JP2012038097A - Information management system and method - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide a system for substantially preventing even a malicious insider from stealing a large amount of confidential information.SOLUTION: The information management system for managing one set of element information by dividing the one set into some parts includes a database management system 420 for generating a unique indirect element key with each element key allocated to some parts of the one set of element information as a function, and a database 410 for storing the indirect element key. The database management system 420 preferably uses one of factorization, a slide function and a random number table to generate the indirect element key. The database management system 420 preferably includes a collation mechanism 421 for deriving element information allocated to the element key by identifying the element key from the indirect element key.

Description

  The present invention relates to an information management system and method, and more particularly to an information management system and method for preventing a large amount of leakage of confidential information managed on a database in a database processing technique for managing data in a distributed manner.

  Many modern information systems have a database as a part thereof, and the database generally contains confidential information that should not be leaked to a third party such as personal information. Various methods have been studied to prevent the leakage of confidential information on the database. Recently, a method called distributed management, in which confidential information is divided into small pieces that do not make sense on their own and stored separately, has attracted attention. Has been.

  The outline of this distributed management will be described with reference to FIGS. Assume that the original information, which is confidential information, is composed of member numbers, names, addresses, and telephone numbers, which are element information, as shown in FIG. As shown in FIG. 2, the original information 101 includes element information 201 including a member number and a member number key for identifying each member number, element information 202 including a name and a name key for identifying each name, The information is divided into element information 203 composed of an address and an address key for identifying each address, and element information 20 and 4 composed of a telephone number and a telephone number key for identifying each telephone number, and stored in a database. Further, normally, in addition to this element information 201, element information 202, element information 203, and element information 204, a connection table 301 as shown in FIG. 3 showing the relationship between the element keys of each element information is prepared. Save at the same time.

  For example, item number 5 of the original information 101 is composed of a member number “0005”, a name “Taro Yamada”, an address “Minato-ku, Tokyo” and a telephone number “▽▽▽▽▽▽▽▽▽▽” Element keys corresponding to the element information are a member number key “213”, a name key “221”, an address key “234”, and a telephone number key “247”. At this time, in the concatenation table 301, the member number key “213”, the name key “221”, the address key “234”, and the telephone number key “247” constitute one line, which is the member number, name, and address. You can see that the phone number is linked. If the connection table 301 is used in this way, the original information 101 can be easily restored from the element information 201, the element information 202, the element information 203, and the element information 204.

  In the distributed management of confidential information, all element information may be distributed and managed as shown in FIG. 2, but those that do not pose a problem for maintaining confidentiality even if the relationship between the element information is known. It is more efficient to manage. For example, referring to the original information in FIG. 1, the address of the element information 203 and the telephone number of the element information 204 may be managed together. In this case, one element key is given to one set of address and telephone number. Anyway, if the element information 201, the element information 202, the element information 203, the element information 204, and the connection table 301 are stored in different storage devices, it is meaningful as long as all data across the five storage devices are not stolen. The original information cannot be restored. By using the distributed management method in this way, a large amount of data leakage by a malicious third party can be greatly suppressed.

JP-A-11-272681

  However, even if the above distributed management method is used, if an internal party such as a legitimate user or system administrator is malicious, the information after restoration can be taken out. Cannot be avoided. In addition to distributed management, there are many technologies for preventing confidential leaks, but none of them has a preventive effect on particularly malicious insiders. For example, access restrictions such as granting a right to access confidential information only to a specific administrator are made. However, this technique cannot prevent information leakage if the person with the right to access is malicious. This seems to be reflected in the reality that many cases of large-scale leaks of confidential information are crimes by insiders.

  The present invention has been made in view of the above points, and an object of the present invention is to provide a system in which even a malicious internal party cannot substantially steal a large amount of confidential information.

In order to solve the above-described problems, the present invention provides an information management system in which a set of element information is divided into several parts and manages each element key assigned to some of the set of element information as a function. Generating means for generating a unique indirect element key and storage means for storing the indirect element key. The generation means may generate the indirect element key using any one of prime factorization, a slide function, and a random number table. Further, it may be provided with a derivation unit that derives element information assigned to the element key by determining the element key from the indirect element key.
Specifically, information that is generally desired to be stolen as confidential information is meaningful confidential information, such as the original information 101 shown in FIG. If only one piece of element information is stolen from a distributed and managed database (for example, only the membership number “0005” or the name “Taro Yamada”), the purpose cannot be achieved, and restoration processing must be performed. It is necessary to go and make meaningful source information. For example, even a malicious administrator cannot steal meaningful confidential information without performing the restoration process. The present invention has been made in view of such properties of a distributed and managed database, and has been devised for a restoration process for restoring element information to original information.

  The outline of the present invention will be described with reference to FIG. 4 showing a general information system. The confidential information is stored in the database 410 in a form divided into element information. In order to simplify the description, the database 410 stores the element information 201, the element information 202, the element information 203, and the element information 204 shown in FIG. 2 and the connection table 301 shown in FIG. Suppose there is. Of course, the original confidential information is the original information 101 shown in FIG. The system user 440 accesses the element information 201, the element information 202, the element information 203, and the element information 204 in the database 410 via the application system 430 and the database management system 420, and assigns desired confidential information or assigned to this. You will get the element key etc.

  For example, it is assumed that the system user 440 requests the name and address of the person with the membership number “0005”. When this request is transmitted from the application system 430 to the database management system 420, the access control unit 422 of the database management system 420 accesses the element information 201 in the database 410, and the access control unit 422 sets the membership number “0005”. The corresponding member number key “213” is picked up. The matching mechanism 421 refers to the connection table 301 and determines that the element information related to the member number key “213” is the name key “221”, the address key “234”, and the telephone number key “247”. The access control unit 422 accesses the element information 202, the element information 203, and the element information 204, the name “Taro Yamada”, the address “Minato-ku, Tokyo”, and “▽▽▽▽▽▽▽▽▽▽ Is retrieved and transmitted to the application system 430, so that the system user can obtain the desired data. From an element key of a set of element information (for example, element key “213” of membership number “0005”) by the matching mechanism 421, an element key of related element information (for example, element key “221” of the name “Taro Yamada”) The process of calculating the element key “234” of the address “Minato-ku, Tokyo” and the element key “247” of the telephone number “▽▽▽▽▽▽▽▽▽▽”) is called a matching process. This collation process is indispensable when trying to extract meaningful information from the distributedly managed database 410 as shown in FIG.

  This is the same whether the confidential information is stealed maliciously by an inside party when the system attempts to steal confidential information by entering the system from the outside. Therefore, if this processing takes time and the processing capacity limit of the database management system 420 is utilized, for example, if only 10 reconciliation processes can be performed per second, a malicious internal party Even so, for example, in order to steal 200,000 confidential information, the database management system must be occupied for at least 5 and a half hours. In normal business, if the number of times of information requests to the information system is an average of 9 times / second, the matching process is performed 9 times per second on average. On the other hand, the processing capacity limit of this database management system is 10 matching processes. Therefore, since the reconciliation process that can be performed outside the normal business is only once / second, the database management system must be continuously operated for 55 hours or more in order to steal 200,000 pieces of confidential information.

  More generally speaking, assuming that the number of accesses per second in normal business is N, and the processing capacity of the information system is used to the limit, the reconciliation processing time is set so that (N + α) cases are processed per second Then, it takes M / α seconds to steal M confidential information. Setting M / α large is important to prevent a large amount of confidential information from being leaked.

  However, generally speaking, for example, if a simple concatenation table as shown in FIG. 2 is used, the time required for the reconciliation process is very short, and the limit number of processing per second of the data server management system is several thousand to several tens of thousands. Such a very large value. For example, if the average number of accesses per second is 10 and the limit processing number of the data server management system is estimated to be 1000 cases / second, α is a value of 990, and the confidential information to be stolen is 200,000. In the case of a case, it would be sufficient to have a little more than 3 minutes while carrying out normal work. With this, it is not possible to prevent leakage of confidential information. Therefore, it is necessary to extend the time required for the matching process by some method. Moreover, it must be something that cannot be easily changed even by malicious insiders. For future convenience, controlling the duration of the matching process is called load control.

BEST MODE FOR CARRYING OUT THE INVENTION

  In the following, the load control method of the matching process will be described in detail using an embodiment. Unless otherwise specified, it is assumed that the original information 501 which is confidential information is composed of element information represented by Am, l and has a form of M rows and L columns as shown in FIG. In the specific example of FIG. 1, M = 7, L = 4, A1,1 is the membership number “0001”, A1,2 are the names “Hanako Maruyama”, and A1,3 are the address “Shinagawa-ku, Tokyo”. , A1 and 4 correspond to the telephone number “XXXXXX”, A7 and 1 correspond to the member number “0007”, and A7 and 3 correspond to the address “Sapporo City, Hokkaido”. Since the information management system under consideration is premised on distributed management, the original information 501 in FIG. 5 is divided into N pieces, and as shown in FIG. 6, the element keys Ym, n and stored in the database 410. Here, m and n are 1 ≦ m ≦ M, 1 ≦ n ≦ N, and N ≦ L. In FIG. 6, for the sake of convenience, element information is arranged in the same order as the original information 501. However, as it is, the relationship between the element information can be easily understood without using a connection table. In general, the order in which the element information is arranged in the database management system 410 is changed.

  The relationship between Am, l and Bm, n is normally Bm if n ≦ N−1, Bm, n = [Am, N = [Am, N, Am, N + 1, n, and n = N. ,..., Am, L-1, Am, L]. Of course, the relationship between Am, l and Bm, n is not limited to this. For example, if K <J, Bm, K = [Am, K, Am, K + 1,..., Am, J−1] and Bm, A plurality of pieces of a plurality of pieces of element information may be provided as J = [Am, J, Am, J + 1,..., Am, L].

  In the specific example of FIG. 2, M = 7, L = 4, and N = 4. In this case, since L = N, Bm and n = Am, n for all (m, n) pairs. Further, regarding Ym, n in the specific example of FIG. 2, Y1,1 is "211", Y1,2 is "224", Y1,3 is "231", and Y1,4 is "242". As shown in FIG. 6, what is important in the load control method in the collation processing of information that is divided and managed is how to generate each element key corresponding to the element information divided into N pieces and when a certain element key is specified. The algorithm of how to find the element key of the related element information from the element key is used. A method for generating an element key and how the database management system 410 searches for an element key of related element information when a certain element key is designated will be described in detail using the following embodiment.

  As described above, in the distributed management system of confidential information so far, the element information is distributed and managed by the database management system 420 and the database 410, and the linkage table 301 shown in FIG. 3 or the linkage shown in FIG. Generally, the table 701 is created by the database management system 410 and stored in the database 410. The linked table directly represents the relationship between each element key. Therefore, if a malicious internal party analyzes the linked table, the matching process for finding the relationship between each element key is completed in a short time. There was a problem. In order to prevent this, in order to make the matching process more complicated, the element keys are associated with each other by another method without creating a so-called connection table, and the load of the matching process in the matching mechanism 421 is heavy. A so-called concatenation table is created, but any one of the methods can be adopted so that the load of the matching process between the element keys is increased. In addition, the load of the matching process needs to be changed depending on the actual system configuration and the frequency of normal access to confidential information. Therefore, it is desirable that the load of the butt process can be controlled, that is, it is possible to greatly change the load of the butt process using the same algorithm. Such an algorithm is referred to herein as a load control method.

  In the following, first, a load control method in the matching process when a so-called connection table is not created will be described using an embodiment.

Example 1

  In order to increase the load in the matching process without creating a so-called connection table, the matching mechanism 421 uses a prime factorization method. In this method, the element key is determined in two stages. In the first stage, an element key as a value uniquely identified is appropriately assigned to data included in the element information. In the second stage, the database management system 420 generates another value as a function of this associated plurality of element keys while maintaining uniqueness. This generated value is called an indirect element key. In this embodiment, the generated value is stored together with element information instead of the element key initially assigned by the database management system 420. This will be specifically described below with reference to examples.

The database management system 420 selects all the element keys Ym, n of the distributedly managed element information b1, b2,..., BN shown in FIG. At this time, when Ym, n is m ≠ m ′, the database management system 420 selects so as to satisfy the condition of Ym, n ≠ Ym ′, n. Specifically, the database management system 420 assumes that the largest one of the element keys Ym, n is α digits, and Xm, n represented by the following equation:
Xm, n = Ym, n * 10α + Ym, n + 1; m = 1 to M, n = 1 to N−1 & Xm, N = Ym, N * 10α + Ym, 1 (1)
Ask for. Here, “*” represents multiplication. However, when n = N, α is the maximum number of digits in Ym, n, but may be a natural number greater than the maximum number of digits. For example, if the maximum Ym, n is 3 digits, either α = 3 or α = 4 may be used. When α is equal to the number of digits of the maximum of Ym, n, for example, Xm, n considers Ym, n as a simple numeric string “Ym, n” and “Ym, n” “Ym, n + 1” Thus, the numeric string “Ym, n” is simply arranged in order. For example, when Ym, 1 = “111”, Ym, 2 = “222”,..., Ym, N = “NNN” and α = 3, Xm, 1 = “111222”. Similarly, Xm, 2 = “222333”, Xm, N = “NNN111”, which is simply a sequence of two numbers. If α = 4, a numeric string in which one zero is inserted between the numeric strings “Ym, n” such as Xm, 1 = “1110222” is formed. Similarly, when α = 5, a numeric string with two 0s between element keys is created. Since “0” between the numeric strings of the element keys has no meaning, a numeric string other than “0” may be entered.

  Next, Xm, n created in this way is subjected to prime factorization, and one prime number larger than any of the obtained prime factors is selected. If this is Pm, n, Zm, n = Zm, n = Xm, n * Pm, n is calculated, and this is used as the indirect element key of the element key Ym, n. FIG. 8 shows an element information group in which each element key in FIG. 6 is replaced with an indirect element key. In the confidential information distributed management system, when the prime factorization method described here is used, only the element information shown in FIG. 8 is distributed and stored in a plurality of servers.

  Pm, n is a prime number larger than any prime factor obtained when Xm, n is primed, but logically, Zm, n is primed without knowing the value of Xm, n. Sometimes, any rule can be used to select Pm, n as long as it is possible to extract prime numbers other than prime factors obtained when Xm, n is prime factorized. For example, a prime number larger than Xm, n may be simply used. For example, a rule that three prime numbers larger than all the prime factors obtained when Xm, n is primed may be selected. In this case, the product of the selected three prime numbers may be Pm, n in the above discussion. Actually, how to select Pm, n depends on how much the load of the matching process is to be made. In general, since prime factorization of a number having a large prime factor takes time, Pm, n often selects a prime number that is considerably larger than a prime factor that appears in the prime factorization of Xm, n.

  On the other hand, since the number of digits of Xm, n is known in advance, when Zm, n is prime factorized, even if Pm, n which is the maximum prime factor is not obtained, the obtained prime factors are sequentially multiplied from the smallest. , Xm, n is obtained even if the prime factorization is discontinued when the number of digits of Xm, n is reached. A preferred embodiment for preventing this from happening and ensuring that Pm, n is obtained by calculation to obtain Xm, n from Zm, n is Wm, n = Zm, n * F instead of Zm, n. (Pm, n) is used. Here, F (Pm, n) is a function of Pm, n, which is uniquely determined when Pm, n is given, and all the prime factors obtained when F (Pm, n) is primed are Any function may be used as long as the condition that it is smaller than Pm, n is satisfied. For example, it may be a numerical value of the upper 1 digit or the upper 2 digits of Pm, n (which may be lower, but the higher is easier to ensure that it is not 0), or the number of each digit of Pm, n Or a function such as F (Pm, n) = (Pm, n-1) / 2.

  As a more specific embodiment, for example, confidential information based on FIG. 1 is stored in element information as shown in FIG. 2, and the element key shown in FIG. Consider the case where the prime factorization method is applied to what is assigned. In this case, since all the element keys are three digits, α = 3 is set for simplicity. For all m, Xm, n can be easily made from FIG. 1 and FIG. That is, X1,1 is a combination of a member number “0002” and a pair of member number keys “211”, “Yoichi Suzuki” corresponding to the member number “0002” and a pair of name keys “224”. In the same manner, Xm, n may be created by combining the keys related to the member number “0002”. The result is shown in FIG. Further, FIG. 10 shows a result of prime factorization of the values of Xm, n in FIG. 9 and a prime number Pm, n larger than the prime number obtained by prime factorization of Xm, n (in this case, obtained by prime factorization of Xm, n). In addition, Zm, n = Xm, n * Pm, n is indicated as a prime number that is larger than the largest prime number among the prime numbers. This Zm, n may be used as an indirect element key instead of the original element key. However, as described above, as a more preferred embodiment, this Zm, n is multiplied by F (Pm, n). Should be used as an indirect element key. Here, it is assumed that F (Pm, n) is a function of adding numerical values of each digit of Pm, n. FIG. 10 also shows F (Pm, n) and Wm, n = Zm, n * F (Pm, n). Further, FIG. 11 shows a case where Wm, n is substituted as an indirect element key in place of each element key of the member number key, name key, and address telephone number key in FIG. Each content shown in FIGS. 9 to 10 is created by the database management system 420.

  Here, it is assumed that the information shown in FIG. 11 is stored in the database 410 of FIG. 4 and how the information is acquired for the information retrieval of the system user 440 will be described. Assume that the system user issues a request to the application system 430 to know the name, address, and telephone number of the member number “0005”, for example. Application system 430 communicates the request to database management system 420. Then, in the database management system, the access control unit 422 accesses the element information 201 in which the member number is stored, picks up that the indirect element key of the member number “0005” is “92335027952”, and the matching mechanism 421 The prime factorization is performed to obtain “9235027952” = “2 * 2 * 2 * 2 * 131 * 2699 * 2707”. Subsequently, the matching mechanism 421 adds each digit of the maximum prime number “2707” to obtain “2 + 7 + 0 + 7 = 16”, divides the indirect element key “92335027952” by 16, and further divides it by 2707 to obtain “213221”. obtain. Thus, it is found that the name key of the element information 202 is “221”.

  Next, the access control unit 422 accesses the element information 202 of the database 411 and extracts one indirect element key. For example, if it is the indirect element key “26016795” in the first row that has been taken out, the factoring is performed by the matching mechanism 421 using the same method as described above. The result is “3 * 3 * 3 * 3 * 5 * 7 * 7 * 19 * 23”. When each digit of the maximum prime number is added, it is found that 2 + 3 = 5, and F (Pm, n) = 5 in this case. Therefore, the obtained indirect element key “26016795” is divided by “5”, and further divided by the maximum prime number “23” to obtain “226233”. It turns out that the name key of this element information is “226” To do. Here, since the name key to be obtained is “221”, the name “26016795” in the first row is not the target connected element key.

  Accordingly, the database management system 420 accesses the element information 202 and retrieves another indirect element key. If it is “14908270” in the second row, “221234” is obtained by performing the same calculation as above. Since the element key of this element information is “221”, it is found that the name to be obtained is “Taro Yamada” corresponding to the element key “221”. Further, since it is understood that the element key of the address information related to this is “234”, the database management system 420 next accesses the element information 203 and performs the same procedure as that for the element information 202 by the address key. Finds the telephone number key “247” associated with the address “234”, “Minato-ku, Tokyo”. The database management system 420 accesses the element information 204 in order to search for the telephone number of the telephone number key “247” found here, and the target telephone number key “ 247 "is searched and the desired telephone number" ▽▽▽▽▽▽▽▽▽▽ "is obtained. Now that all the element information related to the member number “0005” has been obtained, the system user is notified through the application system, and the series of operations is terminated.

In the embodiment, Xm, n represented by the expression (1) is adopted and the prime factorization method is applied thereto. However, Xm, n other than the expression (1) may be employed. For example,
Xm, n = Ym, n + 1 * 10α + Ym, n; m = 1 to M, n = 1 to N−1 & Xm, N = Ym, 1 * 10α + Ym, N... Further, the expression (1) is a function of two element keys Xm, n is Ym, n and Ym, n-1, but Xm, n may be a function of more element keys. .
For example, when a function of three element keys is used, the following equation may be used.
Xm, n = Ym, n * 102α + Ym, n + 1 * 10α + Ym, n + 2; m = 1 to M, n = 1 to N−2.
Xm, N-1 = Ym, N-1 * 102α + Ym, N10α + Ym, 1 & Xm, N = Ym, N * 102α + Ym, 1 * 10α + Ym, 2
As described above, the order of Ym, n may follow any rule as long as Ym, n appears in the numerical sequence of Xm, n.

Further, for example, Xm, 1 = Ym, 1 * 10 (N−1) * α + Ym, 2 * 10 (N−2) * α +... + Ym, N−1 * 10α + Ym, N
Xm, 2 = Ym, 2 * 10 (N−1) * α + Ym, 3 * 10 (N−2) * α +... + Ym, N * 10α + Ym, 1,.
Xm, N = Ym, N * 10 (N−1) * α + Ym, 1 * 10 (N−2) * α +... + Ym, N−2 * 10α + Ym, N−1
As described above, Xm, n can be a function of all Ym, n. Of course, the order of arranging Ym and n can be variously considered in addition to the above.

  The method for producing Xm, n described so far has a certain kind of symmetry as a function of Ym, n, but it is also possible to produce Xm, n without any symmetry.

For example, indirect element keys may be created by using the above function for only some of the N element keys, and the original element keys may be used as they are for the rest.
For example, when N = 9,
Xm, 1 = Ym, 1 * 105α + Ym, 2 * 104α + Ym, 3 * 103α + Ym, 4 * 102α + Ym, 5 * 10α + Ym, 6
Xm, 6 = Ym, 6 * 103α + Ym, 7 * 102α + Ym, 8 * 10α + Ym, 9
Xm, n = Ym, n where n = 2, 3, 4, 5, 7, 8, 9
In this way, it is possible to know the relationship between the element keys Ym, n from Xm, 1 and Xm, 6 without creating a concatenation table, and the original information can be restored.

Further, in the above case where Xm, n is a function of all Ym, n, the above formula is applied only to one, for example, Xm, 1 in the same idea as above, and Ym, n is set to the other. It can be used as it is.
Xm, 1 = Ym, 1 * 10 (N−1) * α + Ym, 2 * 10 (N−2) * α +... + Ym, N−1 * 10α + Ym, N
Xm, n = Ym, n where n = 2 to N
In this case, as described in the second embodiment, there is an advantage that time can be shortened at the time of data registration.

Furthermore, when doing this, only one piece of special element information (element information corresponding to Ym, 1 in the above example) is obtained, so that all element information is not treated specially.
Rm, n = Ym, 1 * 10 (N−1) * α + Ym, 2 * 10 (N−2) * α +... + Ym, N−1 * 10α + Ym, N
For all n, Xm, n = Ym, n
It is also good. In this case, Rm, n serves as a kind of connection table.

Up to now, it has been described that Xm, n can be made by various methods. However, after making Xm, n, the method of applying the prime factorization method is the same as that described in the present embodiment. However, it may be that of another embodiment.
(Example 2)

  In the first embodiment, the indirect element key (Wm, n) shown in FIGS. 10 and 11 is based on the assumption that an element key has already been assigned to the element information in FIG. 2 or FIG. Explained the example of creating. This is a technique introduced for the purpose of applying a large computer load to prime factorization of indirect element keys. Therefore, the registration of element information in the database 410 is very computationally intensive, and a large amount of information is stored at one time. It becomes a difficult system to register. In view of this, in the second embodiment, a method for creating an element key on the assumption that an element key to be assigned to element information is subjected to prime factorization on the indirect element key will be described.

  As shown in FIGS. 5 and 6, consider a process of dividing the original information of the table structure of M rows and L columns into N pieces of element information and assigning element keys composed of natural numbers to the respective element information. An integer R satisfying 1 * 10R ≧ M is set as the number of natural digits assigned as an element key. For example, if M = 1000, R is an integer of 3 or more.

  It is assumed that an element key has already been assigned by the database management system 420 to the element information of the original information from item number 1 to item number (m−1) in FIG. Consider the case of assigning a key. The database management system 420 selects an appropriate prime number from a so-called prime number table as shown in FIG. 12 and internally multiplies them to obtain a Q-digit number Am. At this time, the database management system 420 adds a prime number if Q ≦ R * (N−1), and removes one of the prime numbers selected first if Q> R * N. The database management system 420 continues this operation until P * N ≧ Q> R * (N−1). Hereinafter, for simplicity, it is assumed that Q = R * N (in the case of Q <R * N, (R * N−Q) “0” s are arranged on the most significant digit of the obtained number Am. Apparently, it may be R × N digits.) It is assumed that the finally obtained number Am is “a1, ma2, m... ANR, m”. This number is divided into P digits, and N "a1, ma2, m ... aR, m", "aR + 1, maR + 2, m ... a2R, m", ..., "aR (N −1) +1, m... ANP, m ”, each of which is used as an element key of N element information of confidential information of item number m. However, this element key is made different from the corresponding element key of item number 1 to item number (m−1) determined before that. If there is an element key that is the same as the previously determined element key, start over from the stage of selecting a prime number. If the minimum value of R that satisfies 1 × 10R ≧ M is R0 in order to increase the degree of freedom for selecting a prime number in the above process, the number of digits R assigned as an element key is preferably R0 + 1 or more.

  Assuming that Am satisfying the conditions is obtained in this way, the database management system 420 next selects Pm as a prime number larger than the prime number used to obtain this number Am, and further calculates a function F (Pm) of some Pm, A number Bm obtained by multiplying Am by Pm and F (Pm), that is, Bm = Am * Pm * F (Pm) is used as an indirect element key.

  A more specific embodiment will be described assuming a scene in which element keys are assigned to element information of the original information 101 shown in FIG. As in FIG. 2, the element information is divided into four pieces of element information including member information, name information, address information, and telephone number information. For simplicity, if the number of members is less than 100, the element key can be identified by using a maximum of 2 digits. However, in order to increase the degree of freedom to select prime numbers, the maximum number of elements is used here. Use three-digit numbers.

  The database management system 420 first creates an element key of item number 1 of the original information 101. For example, “2, 2, 2, 7, 17, 29, 73, 101, 1481” is selected as a prime number and all are multiplied to obtain a 12-digit number “30146315154104”. The 12-digit number “30146315154104” is set to X1 for simplicity. The database management system 420 obtains “301”, “463”, “155”, and “404” by dividing X1 into three digits. Let these be a1, b1, c1, and d1, respectively. Let a1, b1, c1, and d1 be the element keys of the four element information corresponding to item number 1 of the original information 101. Furthermore, it is clear from the method of creating X1 that the maximum prime number obtained by prime factorizing X1 is “1481”. If the prime number table 1201 is used, “1483” can be selected as a prime number P1 larger than “1481”. If F (Pm) is a function that takes the sum of each digit of Pm, F (P1) = 1 + 4 + 8 + 3 = 16 is obtained. Therefore, B1 = A1 * “1483” * “16” = “71515317720597712” is obtained. If the member number assigned to the indirect element key is the member number in the first column, it is set as the indirect element key W11 corresponding to the member number of item number 1.

  Next, the database management system 420 selects an element key of element information of item number 2 of the original information. Specifically, the database management system 420 selects a prime number “3, 7, 23, 23, 97, 311, 619” from the prime number table 1201 and multiplies them to obtain a 12-digit number “2074442500657”. (= X2) is obtained. Accordingly, a2 = “207”, b2 = “442”, c2 = “500”, and d2 = “657” are obtained as four element keys, and since a2 ≠ a1, b2 ≠ b1, c2 ≠ c1, and d2 ≠ d1. , (A2, b2, c2, d2) can be adopted as new element keys. The database management system 420 further refers to the prime table, so that the next largest prime P2 after the prime 619 is “631” and F (P2) = 10, so that W2, 1 = X2 * P2 * F (P2 ) = “1308962179145670”.

  Next, the database management system 420 assigns the element key to the element information of item number 3, for example, “2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2,3,3,3,5,79,167 "is selected. The database management system 420 multiplies all of them and obtains “301462179840” as a candidate for X3. Subsequently, the database management system 420 divides this into three digits and obtains a3 = “301”, b3 = “462”, c3 = “179”, and d3 = “840” as element key candidates. . Here, when compared with the element keys obtained so far, it is understood that “3014621979840” cannot be adopted as X3 since a3 = a1. Therefore, the database management system 420 starts over from the process of selecting a prime number and selects another prime number pair.

  FIG. 13 shows “a set of prime numbers” and Xm, Pm, F (Pm), and Wm, 1 obtained by repeating the above operation. Further, FIG. 14 shows a numeric string obtained by dividing Xm into three digits, and FIG. 15 shows the result of associating the divided numeric strings shown in FIG. Here, the indirect element key of the membership number key has already been calculated in the process of obtaining each element key as Wm, 1. For element information other than membership number, name / address / telephone number, as shown in FIG. 15, b1, c1 and d1 obtained above are element keys. The factoring method is also applied to this element key. Thus, it is preferable that each element key is replaced with an indirect element key so that one end of load control of the matching process is performed. As a result of the prime factorization of the element key Xm, n corresponding to the name, address and telephone number shown in FIG. 15 in FIG. 16, a prime number Pm larger than the prime number obtained by the prime factorization (here, a prime number of 1000 or more is selected). F (Pm) that is a function of Pm (here, the number of each digit of Pm added), and Wm, n multiplied by them are selected. Show.

FIG. 17 shows the indirect element key obtained above added to the corresponding element information. In the distributed management system of this embodiment, the element information shown in FIG. 17 is distributed and stored in, for example, the database 410 of the information management system in FIG. A method for extracting certain information from the distributedly managed database 410 may be the same as in the first embodiment, or other methods may be employed.
(Example 3)

  Next, a method using a function having a long period will be described as another preferred embodiment of load control in the matching process when a so-called connection table is not used. A function having a long period is a function that takes a natural number as input and output, and is a function that outputs P when applied K times to an arbitrary natural number P having a maximum value of N at most. At this time, K represents the period of the function, and in order to increase the calculation time of the matching process, it is desirable that K is a very large number.

  As a function having a long period, a function in which operations for generating pseudo-random numbers are combined into a function is known. Specific examples include linear congruential methods (also called mixed congruential methods), multiplication type congruential recurrence formulas, recurrence formulas that generate M-sequence pseudo-random numbers, etc. The present invention generates random numbers. However, it is only necessary that different numbers are generated one after another from a certain number. Here, such periodic functions are collectively referred to as a slide function. For example, in the recursion formula Xn = aXn−1 (mod M) of the multiplication congruential method, if a = 16807 and M = 231−1 = 22147483647, the period K may be K = M−1 = 22147483646. Are known.

  A method for generating an element key using such a slide function is as follows. The element key is any natural number from 1 to N, and this is set as Y. Further, it is assumed that the period of the slide function is K. Here, an appropriately selected natural number less than K is referred to as a slide number Sα (α = 1, 2, 3,..., R−1). When the slide function is applied Sα times to Y, some natural number from 1 to N is obtained. This is referred to as the number of Y slides or the number of slides.

  Here, consider a process in which there is one set of R data values and this set is divided and element keys are assigned to the individual data values. At this time, an appropriately selected natural number from 1 to N is referred to as a representative element key for this set. Among different sets, representative element keys must be chosen so that there is no overlap. Next, the S1 number of slides of the representative element key is referred to as a primary element key. Further, the number of S2 slides of the primary element key is referred to as a secondary element key. Similarly, the SR-1 next slide number of the (R-2) next element key is referred to as an R-1 primary element key. The 1st to R-1 primary element keys are generally referred to as subordinate element keys. In this manner, the representative element key and R-1 subordinate element keys that are derived from the representative element key can be determined.

  A total of R keys including the determined representative element key and subordinate element key are adopted as element keys for each of the R data values forming the set. However, the target column to which the representative element key is associated is determined in advance. For example, in the original information shown in FIG. 1, it is determined that the element key of the member number is always the representative element key.

Here, if the original information shown in FIG. 1 is divided into three pieces of element information as shown in FIG. Describe specifically whether to give the key. In order to explain the embodiment in an easy-to-understand manner, it is assumed that the following formula (1) is adopted as a specific recurrence formula although it is not a very long period.
Xn = 7Xn-1 (mod 47) (1)
The period of this function is K = 23, and the N is N = 46.

  Assume that the member number key in FIG. This means that the initial value X0 is set to 1, 2, 3, 4, 5, 6, 7 respectively in the above recurrence formula. The primary element key is a name key and the number of slides is 9 times, the secondary element key is an address key and the number of slides is 10 times, and the tertiary element key is a telephone number key and the number of slides is 2 times. The reason why the number of slides of the address key is 10 and the number of slides of the name key and the telephone number key is 2 and there is a large difference is that confidentiality is taken into consideration. That is, the relationship between the membership number and the name and the relationship between the address and the telephone number are low in confidentiality, so the number of slides is small, and the relationship between the name and address is high in confidentiality, so the number of slides is large.

  The slide function applied here has periodicity, and in the case of the above formula (2), the period is 23, so the two-time slide of the telephone number key becomes the member number key. Therefore, the 11th slide number of the telephone number key is a name key. FIG. 19 schematically shows such a relationship. As apparent from FIG. 19, the relationship between the name key, the address key, and the telephone number key is far away in consideration of the periodicity of the slide function. Thus, in selecting the number of slides, it is important that the number of slides between highly confidential element information is as large as possible in consideration of the periodicity of the slide function. In the recurrence formula, the member number key is X0, the name key is X2, the address key is X12, and the telephone number key is X14. The recurrence period is 23, so X25 = X2. If X14, that is, the telephone number key is slid 11 times, X26, that is, the name key X2 can be obtained. In FIG. 19, the value of Xn (n is 1 to 23) of the above recurrence formula is calculated for the initial value X0 = 1 to 7. The shaded lines are initial values X0 (member number key), X2 (name key), X12 (address key) and X14 (phone number key).

  FIG. 20 shows each element key inserted in the original information of FIG. 1 based on the calculation result of FIG. Further, based on FIG. 20, the element information to which the element key is added is divided, and the element information having the smaller number of element keys is arranged in FIG. As described above, since the order of the element information is changed, the correlation between the element information is not known, and information that makes sense unless the relationship is calculated using the formula of Xn = 7Xn-1 (mod 47). It will not be.

  Hereinafter, how to realize the matching process from the element key to the element key will be described with reference to FIG. Here, the representative key is the member number key, the member key that has been slid nine times is the name key, the member that has been further slid the name key ten times is the address key, and the address key is further slid two times. It is assumed that the phone number key is used and the recurrence formula (2), that is, Xn = 7Xn-1 (mod 47) is used as a function, and the period is 23.

  When the system user 400 wants to know the address telephone number of the name “Tabe Aichi” and the member number, the system user 400 inputs that fact to the application system 430, and the application system 430 sends the information to the database management system 420. The corresponding process is executed. Specifically, in the database management system 420, the access control unit 422 first accesses the element information 2102 and picks up the name key “25” of Taichi Abe. Since the address telephone number key is obtained by sliding the name key 10 times, the database management system 420 first sets X0 = 25, obtains X1 = 34 using the recurrence formula of equation (2), and then X2 = 3 is obtained by using X1 = 34, and this is repeated to determine X10 = 1. This is the desired address key. After determining the address key, the database management system 420 accesses the element information 2103 and picks up the address “Mito City, Ibaraki Prefecture”. Since the database management system 420 knows that the number of slides of the address key twice is a telephone number, X0 = 1 is substituted into the recurrence formula of the formula (2), and X1 = 7. X2 = 2 is obtained, and it is determined that the telephone number key is “2”. The database management system 420 accesses the element information 2104 and picks up that the telephone number with the telephone number key “2” is “□□□□□□□□□□”. The database management system 420 then calculates the member number key by using the recurrence formula (2) because the member number key is the number of slides of the telephone number key twice in order to obtain the member number key. The database management system 420 accesses the element information 2101 and picks up the member number “0004”.

  In the above description, the member number key is obtained from the telephone number key by using the slide function, but it can also be obtained from the name key.

  In general, the recurrence formula Xn = aXn-1 (mod M) means that when Xn-1 is multiplied by a and divided by M, the remainder is Xn. Therefore, if the quotient when aXn-1 is divided by M is bn-1, (M * bn-1 + Xn) should be divisible by a. Here, the integer b is 0 ≦ bn−1 <a. If this bn-1 is used, Xn-1 can be obtained by Xn-1 = (M * bn-1 + Xn) / a. This corresponds to obtaining an inverse function of the slide function.

  Using the above, try to find the member number key from the name key. In the specific example, since the recurrence formula (1) is used, a = 7 and M = 47. Since the name key of “Tabe Abe” is “25”, (47b8 + 25) is divisible by 7, and the database management system 420 can calculate that b8 = 2. Therefore, the database management system 420 can also calculate X8 = (47 × 2 + 25) ÷ 7 = 17. The database management system 420 then gets (7b7 + 17) divisible by 7, so b7 = 5 and thus X7 = (47 × 5 + 17) ÷ 7 = 36. By repeating this operation, the database management system 420 calculates X6 = 32, X5 = 18,..., X1 = 28, and finally X0 = 4, that is, the member number key is “4”. Can be determined. Of course, this is the same as that obtained by sliding twice from the telephone number key.

  As described in detail in the third embodiment, it is necessary to apply the slide function many times to perform meaningful processing and extract meaningful information. In the above specific example, it is necessary to apply the recurrence formula (2) which is a slide function at least 10 times. In this specific example, a slide function with a period of 23 is used. However, the period is long, and for example, a recurrence formula Xn = aXn−1 (mod M) of a multiplication type congruence method often used for random number generation, a = 630360016, M = 231-1, the period is 231-2 = 2147483646, the slide calculation becomes enormous, and computer resources can be greatly consumed in the matching process.

In the third embodiment, the selection of the slide function plays an important role. In the above specific example, the function (recurrence formula) used in the random number generation program called the multiplication type congruential method is used as the slide function. However, for the purpose of the present invention, the necessary properties as the slide function are as follows. ,
(1) When a natural number is input, the natural number is output.
(2) The same number does not appear in the cycle,
(3) The original number cannot be easily predicted.
The three points.

The random number generation function is suitable as a function that satisfies the property (3). Among them, one of the functions suitable as a function having all the above three properties is a recurrence formula used in the random number multiplication congruent method shown in the second embodiment.
Xn = aXn−1 (mod M) where a ≦ M
It becomes. If you choose M and a well, the sequence obtained by this formula is a sequence that is said to be pseudo-random, and it is difficult to predict what will come next, and the cycle is at most M-1 and within the cycle The number Xn appearing in is any number from 1 to M-1, and when n ≠ m, Xn ≠ Xm, that is, the same number does not appear.

Another preferred function is a recurrence formula of a linear congruence method (also referred to as a mixed congruence method) often used for the same random number generation algorithm. Xn = aXn-1 + c (mod MM) where a, c ≦ M
It is.
(1) c and M are relatively prime,
(2) a-1 can be divided by all the prime factors of M.
(3) If M is a multiple of 4, a-1 is also a multiple of 4.
It is known that the period becomes M if all the three conditions are satisfied.
In this case, all the numbers 0 to M-1 appear only once in the sequence {Xn}. As long as the above conditions are satisfied, the period becomes M, and in principle, any number of long-period sequences can be created.

  Even if any one of the first embodiment, the second embodiment, and the third embodiment is used, the time calculation amount set at the time of determining the element key cannot be reduced without changing the element key. In addition, when changing the element key, a calculation corresponding to the matching process is required in order to check how the element key is paired with other element keys. That is, the calculation load cannot be reduced by a malicious third party.

  Note that the realization of the abutment mechanism by the methods shown in the first, second, and third embodiments has a configuration as a software program in mind, but a physical device having an equivalent function (for example, a hardware as an integrated circuit) A hardware-implemented arithmetic circuit) or a service that can be used through a network is also an embodiment of the present invention.

  Next, an embodiment in which a linked table is created in accordance with data division will be described. Prior to that, terms such as an indirect element key, a conversion mechanism, an indirect reference process, and an indirectly linked table are defined. The indirect element key is a unique identification code assigned to each element key. However, in order to achieve the object of the present invention, it is necessary to select an identification code to be an indirect element key so that the value of the element key that is the grant destination cannot be easily inferred. The conversion mechanism 2201 shown in FIG. 22 is a mechanism that converts a certain element key into an indirect element key that is an identification code thereof. Considering the nature of element keys, element keys and indirect element keys must have a one-to-one correspondence. A mechanism for identifying an element key from an indirect element key is called a reverse conversion mechanism. In the following, for the sake of simplicity, it is assumed that the conversion mechanism also serves as the reverse conversion mechanism as an apparatus, but this may be realized as an independent apparatus. The process of determining the element key from the indirect element key through the conversion mechanism 2201 and the process of determining the indirect element key from the element key are both referred to as an indirect reference process. A table obtained by replacing an element key of a linked table with an indirect element key is called an indirect linked table.

When the indirect connection table is used, it is the element key that is stored in pairs with the element information. However, instead of the indirect connection table, the connection table is stored and the information stored in pairs with the element information is the indirect element key. It is also good. In any case, the matching process between the distributedly managed element information includes indirect reference process for determining the indirect element key from the element key and indirect reference process for determining the element key from the indirect element key. By intentionally increasing the processing load, the number of matching processes that can be executed per unit time can be limited. Hereinafter, a method for increasing the load of the indirect reference process will be described in detail based on an embodiment.
Example 4

  A first preferred embodiment of a method for intentionally increasing the load of indirect reference processing by a method for generating an indirect element key from an element key is a method using prime factorization.

The prime factorization method used here is the method used in the first embodiment. In the first embodiment, a new number Zm is obtained by using the prime factorization method for Ym which is a function of the element key. Here, the indirect element key is obtained by applying the prime factorization method to the element key itself. The essence is the same for prime factorization, with only differences. Therefore, what was supplementarily described in the first embodiment is also applied here, and the idea of the second embodiment in which a number generated from multiplication of prime numbers is used in consideration of the registration work is also applied as it is.
(Example 5)

  A second preferred embodiment of a method for intentionally increasing the load of indirect reference processing by a method for generating an indirect element key from an element key is a method using a random number sequence.

  The possible values of the element key are natural numbers from 1 to N. The element key itself may be assigned by the database management system 420 as described above. Further, a random number sequence obtained by arranging natural numbers from 1 to N in a line and randomly changing the order of arrangement is created. An example of the random number sequence obtained in this way is shown in FIG. This random number sequence creates an indirect element key based on the element key. In the present embodiment, for an element key whose value is K, the value Q at the Kth position of this random number sequence is used as the indirect element key. Save the created indirect element key in the indirect reference table. At this time, the random number sequence used here is also stored in a separate appropriate storage device (for example, the database 410). These operations are realized by the conversion mechanism 2201. In the example of FIG. 23, when the conversion mechanism 2201 creates an indirect element key corresponding to an element key having a value of 5, the value that is the fifth from the left in the random number sequence is 23. Therefore, the indirect element key is created by selecting “23”. Conversely, the element key K can be created from the indirect element key Q. In this case, the natural number Q is searched from the random number sequence on the storage device, and the found position may be used as the element key K. In the example of FIG. 23, since the value 23 included in the random number sequence is located fifth from the left, the value of the element key corresponding to the indirect element key whose value is 23 is 5. The conversion mechanism 2201 executes the conversion process between the element key and the indirect element key according to the above method.

In the above, for the element key having the value K, the value Q at the Kth position in the random number sequence is used as the indirect element key, but the position with the value K in the random number sequence is the random number sequence. When in the Rth position, the indirect element key may be R. In either case, since the association between the element key and the indirect element key depends only on the randomly determined random number sequence, the element key cannot be determined only from the indirect element key without referring to the random number sequence. If a random number sequence is made sufficiently large (for example, all random numbers are 2 digits or more) and stored in a relatively low-speed external storage device such as a hard disk, such a search is extremely large. It takes a lot of time calculation.
(Example 6)

  A third preferred embodiment of a method for intentionally increasing the load of indirect reference processing by a method for generating an indirect element key from an element key is a method using repetitive reference of a random number sequence.

  As in the case of the fifth embodiment, the possible value of the element key is a natural number from 1 to N. The element key itself may be assigned by the database management system 420 as described above. Further, a random number sequence obtained by arranging natural numbers from 1 to N in a line and changing the arrangement order at random is created. This random number sequence may be, for example, the random number sequence of FIG. 23 shown in the fifth embodiment, and the process of specifying a value at the Pth position of this random number sequence is referred to as P point selection. The random number sequence includes only values from 1 to N. Therefore, regardless of the value of P, the number of values determined by P point selection is always 1 to N. In the example of FIG. 23, since the value at the fourth position from the left of the random number sequence is 7, the value specified by the 4-point selection is 7. The conversion mechanism 2201 executes such a selection process.

  When the value of the element key is K, a value obtained by selecting the K point is referred to as a primary element key, and this value is set as K1. Next, a value obtained by the K1 point selection executed by the conversion mechanism 2201 is referred to as a secondary element key, and this value is set as K2. Similarly, the selection by the conversion mechanism 2201 is repeated, and the obtained n-th key is set to Kn. A set of the n-th order key Kn and the number of repetitions n is used as an indirect element key. As in the fifth embodiment, when storing the indirect element key in the indirect concatenation table, the random number sequence used here is also stored in a separate appropriate storage device. In the example of FIG. 23, when the value of the element key is 4, the value of 4-point selection is 7, so K1 is 7. Since the 7-point selection value is 3, K2 is 3. Since the value of the three-point selection is 5, K3 is 5.

  In order to determine the element key K from the n-th indirect element key Kn, the conversion mechanism 2201 searches for a natural number Kn from a random number sequence on the storage device, subtracts n by 1 when the value is found, and finds the discovery position. Is Kn-1. Thereafter, the conversion mechanism 2201 repeats this search. When K1 is searched from the random number sequence and the discovery position is determined, the discovery position becomes the element key K. The flow of this process is shown in FIG. In the example of FIG. 23, when the third-order indirect element key K3 is 5, the value at the third position from the left of the random number sequence is 5, so the position where K3 is found by the conversion mechanism 2201 is 3. This is the value of K2. Similarly, since the value at the seventh position from the left of the random number sequence is 3, the discovery position of K2 by the conversion mechanism 2201 is 7, which is the value of K1. Again, since the value at the fourth position from the left in the random number sequence is 7, the discovery position of K1 by the conversion mechanism 2201 is 4, which is the value of K. By the processing by the conversion mechanism 2201 described above, it is determined that the value of the element key K is 4. In accordance with the above method, a conversion mechanism 2201 is provided with a conversion process between an element key and an indirect element key.

The number of iterations n can be set freely, and the amount of time calculation increases as n increases. In the load control using the random number sequence described in the previous section, the load is controlled by increasing the random number sequence. In the load control using the repetitive reference of the random number sequence, the load is controlled by increasing the number of iterations n. For this reason, it is not always necessary to use a large random number sequence, and it becomes relatively easy to configure the conversion mechanism as, for example, a dedicated physical arithmetic device without using an external storage device.
It is also conceivable that a plurality of random number sequences are prepared and switched depending on the number of iterations.
(Example 7)

  A fourth preferred embodiment of the method for intentionally increasing the load of the indirect reference processing by the method of generating the indirect element key from the element key is a method using the length of the element key.

  Any element key may be used as long as element information can be uniquely identified. Therefore, for each element information, the database management system 420 selects a unique and extremely long character string selected at random as an element key. Assume that there are N element keys, and the values are X1 to XN. Similarly, the conversion mechanism arranges randomly selected unique and extremely long N character strings in a suitable order, and sets Y1 to YN in the arranged order. Based on the above preparation, k = 1 to N, and Yk is determined as an indirect element key for the element key Xk. A key dictionary is a combination of element key Xk and indirect element key Yk. The conversion mechanism creates an indirect element key from the element key by referring to the key dictionary based on the element key Xk and picking up the corresponding indirect element key Yk. FIG. 25 shows an example of a key dictionary when N = 5, the length of the element key is 12, and the length of the indirect element key is 16. In this example, the length of the indirect element key is larger than the element key, but the element key may be longer than the indirect element key, or the lengths of both may be equal. In addition to the indirect linkage table, the key dictionary used here is also stored separately in an appropriate storage device.

  In order to determine an element key from an indirect element key whose value is K, a set whose indirect element key value is K is searched from the key dictionary, and a paired value is used as an element key. In the example of FIG. 25, when the value of the indirect element key Y5 is “5Efah3fpl89GB69ww”, the corresponding value on the key dictionary is “V5gya55pxKWq”. Therefore, the value of the corresponding element key X5 is “V5gya55pxKWq”. In accordance with the above method, a conversion mechanism that implements conversion processing between an element key and an indirect element key is a conversion mechanism.

  Since load control by this method is applied not to the limit of time calculation amount but to the limit of network capacity, as an example, element information and a key dictionary are arranged on different physical devices as a set. It is preferable. Of course, the element information and the key dictionary may not be paired but may be arranged on different physical devices.

  As shown in FIG. 26, element information 2611 and element information 2612 divided into two parts, a key dictionary 2621 and a key dictionary 2622 corresponding to each element information, and a storage device that stores the element information and the key dictionary as a set. 2601 and a storage device 2602, a computer 2631 and a computer 2632 including a storage device 2601 and a storage device 2602, a storage device 2603 including an indirect linkage table 2613, and a computer 2633 including a storage device 2603, and in addition, It is assumed that the conversion mechanism 2604 is mounted on another computer 2634.

  Here, the element key indirect reference process corresponding to the indirect element key is executed in the conversion mechanism. The indirect linkage table 2613 exists only on the storage device 2633, and the key dictionary 2621 or the key dictionary 2622 including the indirect element key exists in either the storage device 2601 or the storage device 2602, and is different from the conversion mechanism 2604. Exists on the device. Therefore, in executing the indirect reference process, the information of the indirect element key and the key dictionary must be transferred to the computer 2634 having the conversion mechanism via the network.

  If the element key or the indirect element key is a sufficiently long character string, the range of the key dictionary that can be transferred per unit time is limited by the network capacity. That is, as the element key or indirect element key becomes longer, the network capacity consumed per unit time increases, and the number of executable indirect reference processes decreases. In the example of FIG. 26, if the network capacity on the communication path 2605 is equivalent to 1000 characters per second and both the element key and indirect element key values have a length of 10,000 characters, they are included in the key dictionary. It takes at least 20 seconds to transfer one set of indirect element key values with the element key to be transferred from the storage devices 2601 and 2602 to the computer 2634 having the conversion mechanism. If the value of the element key and the indirect element key is expressed by a longer character string, this time becomes longer.

  In FIG. 26 and the above description, the element information and the key dictionary are stored in the storage device as a set. Of course, the element information and the key dictionary may be arranged on different physical devices without being combined. A plurality of key dictionaries may be collected and stored in one storage device. The essence of the present invention is that the conversion mechanism is placed in a device that is physically separate from the computer having the key dictionary and the storage device for storing the element information so that long data flows through the network communication path.

  In addition, although the implementation of the conversion mechanism by the method exemplified above has a configuration as a software program in mind, a physical device having an equivalent function (for example, an arithmetic circuit implemented in hardware as an integrated circuit), a network A case where the service is configured as a service that can be used through the network is also an embodiment of the present invention.

The element key and the indirect element key may be generated by a conversion mechanism. For example, if a long element key and an indirect element key are placed in the computer 2634 in FIG. In 2605, a long element key and an indirect element key flow. Therefore, when recording confidential information, network capacity is limited, and it takes a long time to record a large amount of confidential information. In view of this, the element key and indirect element key generation mechanism is preferably arranged in a storage device that stores the key dictionary. A specific example of a long element key and indirect element key generation mechanism is shown in an eighth embodiment.
(Example 8)

In the seventh embodiment, the long element key and the indirect element key are written on the assumption that the alphanumeric characters are randomly arranged. Here, the generation of the long element key and the indirect element key by the multiplication congruential method is described. State the law. In this embodiment, the following recurrence formula (2)
Xn = aXn−1 (mod M) (2)
use. If there is a relationship between a and M, the maximum random number period that can be generated is M-1. Here, the period is S. The feature of this function is that the integers that can be taken as initial values are X0 = 1, 2,..., M−1, and their numerical sequences are all different.

From the random number sequence {Xn} generated by the recurrence formula (2),
Um = XS-1 * 10α × (S-1) + XS-2 * 10α × (S-2) +... + X1 * 10α + X0
Produces a number. Here, α is the number of digits of the number “M−1”. At this time, the number of digits of Um is α × S. For example, if M is 106 + 1 and the period is 106, α is “6”, so the number of Um digits is 6 × 10 6, which is a huge 6 million digits. The number of digits of Um can be adjusted considerably by S, and S is determined by how to select a and M. Therefore, if the recurrence formula (3) is selected well, the number of the desired number of digits can be obtained. The generation mechanism thus applies the numbers generated using two different recurrence formulas to the element key and the indirect element key, respectively. As described above, the generation mechanism can create a long element key and an indirect element key by a simple calculation using the recurrence formula. Moreover, if the initial value is changed, another element key and indirect element key of the same digit can be obtained, which is convenient for application to the seventh embodiment.
Example 9

  Next, when the original information is data having a table structure of M rows and L columns as shown in FIG. 5 and divided into N pieces of element information as shown in FIG. An embodiment suitable for finely controlling the load of the matching process will be described.

There are a total of (N × (N−1)) ÷ 2 sets of arbitrary two pieces of element information of the N pieces of element information that are divided and managed. In this embodiment, instead of creating and storing a single linked table, an indirect linked table 2613 consisting of two columns corresponding to all the above N (N−1) ÷ 2 groups is created. It is created and stored in the computer C2633. For example, consider a case where element information given element keys as shown in FIG. In this case, there are six pairs of any two element information, that is, a member number / name pair, a member number / address pair, a member number / phone number pair, a name / address pair, a name / phone number pair. A set, a set of address and phone number. In the original information 101, if the confidential information as the confidential information is name information, the element key is Y, and prime numbers larger than all the prime factors obtained by the prime factorization are U1, U2, U3, And U4 (where U1 <U2 <U3 <U4) and the function of each prime number is F (Un), the generation of the indirect element key Z for calibrating the indirect concatenation table follows the following rules: And
(1) When generating an indirect element key that constitutes an indirect linkage table of member number and name,
Z = Y * U1 * U2 * U3 * F (U3)
(2) When generating an indirect element key that constitutes an indirect linkage table of name and address and name and phone number,
Z = Y * U1 * U2 * U3 * U4 * F (U4)
(3) When generating an indirect element key that constitutes an indirect link table of member number and address number, member number and phone number, and address and phone number,
Z = Y * U1 * F (U1)

In this way, it takes a long time to acquire the information associated with the name information, and it is preferable from the viewpoint of protecting the confidential information because it takes a relatively short time to acquire information unrelated to the name. In addition, even if they are related to the same name information, there is a fine detail that makes a little difference between relatively less sensitive information such as names and membership numbers and more sensitive information such as names and addresses or telephone numbers. Is possible. FIG. 27 collectively shows numerical values necessary for generating the indirect element key Zm, n from the element key Ym, n by applying the above rule to the element information and element key shown in FIG. is there. Even with indirect element keys of the same element information, different sets of indirect element keys have different values by changing the selection of prime numbers. By doing so, fine weighting is possible according to the confidentiality of each set. FIG. 28 shows six linked tables created based on the calculation results of FIG.
(Example 10)

  In Example 9 above, an indirect linkage table is provided for every two-column set, but in consideration of the relevance and confidentiality of the element information, a partial set of three element information and four element information sets An indirect linkage table may be provided. For example, for the element information of FIG. 2, the member number, address and telephone number are made into one indirect linkage table, and the indirect element key using the element decomposition method is generated according to the rule (3) of the ninth embodiment. In addition, even if the member number and the name are made into one indirect linkage table and the indirect element key generation using the element decomposition method is generated according to the rule (1) of the ninth embodiment, the confidentiality weighting is performed in the ninth embodiment. It is possible to obtain the same effect as creating an indirect linkage table for all two element information combinations. FIG. 29 shows the indirect linkage table created in this way. A table 2901 in FIG. 29 is an indirect connection table of names and membership numbers using the indirect element key obtained in the table 2703. A table 2902 in FIG. 29 shows three element information of the member number, address, and telephone number using the indirect element key of the member number and address obtained in Table 2704 and the indirect element key of the telephone number obtained in Table 2705. It is an indirect linkage table. In this case, when trying to know the relationship between an address and / or a telephone number and a name, information is always acquired via the member number.

In the ninth and tenth embodiments, the indirect element key generation method uses the prime factorization method as in the first, second, and fourth embodiments, but the indirect element key generation method is limited to this. The method using the slide function having a long period shown in the third embodiment, the method using the random number sequence shown in the fifth embodiment, the method using the repeated reference of the random number sequence shown in the sixth embodiment, Alternatively, even when the indirect element key is generated by another method such as the method using the element key length shown in the seventh embodiment, it is an aspect of the present invention.
(Example 11)

  Next, a load control method suitable for a case where the original information is tree-structured data and data values are associated with the nodes will be described. FIG. 30 shows a data structure of a tree structure. Since it has a tree structure, there is only one node as a root, and a unique number such as a serial number for all the nodes 3011, 3012, 3013, 3014, 3015, and 3016 by using, for example, breadth-first search with the root as a base point Can be assigned. This serial number assigned to each node is referred to as a node number, and its value is a natural number from 1 to N. Normally, a natural number 1 is assigned to the root node 3011, and numbers are assigned as 2, 3, 4, 5 in accordance with the child node and grandchild node. FIG. 31 shows an example of such assignment.

  Table-structured data representing element information can be constructed from tree-structured data with node numbers assigned as follows. Data is arranged in the order of the node numbers, and as shown in FIG. 32, a two-column table consisting of pairs of node numbers and data is formed. At this time, the node number is kept unique, and the node number can be used as an element key. Therefore, the two-column table shown in FIG. 32 is a linked table of tree structure data.

  The method of constructing the indirect connection table from the connection table shown in FIG. 32 is as follows. In the present embodiment, since it is known that the element keys are 1 to N, the indirect element key corresponding to the element key can be determined by a method using a slide function, for example. A table of N rows and 2 columns obtained by replacing all the element keys included in the concatenation table of FIG. 32 with the corresponding indirect element keys using the indirect element keys obtained in this way becomes an indirect concatenation table. .

For example, as the slide function, the recurrence formula (1) of the multiplication congruence method used in the third embodiment, that is,
Xn = 7Xn-1 (mod 47)
, When the element key is slid 12 times, that is, when X0 is an element key and X12 is an indirect element key, referring to FIG. 19, (X0, X12) = (“1”, “17 ”), (“ 2 ”,“ 34 ”), (“ 3 ”,“ 4 ”), (“ 4 ”,“ 21 ”), (“ 5 ”,“ 38 ”), (“ 6 ”,“ 8 ” "), (" 7 "," 25 "). In parentheses, for example, (“1”, “17”) means that X12 = “17” when X0 = “1”. In order to obtain the element key from the indirect element key, since the cycle of this slide function is 24, if the indirect element key is slid 11 times, that is, X23 may be obtained by applying the expression (1) 11 times. FIG. 33 shows a case where all the element key values in the linked table of FIG. 32 are replaced with indirect element key values and rearranged in ascending order.

  When the original information is data having a tree structure, what is stored in the storage device is the one in which natural numbers are assigned to the nodes of the tree structure in FIG. 30 and the indirect connection table in FIG. For example, it is assumed that there is a request from a user of this data management system to know how many parts Ichiro Takahashi belongs to. First, the database management system accesses the information in the indirect linkage table shown in FIG. 33 and picks up that the indirect element key of Ichiro Takahashi is “8”. Next, assuming that X0 = “8”, the recurrence formula (1) is applied 11 times, and it can be seen that X11 = “6”. It can be seen that the information of the linked table shown in FIG. Therefore, if X0 = “3” and the recurrence formula (1) is applied 12 times, X12 = “4” is obtained. This is the indirect element key of the department. Subsequently, by accessing the information in the indirect linkage table of FIG. 33, it is found that the indirect element key “4” corresponds to the general affairs department, and Mr. Ichiro Takahashi informs the system user that he belongs to the general affairs department. Can be reported.

  As shown in the above embodiment, when making an indirect concatenation table using a slide function, it is possible to facilitate a slide function with a long period, and if the number of slides is increased, the load of the matching process can be increased. The number of possible matching processes per unit time can be reduced.

  In addition, by generalizing the tree structure example, even if data is connected to nodes in a general graph structure, if a unique number that is an element key is assigned to the nodes by an appropriate method, it can be implemented As shown in Example 9, an indirect linkage table can be generated using a slide function or the like, and the load of the matching process can be increased.

What has been described above is an example of the configuration of the linked table, element information, and indirect linked table. Even when configured by other methods, the following is an embodiment of the present invention as long as the following is satisfied.
(1) Element information consists of numbered elements obtained by dividing the original information into small pieces that do not make sense on their own and assigning element keys that identify individual elements contained in the small pieces. ,
(2) Supplementary information that can restore original information by combining with element information, and a data set composed of element keys is a linked table,
(3) An element code can be determined by passing through a conversion mechanism whose conversion load is controlled, but an identification code that cannot determine an element key from its own value is an indirect element key.
(4) Supplemental information that can restore original information by combining with element information, and a data set including indirect element keys is an indirect reference table.

So far, various methods for limiting the number of butt processes that can be performed per unit time by increasing the load control of the butt process, that is, the load of the butt process, have been described using the embodiments. Here, how to use these load controls in normal business will be described according to the following embodiment.
(Example 12)

  Various load control methods can be considered in addition to the methods described so far, but in any case, a common problem is that a large amount of leakage occurs by increasing the conversion load of indirect reference processing associated with concatenation processing. The corresponding large amount of data transfer is intended to lead to depletion of computer resources of the information system. On the other hand, in order to be able to use the information system in a normal range, it is required to exhibit a certain processing performance required in the usage context of the information system.

  For example, if the average number of personal information referred to in normal business is 100 per second, a concatenation process of about 100 per second must be executed without causing depletion of computer resources. Don't be. A load of the reconciliation process set so as to match the required number of connected processes per unit time by calculating backward from the usage requirements of the system is referred to as a reference load.

  The usage status of information systems usually varies with time. For example, it is assumed that confidential information is frequently accessed during normal work during the day, and the amount of access decreases at night. Such a situation can be dealt with by switching the reference load according to the time zone. That is, by adopting a low standard load during the daytime, the number of connection processes possible per unit time is increased, and by adopting a high standard load at night, the number of connection processes is also reduced.

  Generally speaking, it is possible to implement an arithmetic process that consumes only computation time and has no other side effects. A typical method is an empty loop process that repeats a predetermined number of times without performing other calculations. This is called a wait loop. Based on this, when a wait loop is introduced into the process of an arbitrary conversion mechanism, the wait loop is executed in the process of indirect reference processing by the conversion mechanism. However, it only increases the amount of time calculation required for the operation of the conversion mechanism, and does not affect the configuration of the indirect element key, element key, indirect reference table, and the like. On the other hand, if the number of repetitions of the wait loop is increased, that is, the amount of time calculation consumed by the wait loop increases, and the number of indirect reference processes that can be executed per unit time decreases. Therefore, the time calculation amount in an arbitrary conversion mechanism can be controlled by such a weight loop.

  As an example of a method of adjusting the reference load, there is a method of combining the load control by mixing this wait loop with another load control method a predetermined number of times. For example, the daytime reference load is set under the load control described with reference to the embodiments so far, such as a method using prime factorization. Only load corresponding to the difference is additionally introduced with load control by mixing weights. Further, the number of repetitions of the wait loop is separately stored on the storage device, and the number of repetitions is implemented so that the number of repetitions is referred to when executing the wait loop. Then, the magnitude of the load can be quickly adjusted by rewriting the number of repetitions on the storage device. That is, this method can be used when the load must be controlled in a short time.

  For example, it is assumed that there is a division management system that performs load control based on the number of slides for 1 million pieces of confidential information using the slide function shown in the first embodiment. It is assumed that the average number of accesses to confidential information of this system is 9 in the day from 9:00 am to 7:00 pm, and 0.9 in other time zones. In such a confidential information management system, in a preferred embodiment, the daytime load control is set so that 10 processes per second can be performed only by the method of adjusting the number of slides by the slide function. That is, when registering confidential information, a slide function and the number of slides are appropriately selected, and a reference load is set so that access to one confidential information takes 0.1 seconds. Since most of the time for accessing the confidential information is the time for the matching process including the application of the slide function, it can be set by appropriately selecting the slide function and the number of slides when registering the confidential information. In this way, even if the number of accesses to confidential information fluctuates by 10% during daytime work, the work can be performed without any problem. On the other hand, for other time zones, a 0.9 second wait loop is inserted for one access so that only one access can be made per second. If the average number of accesses during non-daytime hours is 0.9, even if the number of accesses varies by 10% as in the daytime, operations can be performed without any problem.

  When trying to steal confidential information from the confidential information management system set in this way, only one information per second can be stolen on average during the day, and 0.1 information per second during other times. Confidential information that can be stolen in one day is 1 (case / second) x 60 (second / minute) x 60 (minute / hour) x 8 hours + 0.1 (case / second) x 60 (second / minute) x 60 ( (Minute / hour) × 12 hours = 33,120 cases, even if it is attempted to steal all 1 million confidential information, it cannot be stolen unless the confidential information management system is operated in full operation for 30 days. This is almost impossible.

  In the embodiment 11, the case where the slide function is applied has been described. However, when the prime factorization method is used, the size of the prime number to be multiplied is adjusted, when the random number sequence is used, the length of the random number sequence is adjusted, and the random number sequence is repeated. Even if the indirect element key is generated by another method, such as adjusting the number of iterations when using a reference, or adjusting the length when using the length of an element key, the same adjustment is made so that the daily work is not delayed. In addition, it is possible to construct a system in which even inside humans cannot effectively steal confidential information.

  It is an aspect of the present invention to combine a plurality of load control methods in this way for adjusting the reference load. Similarly, it is an aspect of the present invention to adjust the reference load by changing parameters and the like by a certain single load control method.

Example of confidential information Example of element information and element key to be managed separately Examples of concatenated tables Configuration example of information management system using division management General organization of information presented in tabular format General configuration of element information and element key when dividing and managing the information of FIG. Structure of a linkage table showing the relationship between the element keys in FIG. Correspondence table of element information to store and indirect element key Intermediate configuration diagram of a specific example for creating an indirect element key of the present invention Specific example of indirect element key calculation using prime factorization Specific example of table of element information and indirect element key to be stored Example of prime table Specific calculation examples for creating indirect element keys for prime factorization Configuration example of element key obtained in the process of creating the indirect element key of FIG. Table showing the relationship between the element key and element information in FIG. Example of calculating the indirect element key from the element key in FIG. Configuration example of indirect element key and element information based on information obtained in FIGS. 13 to 16 Example of calculation when initial values 1, 2, 3, 4, 5, 6, 7 are given to Xn = 7Xn-1 (mod 47) Diagram showing the relationship between each element key and the number of slides when using the slide function Table of embodiments of the present invention using slide functions Example of element information and element key using slide function Configuration diagram of conversion mechanism Specific examples of numerical sequences that are randomly sorted from 1 to N Example of algorithm for deriving element key from nth-order indirect element key in K-point selection method Example of key dictionary in load control method using element key length Example of system configuration in load control method using element key length Examples of numbers required to generate indirect element keys Indirectly linked table example Indirectly linked table example Example of tree structure data Example of tree structure data numbering Example of a linked table of tree structure data Example of indirectly linked table of tree structure data related to the present invention

410 Database 420 Database management system 430 Application system 440 System user

Claims (8)

In an information management system that manages a set of element information by dividing it into several parts,
Generating means for generating a unique indirect element key as a function of each element key assigned to some of the set of element information;
An information management system comprising storage means for storing the indirect element key.   The information management system according to claim 1, wherein the generation unit generates the indirect element key using any one of prime factorization, a slide function, and a random number table.   The information management system according to claim 1, further comprising derivation means for deriving element information assigned to the element key by calculating the element key from the indirect element key.   The information management system according to claim 1, further comprising a specifying unit that specifies an element key assigned to other element information based on an element key assigned to one element information constituting the set of element information.   The information management system according to claim 4, wherein the specifying unit performs the specification using a slide function or an inverse function of the slide function. The set of element information is a tree structure;
The information management system according to claim 1, wherein the assigning means assigns a serial number based on a root among a plurality of nodes as an element key corresponding to element information at the node of the tree structure. further,
Implementation means for performing arithmetic processing under a predetermined load under conditions that do not affect the work performed by the information management system main body,
The information management system according to claim 1, further comprising a determination unit that determines the number of times of execution by the execution unit based on an average access amount during a time zone in which the information management system main body operates. In an information management method for dividing and managing a set of element information into several parts,
Generating a unique indirect element key as a function of each element key assigned to some of the set of element information;
A storage step of storing the indirect element key.

Images