imagined that the information such as the sender and the sender includes personal information. It may not be easy to determine whether confidential information is included.

  For general software products, the operation history of the product and the usage history of information, etc. are saved in the computer as a log file, and if a problem occurs in that product, the product developer can investigate and identify the cause smoothly To do so, output a log file. The user sends the log file to the product developer, and the product developer investigates a defect in the product with reference to the log file. In that case, since the user does not know what information the product collects and outputs as a log file, even if the log file contains information that may be personal information or confidential information of the user It cannot be recognized, and confidential information may be leaked unintentionally. As a countermeasure, the content of the log file is checked by the user, and if information that becomes confidential information is included, masking is performed to prevent the leakage of confidential information to some extent. it can.

  However, in reality, it is impossible for the user to check all the contents of the log file of the product and to mask the confidential information, and for the user to check the log file without permission. If editing is performed, information originally required for investigation may be destroyed.

  The object of the present invention is that it is not necessary for the user to know what information is output to the log file for investigation. To provide a log masking system capable of preventing leakage. More generally, an object of the present invention is to provide a masking system which is not limited to a log file for investigation but is intended for a text file containing confidential information.

In order to achieve the above object, a confidential information masking system of the present invention is a confidential information masking system having a data processing device that performs a masking process on confidential information included in a target file in a text format. , Means for recording a one-to-one correspondence between full-width characters before mask processing and another full-width character replaced after mask processing in a database as conversion information, means for reading the target file, and the read target file Means for generating a mask result file by performing a mask process for replacing each full-width character included in each of the full-width characters with a corresponding another full-width character with reference to the conversion information of the database, and the mask result file Output means.
More preferably, when the data processing apparatus has no conversion information about the full-width characters before the mask processing when referring to the conversion information in the database, the data processing apparatus is configured to perform another processing after the mask processing corresponding to the full-width characters before the mask processing. Means for newly setting the full-width characters of, and means for recording the newly set full-width characters before the mask processing and another full-width characters after the mask processing as conversion information in the database. is there.
More preferably, the data processing device refers to the conversion information in the database, thereby converting one or more full-width characters after mask processing included in the mask result file into full-width characters before the mask processing, respectively. It has a means to restore.

As described above, the confidential information masking system of the present invention has the following effects.
A mask process is performed in which all double-byte characters in the target file are converted into one-to-one correspondence with another full-width character, so the user does not need to know what information is included in the target file, and the user However, since it is not necessary to manually mask and full-width characters that can become confidential information are masked, it is possible to efficiently prevent leakage of confidential information.
In addition, when targeting log files, the product developer does not destroy the information necessary for the investigation by editing the log file in order to prevent leakage of confidential information. It can be handled as a log file (not falsified) and can be investigated appropriately.
Furthermore, since conversion information of full-width characters before mask processing and full-width characters after mask processing is recorded in the target file and conversion information can be referred to, for example, double-byte characters can be used as information necessary for a log for investigation. Even if it is included, it is possible to restore only some of the necessary double-byte characters by referring to the conversion information. As a result, it is possible to avoid knowing more information than necessary.

1 is a system configuration diagram showing an embodiment of a log masking system according to the present invention. It is a figure which shows an example of the data structure of the conversion information. 3 is a flowchart showing an outline of processing of a log masking system 101. 2 shows an example of the present embodiment in a log masking system.

  Hereinafter, embodiments of the present invention will be described with reference to the drawings. In the following, the present invention will be described by taking a log masking system for a log file for investigation as an example, but the present invention can be applied as a general masking system for confidential information files.

FIG. 1 is a system configuration diagram showing an embodiment of a log masking system according to the present invention.
The investigation log file 121 is stored as a use history of the software product installed in the computer. For example, when a software product malfunctions or during maintenance, the user takes out the saved log file as the investigation log file 121. The user does not provide the investigation log file 121 as it is for the outside investigation, but causes the log masking system 101 to perform processing, and provides the processed mask result file 131 for the outside investigation. .

  The log masking system 101 includes a data processing apparatus in which a predetermined program for performing mask processing is introduced. The data processing apparatus includes a storage unit 102 including a memory, each data processing unit 103a to 103d realized by a CPU executing a predetermined program, and an output unit 104 including a printing apparatus. Although not shown, a general input device and a display device for a user to operate are also provided as appropriate. Furthermore, a database for storing the conversion information 111 is also provided.

  The investigation log file reading processing unit 103 a reads the investigation log file 121 designated by the user into the storage unit 102. The mask processing unit 103b performs mask processing on all double-byte characters in the log file for investigation read while referring to the conversion information 111 of the database, and generates a mask result file. The conversion information storage processing unit 103c stores the association between full-width characters before and after the mask processing in the database. The mask result file output processing unit 103d outputs, from the output unit 104, the mask result file 131 after the mask processing is performed as an investigation log file.

  Here, full-width characters to be masked indicate hiragana, katakana, kanji, and full-width numbers that can be confidential information. In general, mask processing is not performed for single-byte characters output as a log for investigation.

  When the mask process is performed, the association between the full-width characters before and after the process is recorded as conversion information 111 in the database. The user can refer to the recorded contents. It is also possible to restore a part or all of the investigation log file 121 by re-converting one or more double-byte characters of the mask result file 131 into double-byte characters before processing based on the conversion information 111 of the database. It is.

FIG. 2 is a diagram illustrating an example of a data structure of the conversion information 111 recorded in the database.
The conversion information 111 includes a target character 402 of a full-width character to be masked and a converted character 403 that is another full-width character obtained by replacing the character. All double-byte characters subjected to mask processing are stored in the target character 201, and replaced double-byte characters are stored in the converted character 202. Also, the converted characters 202 replaced with the target characters 201 always correspond one-to-one, and there are never a plurality of target characters 201 for the same converted character 202.

FIG. 3 is a flowchart showing an outline of processing of the log masking system 101.
The log masking system 101 first reads the investigation log file 121 designated by the user into the storage unit 102 (step 301). Next, when the read log file for investigation is text data (step 302), the character string data in the log file for investigation is acquired (step 303). A search is made from the beginning of the character string data (step 304), and a full-width character string to be masked is acquired (step 305). It is determined whether the conversion information 111 does not exist (Y) or exists (N) by referring to the database (step 306).

If the conversion information 111 does not exist or the replacement character of the acquired full-width character is not set in the conversion information 111 in step 306 (Y), the replacement character for the acquired full-width character is set in the conversion information 111 ( Step 307). The rule for setting the replacement character is arbitrary and is not particularly limited. At this time, however, the replacement character set in the conversion information 111 is a full-width character that is not yet used as the replacement character of the conversion information 111. This ensures a one-to-one correspondence between the full-width character before processing and the full-width character after processing. The newly set conversion information 111 is recorded in the database. Subsequently, conversion of the target character, that is, mask processing is performed based on the set conversion information 111 (step 308).
If conversion information 111 exists in step 306, conversion of the conversion target character, that is, mask processing is performed based on the conversion information 111 (step 308).

  After the search of all character string data in the investigation log file 121 is completed (step 309), the data of the investigation log file 121 in which all double-byte characters are replaced is output as the mask result file 131 (step 310).

FIG. 4 shows an example of this embodiment in a log masking system.
All double-byte characters in the specified investigation log file are replaced with other double-byte characters and output as a mask result file. Single-byte characters are output without being replaced.

  In the above-described embodiment, an example in which the log masking system is applied to one investigation log file is shown. However, the present invention is not limited to this, and a folder by specifying a plurality of investigation log files or folder designations. All the following log files for investigation may be targeted.

  In this embodiment, the log masking system uses the log masking system as an investigation log file. However, the present invention is not limited to this, and it is not a binary file but a text file other than information that can be classified. Any file output as single-byte characters may be used. That is, the present invention is not limited to a log masking system, and can be applied as a general masking system for a confidential information file.

  In this embodiment, the full-width characters to be masked by the log masking system are hiragana, katakana, kanji, and full-width numbers, but are not limited to this, and may be other full-width characters that can be confidential information.

101: Log masking system, 111: Conversion information, 121: Investigation log file, 131: Mask result file

Claims (3)

A confidential information masking system having a data processing device for performing mask processing on confidential information contained in a target file in a text format, the data processing device comprising:
Means for recording a one-to-one correspondence between full-width characters before mask processing and another full-width character replaced after mask processing as conversion information in a database;
Means for reading the target file;
Means for generating a mask result file by performing a masking process for replacing each full-width character included in the read target file with another full-width character corresponding to the conversion information in the database; and
And a means for outputting the mask result file. The data processing device is
Means for newly setting another full-width character after mask processing corresponding to the full-width character before mask processing when there is no conversion information about the full-width character before mask processing when referring to the conversion information of the database;
2. The confidential information according to claim 1, further comprising means for recording a newly set full-width character before mask processing and another full-width character after mask processing in the database as conversion information. Masking system. The data processing device is
The apparatus further comprises means for restoring one or more full-width characters after mask processing included in the mask result file to full-width characters before the mask processing by referring to the conversion information of the database. The confidential information masking system according to claim 1 or 2.

Images