JP2014235623A - Illegitimate information detecting method, and illegitimate information detecting apparatus - Google Patents

Abstract

PROBLEM TO BE SOLVED: To reduce, even if a memory unit where information revealing who belongs to what organization is stored is illegitimately accessed, the risk of information on any individual or an individual's organizational affiliation, detect any demand for illegitimate information linking, and thereby prevent illegitimate linking between information items.SOLUTION: An illegitimate information detecting apparatus comprises a memory unit that stores the hash value of data combining individual person identifying information and identifying information on the organization to which the individual person belongs; and an arithmetic processing unit that receives via a network an information linking demand including identifying information on first individual person identifying information and information identifying the organization of the party demanding information linking, generates first data including the first individual person identifying information and the information identifying the organization of the party demanding information, generates a first hash value from the first data, searches the memory unit on the basis of the first hash value and, in the absence of the first hash value in the memory unit, provides an output to the effect that the information linking demand is an illegitimate information linking demand.

Description

  The present invention relates to an information system for providing information related to an individual in response to a request for information related to an individual among a plurality of organizations such as local governments, administrative institutions, and private companies.

  In order to improve the efficiency of administrative affairs and improve the convenience of the public, the government requests information on individuals (information on individuals) among multiple organizations such as local governments, administrative institutions, and private companies (hereinafter referred to as “ We are studying the construction of an information system that enables the provision of information related to individuals in response to information linkage requests).

  If such an information system is realized, it will be possible to send and receive (link) personal information between organizations, improving business efficiency and improving the convenience of the public, while personal information is illegally linked between organizations. Since personal information is stolen or leaked, there is a need for a technology that prevents unauthorized information cooperation by detecting an unauthorized information cooperation request.

  As illegal information considered in the information system, there is an information cooperation request from an organization outside the organization. For example, when Mr. A lives in B city, B city needs information about Mr. A to do business, but municipalities other than B city (eg C city) do business Information about Mr. A is not needed. That is, requesting information related to Mr. A belonging to City B by an organization (for example, City C) to which Mr. A does not belong is an unauthorized information cooperation request. At this time, as a matter to be considered, a person's organization may be changed due to moving or changing jobs. For example, in the previous example, Mr. A lived in B city, but he moved and moved to C city. After moving, the information linkage request from C city was processed as legitimate. It is necessary to process the information linkage request from as an illegal information linkage request.

  As a related technique, for example, there is a technique for detecting unauthorized communication using a communication reservation table in which a transmission source, a transmission destination, and transmission contents are described (see Patent Document 1). As an equivalent to this communication reservation table, by creating an affiliation table that stores information on who belongs to which organization in advance, when receiving an information linkage request, refer to the affiliation table, By confirming whether the target individual belongs to the organization that made the information cooperation request, an unauthorized information cooperation request can be detected.

JP 2011-118608 A

  However, because the affiliation information listed in the affiliation table includes the municipality where the individual resides and the workplace, etc., if there is an unauthorized access to the affiliation table, the individual or individual There is a high risk that the affiliation information will be leaked.

  The present invention has been made in view of such circumstances, and stores information indicating who belongs to which organization in an information system that transmits and receives (links) information about individuals among a plurality of organizations. Incorrect information detection method that reduces the risk of leakage of individuals and personal affiliation information, detects unauthorized information cooperation requests, and prevents unauthorized information cooperation, and An object of the present invention is to provide an unauthorized information detection apparatus that implements this.

  A typical example for solving the above problem is as follows. That is, the unauthorized information detection apparatus connected to the network includes a storage unit that stores a hash value of data obtained by combining the personal identification information and the identification information of the organization to which the individual belongs. Receiving the information cooperation request including the specific information of the individual and the specific information of the information cooperation request source organization, and the first data combining the first individual specific information and the specific information of the information cooperation request source organization Generating, generating a first hash value from the first data, searching the storage unit based on the first hash value, and when the first hash value is not in the storage unit, the information The fact that the cooperation request is an illegal information cooperation request is output.

  In an information system that sends and receives (collaborates) information about individuals between multiple organizations, even if there is unauthorized access to a storage unit that stores information indicating who belongs to which organization, the individual or individual affiliation In addition to reducing the risk of information leakage, it is possible to detect unauthorized information cooperation requests and prevent unauthorized information cooperation.

It is a block diagram showing an example of composition of information system 1 concerning a 1st embodiment of the present invention. It is a block diagram which shows an example of schematic structure of the function of the unauthorized information detection apparatus which concerns on the 1st Embodiment of this invention. It is a block diagram which shows an example of the hardware constitutions of the unauthorized information detection apparatus 102, the information relay apparatus 101, and the information cooperation apparatus 105 which concern on the 1st Embodiment of this invention. It is a figure which shows an example of a structure of the affiliation hash table 209 which concerns on the 1st Embodiment of this invention. It is a figure which shows an example of the recording content of the initial numbering which concerns on the 1st Embodiment of this invention. It is a flowchart which shows an example of the process which produces | generates the affiliation hash table 209 which concerns on the 1st Embodiment of this invention. It is a flowchart which shows an example of the process which detects the unauthorized information cooperation request | requirement which concerns on the 1st Embodiment of this invention. It is a figure which shows an example of a structure of the information cooperation request | requirement which concerns on the 1st Embodiment of this invention. It is a flowchart which shows an example of the process which updates the affiliation hash table 209 which concerns on the 1st Embodiment of this invention. It is a figure which shows an example of a structure of the information cooperation request | requirement containing the change information which concerns on the 1st Embodiment of this invention. It is a figure which shows an example of a structure of the affiliation hash table 1100 which concerns on the 2nd Embodiment of this invention. It is a figure which shows an example of the group management table 1200 which manages the correspondence of the organization group which concerns on the 2nd Embodiment of this invention, and an organization code. According to the second embodiment of the present invention, even after an individual is transferred to another organization, the period during which the information linkage request can be made from the organization before the individual is moved, for each organization group and reason for information linkage. It is a figure which shows an example of the effective period table 1201 managed to. It is a flowchart which shows an example of the process which updates the affiliation hash table 1100 which concerns on the 2nd Embodiment of this invention. It is a flowchart which shows an example of the process which detects the unauthorized information cooperation request | requirement which concerns on the 2nd Embodiment of this invention. It is a figure which shows an example of a structure of the affiliation hash table 1500 of the municipality group which concerns on the 3rd Embodiment of this invention. It is a figure which shows an example of a structure of the corporate group affiliation hash table 1501 which concerns on the 3rd Embodiment of this invention. It is a flowchart which shows an example of the process which detects the unauthorized information cooperation request | requirement which concerns on the 3rd Embodiment of this invention.

Embodiments of the present invention will be described below in detail with reference to the drawings.
(First embodiment)
FIG. 1 is a diagram showing an example of the configuration of the information system 1 according to the first embodiment of the present invention. The information system 1 according to the present embodiment includes a network 104 such as the Internet or a wide area WAN, and an intra-organization network 103 connected to the network 104 in local governments, administrative organizations, private companies, and the like. The network 104 includes information linkage devices 105 _{1 to} 105 _N installed in organizations such as local governments, administrative organizations, and private companies that provide information in response to information linkage requests and information linkage requests (hereinafter, unless otherwise specified). Is referred to as “Information Linking Device 105”). In addition, the intra-organization network 103 determines whether the information relay apparatus 101 that relays information transmitted and received between the information cooperation apparatuses 105 and the information cooperation request transmitted and received between the information cooperation apparatuses 105 are invalid information cooperation requests. A fraudulent information detection apparatus 102 to be determined is connected.

In the information system 1 having such a configuration, for example, when the information cooperation device 105 ₁ installed in the information cooperation request source organization transmits an information cooperation request, the information cooperation request is illegally transmitted via the information relay device 101. It is transmitted to the information detection apparatus 102. The unauthorized information detection apparatus detects an unauthorized information cooperation request by performing predetermined processing described later. The information relay apparatus 102 performs conversion of information (ID) for identifying an individual when relaying an information cooperation request.

  FIG. 2 is a block diagram showing an example of a schematic configuration of functions of the unauthorized information detection apparatus 102 according to the first embodiment of the present invention. When the unauthorized information detection device 102 detects the processing unit 201, the storage unit 202, and an unauthorized information cooperation request, the unauthorized information detection device 102 indicates that the information cooperation request received via the information relay device 101 is an unauthorized information cooperation request ( An input / output unit 203 that outputs (alert) and the like, and a communication unit 204 for communicating with other devices via the intra-organization network 103.

  The processing unit 201 determines whether the received information cooperation request is an invalid information cooperation request based on the information cooperation request received via the information relay apparatus 101 and the data stored in the storage unit 202. In the case of an unauthorized information cooperation request, a table stored in the storage unit 202 and an unauthorized information detection unit 206 that outputs to the input / output unit 203 that the information cooperation request is an unauthorized information cooperation request. A table management unit 207 that generates, updates, and the like, and a control unit 208 that comprehensively controls each unit of the unauthorized information detection apparatus 102.

  The storage unit 202 stores an affiliation hash table 209 that stores hash values of data obtained by combining individual identification information and identification information of the individual affiliation information.

  FIG. 3 is a block diagram illustrating an example of a hardware configuration of the unauthorized information detection apparatus 102, the information relay apparatus 101, and the information cooperation apparatus 105 according to the first embodiment of the present invention. Each of the information relay apparatus 101, the unauthorized information detection apparatus 102, and the information linkage apparatus 105 receives information from the CPU 301, the memory 302, the external storage device 304 such as a hard disk, and the portable storage medium 308 such as a CD-ROM. A reading device 307 for reading, a communication device 303 for communicating with other devices via the intra-organization network 103 or 104, an input device 305 such as a keyboard and a mouse, an output device 306 such as a monitor and a printer, and the like It can be constructed on a general electronic computer provided with an internal communication line 309 for transmitting and receiving data between the devices.

  Each of the above devices can be realized using a general computer including the CPU 301 and a storage device, or a program or hardware having functions equivalent to those of a general computer.

  The CPU 301 executes a predetermined program loaded on the memory 302 from the external storage device 304, thereby realizing each of the processing units described above. That is, the communication unit 204 uses the communication device 303 by the CPU 301, the input / output unit 203 uses the input device 305, the output device 306, and the reading device 307, and the storage unit 202. Is realized by the CPU 301 using the memory 302 or the external storage device 304. The processing unit 201 is realized as a process of the CPU 301.

  The predetermined program may be stored in advance in the external storage device 304, or stored in the storage medium 308 that can be used by the electronic computer, and read out as necessary via the reading device 307. Alternatively, it is downloaded as necessary from the network, which is a communication medium that can be used by the electronic computer, or another device connected to the communication device 303 that uses a carrier wave propagating on the network, to the external storage device 304. It may be introduced.

  FIG. 4 is a diagram showing an example of the configuration of the belonging hash table 209 according to the first embodiment of the present invention. The affiliation hash table 209 is stored in the storage unit 202, and stores information regarding to which organization a certain individual belongs in a hashed state. Specifically, the affiliation hash table stores a result of calculating a hash value for data obtained by combining an ID of an individual and information (organization code) specifying an organization to which the individual belongs. .

For example, H (ID ₁ , A) (“H (X)” indicates a hash value of data X. The same applies hereinafter) of one record 401 stored in the table indicates that the individual identified by ID ₁ is the organization code. A state in which information belonging to the organization A is hashed and stored is shown. In addition, individuals other than the individual identified by ID ₁ belong to the organization of the organization code A. For example, H (ID ₂ , A) of the record 402 indicates that the individual identified by ID ₂ is the organization code A. Indicates that you belong to an organization. The individual identified by ID ₁ can also belong to an organization other than the organization of organization code A. For example, H (ID ₁ , α) of record 403 belongs to the organization of organization code α. Indicates that

  The personal ID is information defined on a computer to identify a certain individual, and is only inside the unauthorized information detection apparatus 102 or only between the information relay apparatus 101 and the unauthorized information detection apparatus 102. And are kept secret from these. As a method of concealing the ID outside the unauthorized information detection device 102 and the information relay device 101, a tamper resistant device is installed inside the unauthorized information detection device 102 or the information relay device 101, and a key stored in the tamper resistant device is used. A method of encrypting or hashing by adding a value known only by the unauthorized information detection apparatus 102 and the information relay apparatus 101 can be considered.

  Next, an example of processing for generating the belonging hash table 209 will be described with reference to FIGS.

  FIG. 5 shows a record in which the information relay device 101 assigns an ID to an individual belonging to each organization based on a numbering request from the information cooperation device 105 installed in each organization in the early stage of system operation or the like. It is a figure which shows an example of the content.

  The record in FIG. 5 is transmitted from the information relay apparatus 101 to the table management unit 207 via the control unit 208 of the unauthorized information detection apparatus 102, and is used when the table management unit 207 generates the belonging hash table 209. .

  FIG. 6 is a flowchart showing an example of processing for generating the belonging hash table 209 according to the first embodiment of the present invention. Here, a process performed by the table management unit 207 that receives a command from the control unit 208 of the unauthorized information detection apparatus 103 will be described. 6 is performed at a predetermined timing such as when the unauthorized information detection apparatus 102 acquires the record shown in FIG. 5 from the information relay apparatus 101.

First, the table management unit 207 receives the recording 501 from the control unit 208 and starts the processing. The table management unit 207 generates data in which a certain individual ID ₁ and information (organization code) A for identifying the numbering requester are combined (step 601). In this case, the method of combining is a method of combining data A after the data ID _1, a method in which to calculate the exclusive OR of ID ₁ and A are considered. Then, the table management unit 207 generates a hash value H of the data in combination on ID ₁ and A (ID _1, A) (step 602), belonging hash table generated hash value H (ID _1, A) (Step 603), and the process ends.

Next, an example of processing for detecting an unauthorized information cooperation request according to the first embodiment will be described with reference to FIGS. 4, 7, and 8. FIG. 7 is a flowchart illustrating an example of processing for detecting an unauthorized information cooperation request according to the first embodiment of the present invention. FIG. 8 is a diagram illustrating an example of the configuration of the information cooperation request according to the first embodiment of the present invention. As shown in FIG. 8, the information linkage request includes an organization code of the information linkage request source, an organization code of the information linkage request destination, an individual ID, the type of personal information to be linked to information, and an information linkage request. And the date and time when the information linkage was executed. The information cooperation request 801 exemplified is “A” as the organization code of the information cooperation request source, “C” as the organization code of the information cooperation request destination, “ID ₁ ” as the personal ID, and “pension information” as the type of personal information. In addition, “life protection” is included as the reason for information cooperation, and “T11” is included as the information cooperation execution date and time. Further, the information cooperation request 802 exemplified is “B” as the organization code of the information cooperation request source, “C” as the organization code of the information cooperation request destination, “ID ₂ ” as the personal ID, and “Pension” as the personal information type. "Information", "Life protection" as the reason for information cooperation, and "T12" as the information cooperation execution date and time.

  First, the control unit 208 of the unauthorized information detection apparatus 102 receives an information cooperation request 801 from an arbitrary information cooperation apparatus 105 via the communication unit 204, and the unauthorized information detection unit 206 receives an instruction from the control unit 208. Information processing will be described.

The unauthorized information detection unit 206 starts processing upon receiving an information cooperation request 801 from the control unit 208. In the case where the reason for information cooperation included in the information cooperation request indicates a reason that the hash table 209 is not subject to update, such as information related to a change, the unauthorized information detection unit 206 uses the organization code A of the information cooperation request source and an individual ID. Data combining a certain ID ₁ is generated (step 701), and a hash value H (ID ₁ , A) of the generated data is generated (step 702). Next, the unauthorized information detection unit 206 searches the affiliation hash table 209 based on the generated hash value H (ID ₁ , A), and determines whether or not H (ID ₁ , A) is in the affiliation hash table 209. (Step 703). Since H (ID ₁ , A) exists in the affiliation hash table 209 (FIG. 4) illustrated, the unauthorized information detection unit 206 determines that the information cooperation request 801 is a valid information cooperation request, and ends the process.

  Next, the control unit 208 of the unauthorized information detection apparatus 102 receives the information cooperation request 802 from the arbitrary information cooperation apparatus 105 via the communication unit 204, and the unauthorized information detection unit 206 receives the instruction of the control unit 208. Information processing to be performed will be described.

The unauthorized information detection unit 206 starts processing upon receiving the information cooperation request 802 from the control unit 208. In the case where the reason for information cooperation included in the information cooperation request indicates a reason for not belonging to the belonging hash table 209, such as a change, the unauthorized information detection unit 206 uses the organization code B of the information cooperation request source and the individual ID. Data combining a certain ID ₂ is generated (step 701), and a hash value H (ID ₂ , B) of the generated data is generated (step 702). Next, the fraudulent information detection unit 206 searches the affiliation hash table 209 based on the generated hash value H (ID ₂ , B), and determines whether H (ID ₂ , B) is in the affiliation hash table 209. (Step 703). Since the exemplary hash table 209 (FIG. 4) does not have H (ID ₂ , B), the unauthorized information detection unit 206 determines that the information collaboration request 802 is an unauthorized information collaboration request, and causes the output device 306 to create an unauthorized An alert indicating that an information linkage request has been detected is output. Note that an alert indicating that an unauthorized information cooperation request has been detected may be transmitted to an external device as processing when an unauthorized information cooperation request other than this is detected.

  Next, an example of processing for updating the affiliation hash table 209 when an individual is transferred to another organization will be described with reference to FIGS. 9 and 10. FIG. 9 is a flowchart showing an example of processing for updating the affiliation hash table 209 according to the first embodiment of the present invention. FIG. 10 is a diagram showing an example of the configuration of the information cooperation request 1001 including change information according to the first embodiment of the present invention. Here, the control unit 208 of the fraudulent information detection apparatus 102 that has received the cooperation request 1001 from the arbitrary information cooperation apparatus 105 via the communication unit 204, and the information performed by the table management unit 207 that has received a command from the control unit 208 Processing will be described.

The control unit 208 starts processing upon receiving the information cooperation request 1001 from the communication unit 204. First, the control unit 208 determines whether or not the reason for information cooperation included in the information cooperation request is a reason indicating that the table is to be updated. Call (step 901). As a reason for indicating that the table is to be updated, for example, there may be a change related to “moving” or “changing job”. It should be noted that the relationship between the reason for information linkage and whether or not to move can be determined in advance by an administrator or the like. Here, the reason for information cooperation of the information cooperation request 1001 is “moving”, which corresponds to a change and becomes a table update target. Next, the table management unit 207 generates data combining the individual ID ₁ and the organization code C of the request source (the individual transfer destination organization), and generates the hash value H (ID ₁ , C) of the generated value. It is generated (step 902), and the generated hash value H (ID ₁ , C) is additionally registered in the belonging hash table 209 of FIG. 4 (step 903). Next, the table management unit 207 generates data combining the ID ₁ and the organization code A of the request destination (the individual transfer source organization), and generates a hash value H (ID ₁ , A) of the generated value. (Step 904), the generated hash value H (ID ₁ , A) is deleted from the belonging hash table 209 (Step 905), and the update process is terminated. In step 901, if the reason for information linkage is not a table update target, an unauthorized information detection process shown in FIG. 7 is performed.

  The first embodiment of the present invention has been described above.

  According to the first embodiment, a hash value of data obtained by combining an individual ID and an organization to which the individual belongs is stored in advance in the belonging hash table 209 so that the unauthorized information detection apparatus 102 can store the hash value. When an information cooperation request is received, a hash value of data combining the personal ID and the cooperation source organization code is generated, the generated hash value is searched from the belonging hash table 209, and there is no matching hash value The received information cooperation request is detected as an invalid information cooperation request.

  Thereby, even when there is an unauthorized access to the belonging hash table 209, it is possible to reduce the risk of leakage of an individual belonging and to prevent illegal information cooperation by detecting an illegal information cooperation request.

  In addition, when the affiliation of an individual is changed due to “moving” or “changing jobs”, the affiliation hash table 209 is updated. Therefore, when the affiliation of an individual is changed, the affiliation from the organization before the move is changed. Information linkage requests can be detected as unauthorized information linkage requests.

  In the first embodiment, each time an information cooperation request is generated, the information cooperation request is transmitted to the unauthorized information detection apparatus 102 via the information relay apparatus 101. May be held, and thereafter, information cooperation requests for a certain period may be collected and transmitted to the unauthorized information detection apparatus 102.

In addition, the unauthorized information detection unit 206 considers not only “detection of unauthorized information cooperation request” once but also “detection of unauthorized information cooperation request” multiple times, and combines the statistical methods and the like to obtain unauthorized information. A cooperation request may be detected. In other words, not only raises an alert when one information linkage request is detected as an illegal information linkage request, but also alerts when there is a higher possibility of an illegal information linkage request considering multiple information linkage requests. It is good also as a mechanism which can raise.
(Second Embodiment)
A second embodiment of the present invention will be described with reference to FIGS. The differences from the first embodiment of the present invention are as follows. (1) When an individual is changed in the information system of FIG. 1, a flag indicating that the individual has changed in the belonging hash table 209 of FIG. (2) Manage the correspondence between the organization group to which the individual belongs and the organization code, and (3) Manage the information linkage available period for each reason of the organization group and information linkage Is a point. Due to this difference, even when an individual is transferred to another organization, the date and time when the information linkage request is received is determined by the combination of the organization group before the change and the reason for information linkage included in the information linkage request. When it is larger than the sum of the possible period and the movement date and time of the individual, a request for information about the individual from the organization before the change can be detected as an unauthorized information cooperation request.

  FIG. 11 is a diagram showing an example of the configuration of the belonging hash table 1100 according to the second embodiment of the present invention. In the affiliation hash table 1100 according to the second embodiment of the present invention, a hash value 1101 of data obtained by combining an individual ID and an organization code of the organization to which the individual belongs, and the individual is transferred from the organization. The change flag 1102 indicating that the user has changed, and the change date 1103 of the individual are stored in association with each other. Here, “change” is registered in the change flag 1102, but other information may be used as long as the information indicates that the individual has changed. Further, in the change date 1103, for example, the date 1103 when the change flag 1102 was registered in the affiliation hash table 1100 is registered.

  FIG. 12A is a diagram showing an example of a group management table 1200 for managing the correspondence between organization groups and organization codes according to the second embodiment of the present invention. An organization group is a group of organizations of the same type. For example, when the organizations indicated by the organization codes A, B, and C are A city, B town, and C village, respectively, the organization codes A, B, and C belong to the municipal group, and the organization codes α, β, and γ If the organizations indicated by are α, β, and γ, respectively, the organization codes α, β, and γ indicate that they belong to a company group.

  FIG. 12B shows a period in which an information link request can be made from an organization before the individual is moved even after the individual has moved to another organization according to the second embodiment of the present invention. FIG. 5 is a diagram illustrating an example of an effective period table 1201 managed for each reason for information cooperation. The reason for information cooperation stores the same reason as that included in the information cooperation request. For example, record 1202 indicates that the organization of a municipality group may request information on resident tax for five years from the date and time of change for a resident who has moved. .

  Each table shown in FIGS. 12A and 12B is stored in the storage unit 202, defined in advance by an administrator of the information system shown in FIG. 1, and appropriately maintained.

FIG. 13 is a flowchart illustrating an example of processing for updating the belonging hash table 1100 according to the second embodiment. Note that the processing in steps 1301 to 1304 in FIG. 13 is the same as the processing in steps 901 to 904 in FIG. After the processing of step 1304, the table management unit 207 generates a hash value H of data obtained by combining the individual ID ₁ and the organization code A of the organization before the individual change, generated in step 1304, from the belonging hash table 1100 of FIG. (ID ₁ , A) is searched to identify the record 1104, “change” is registered in the change flag 1102 of the specified record 1104, and the registration time is registered in the change date 1103 (step 1305).

  Next, an example of processing for detecting an unauthorized information cooperation request according to the second embodiment will be described with reference to FIGS. 8, 11, 12 (a), 12 (b), and 14. FIG. 14 is a flowchart illustrating an example of processing for detecting an unauthorized information cooperation request according to the second embodiment of the present invention. Here, the information cooperation request 801 will be described as an example of the information cooperation request.

The unauthorized information detection unit 206 starts processing upon receiving an information cooperation request 801 from the control unit 208. First, illicit information detection unit 206 performs the processing similar to the steps 701-703, to generate a hash value H (ID _1, A), based on the generated hash value H (ID _1, A) belongs The hash table 1100 is searched, and it is determined whether or not the hash value H (ID ₁ , A) exists in the affiliated hash table 1100 (steps 1401 to 1403). Here, since there is a hash value H (ID ₁ , A) (record 1104), the unauthorized information detection unit 206 further checks the presence or absence of the change flag 1102 in the record 1104 (step 1404). Here, since there is a transfer flag, the fraudulent information detection unit 206 acquires information indicating the municipality that is the group corresponding to the requesting organization code A from the group management table 1200 (step 1405). Next, the fraudulent information detection unit 206 searches the validity period table 1201 based on the information indicating the municipality and the information indicating the reason (living protection) of the information linkage included in the information linkage request 801, and the relevant information linkage possible period. Information indicating (3 years) is acquired (step 1406). Next, the unauthorized information detection unit 206 compares the time obtained by adding the information cooperation possible period acquired in step 1406 to the change date 1103 of the record 1104 with the information cooperation request reception date (step 1407), and receives the information cooperation request reception. When the date and time is larger, the received information cooperation request is determined to be a valid information cooperation request, and when the information cooperation request reception date and time is smaller, the received information cooperation request is alerted to the output device 306 as an illegal information cooperation request. Etc. are output and the process is terminated.

If the hash value H (ID ₁ , A) does not exist in the affiliated hash table 1100 in step 1403, an alert or the like is output to the output device 306 as an invalid information cooperation request. If there is no transfer flag in step 1404, the received information cooperation request is determined to be a valid information cooperation request, and the process ends.

  The second embodiment of the present invention has been described above.

  According to the second embodiment, (1) in the belonging hash table 209 (FIG. 4) shown in the first embodiment, the flag indicating that an individual has moved and the date and time of the individual's transfer are managed together. , (2) managing the correspondence between the organization group to which the individual belongs and the organization code, and (3) managing the information collaboration possible period for each reason of the organization group and information collaboration, Even if it is transferred to an organization, the information link request reception date / time is a value obtained by adding the transfer date / time and the information link enable period determined by the combination of the organization group before the transfer and the information link reason included in the information link request. If it is large, a request for information on the individual from the organization before the change is detected as an illegal information cooperation request.

As a result, even after an individual is transferred, the organization of the individual transfer source can perform information linkage for a certain period of time, and after a certain period of time, the information linkage request from the organization of the individual transfer source is illegal. By detecting the request as an invalid information linkage request, it is possible to prevent illegal information linkage.
(Third embodiment)
A third embodiment of the present invention will be described with reference to FIGS. 15 (a), 15 (b), and 16. FIG. In the third embodiment, in the affiliation hash table for each organization group, the management is performed by associating and managing the hash value of the data obtained by combining the individual ID and the organization code with the hash value of the individual ID. This is a difference from the configuration of the belonging hash table described in the embodiment and the second embodiment. Due to this difference, an individual prevents illegal information linkage based on the fact that a certain person does not belong to a plurality of organizations in one organization group. For example, since an individual resident's card is registered in one municipality, it is not registered twice in two municipalities. In other words, the fact that there are multiple organizations to which a specific individual belongs in a municipal group suggests that one of them is illegal.

  FIGS. 15A and 15B are diagrams illustrating an example of the configuration of the belonging hash table according to the third embodiment of the present invention. FIG. 15A shows an example of the configuration of the affiliation hash table 1500 of the municipal group, and FIG. 15B shows an example of the configuration of the affiliation hash table 1501 of the company group. In the third embodiment of the present invention, a group management table 1200 for managing the correspondence between organization groups and organization codes as shown in FIG. 12A is managed by the fraudulent information detection apparatus 102. For example, FIG. Before step 601, a step of specifying an individual organization group from an organization code included in the information cooperation request and the group management table 1200, and a step of generating a hash value H (ID) of the individual ID are added. In 603, H (ID, organization code) and H (ID) are associated and registered in the affiliated hash tables 1500 and 1501 for each organization group. Note that the timing for generating H (ID) may be after step 601 in FIG. 6 or after step 602.

  FIG. 16 is a diagram illustrating an example of processing for detecting an unauthorized information cooperation request according to the third embodiment of the present invention. Here, the control unit 208 of the unauthorized information detection apparatus 102 receives the information cooperation request 801 from the arbitrary information cooperation apparatus 105 via the communication unit 204, and the unauthorized information detection unit 206 receives the instruction of the control unit 208. Information processing to be performed will be described.

The unauthorized information detection unit 206 starts processing upon receiving an information cooperation request 801 from the control unit 208. First, individual ID (here, ID ₁₎ to generate a is a hash value of H (ID ₁₎ (step 1601). Next, the fraudulent information detection unit 206 refers to the group management table 1200, identifies the municipality group as the organization group to which the organization of the request source organization code A belongs, and generates the hash value H (ID ₁₎ generated in step 1601. ), The affiliated hash table 1500 of the specified municipality group is searched (step 1602). As a result of the search, since the number of hash values H (ID ₁ ) is one here, the unauthorized information detection unit 206 combines the link source organization code A and ID ₁ based on the information link request 801. Data is generated (steps 1603 and 1604), and a hash value H (ID ₁ , A) of the generated value is generated (step 1605). Next, the fraudulent information detection unit 206 searches the affiliation hash table 1500 of the municipality group identified in step 1602 based on the generated hash value H (ID ₁ , A), and the hash value H (ID ₁ , A) is obtained. If it exists in the affiliation hash table 1500 of the municipality group, the process ends with the information cooperation request 801 as a valid information cooperation request (Yes in step 1606).

  If the number of ID hash values is 0 in step 1603, the unauthorized information detection unit 206 outputs an alert to the output device 306 as an unauthorized information collaboration request, and ends the process. In step 1603, if the number of ID hash values is two or more, the unauthorized information detection unit 206 may be illegal if the same ID is registered twice in one affiliation hash table 1500. Therefore, the information linkage request is output as an unauthorized information linkage request, an alert is output to the output device 306, and the process ends. In step 1606, if the hash value generated in step 1605 is not in the affiliated group hash table 1500, the information cooperation request is output to the output device 306 as an invalid information cooperation request, and the process is terminated (step No in 1606).

  The third embodiment of the present invention has been described above.

  In the third embodiment of the present invention described above, the case where double registration of a hash value of an individual ID is detected triggered by “reception of an information cooperation request” is described as an example. The double registration of the personal ID may be detected by performing the processing of Step 1603 on the record.

  Although the third embodiment of the present invention has been described above, in the third embodiment of the present invention, in the affiliation hash table for each organization group, the hash value of the data combining the personal ID and the organization code, and the ID The hash value of the individual ID included in the information cooperation request is generated when the information cooperation request is received, and the hash value of the generated ID belongs to the organization to which the information cooperation request source organization belongs If there are two or more group hash tables, the information linkage request is detected as an invalid information linkage request.

  As a result, even if there is unauthorized access to the affiliated hash table in an information system that sends and receives information about individuals between multiple organizations, the risk of leakage of information about individuals is reduced and unauthorized information linkage requests are detected. Thus, it is possible to prevent unauthorized information from being linked.

  In addition, the third embodiment of the present invention can detect fraud in which a plurality of information related to the same individual is registered in the belonging hash table of an organization group.

DESCRIPTION OF SYMBOLS 101 ... Information relay apparatus, 102 ... Unauthorized information detection apparatus, 103 ... Institutional network, 104 ... Network, 105 ... Information cooperation apparatus, 201 ... Processing part, 202 ... Storage unit 203 ... Input / output unit 204 ... Communication unit 206 ... Unauthorized information detection unit 207 ... Table management unit 208 ... Control unit 209 ... Hash table belonging 301 ... CPU, 302 ... memory, 303 ... communication device, 304 ... external storage device, 305 ... input device, 306 ... output device, 307 ... reading device, 308. ..Portable storage medium, 309... Internal communication line.

Claims (10)

An unauthorized information detection method in an unauthorized information detection apparatus connected to a network,
A first storage unit for storing a hash value of data obtained by combining the personal identification information and the identification information of the organization to which the individual belongs;
Via the network, receiving an information cooperation request including the specific information of the first individual and the identification information of the information cooperation request source organization;
Generating first data combining the specific information of the first individual and the specific information of the information cooperation request source organization;
Generating a first hash value from the first data;
Searching the first storage unit based on the first hash value;
When the first hash value is not in the first storage unit, the fact that the information cooperation request is an unauthorized information cooperation request is output.
An illegal information detection method characterized by the above. An information cooperation request including the specific information of the first individual, the specific information of the transfer destination organization of the first individual, the specific information of the transfer source organization of the first individual, and the reason for the information link request via the network Receive
In the case where the reason for the information cooperation request is a reason indicating that the first storage unit is to be updated, a combination of the specific information of the first individual and the specific information of the transfer destination organization of the first individual Generate second data,
Generating a second hash value from the second data, registering the second hash value in the first storage unit, and specifying the first individual specifying information and the first individual transfer source organization specifying information; Generate the combined third data,
Generating a third hash value from the third data and deleting it from the first storage unit;
The fraud information detection method according to claim 1. The information cooperation request further includes information indicating a reason for the information cooperation request, and the first storage unit further stores information indicating that the individual has changed and the date and time of the personal change in association with each other,
The fraudulent information detection apparatus further includes a second storage unit that stores the organization group to which the individual belongs and the specific information of the organization to which the individual belongs in association with each other, the organization group, and each reason for the information cooperation request. A third storage unit for storing the information linkage requestable period,
The first storage unit is searched based on the first hash value, the first hash value is in the first storage unit, and information indicating that the first individual has been transferred to the corresponding record is If there is, specify the first individual organization group from the information specifying the information cooperation request source organization and the second storage unit,
An information cooperation request possible period associated with the reason for the information cooperation request included in the first personal organization group and the information cooperation request is acquired from the third storage unit,
The information cooperation request when the date and time when the information cooperation request is received is larger than the value obtained by adding the acquired information cooperation request possible period and the first individual change date and time acquired from the first storage unit. Output that it is an invalid information linkage request,
The fraud information detection method according to claim 1. The information including the first person specific information, the first individual transfer destination organization specific information, the first individual transfer source organization specific information, and the reason for the information linkage request via the network Receive a collaboration request,
In the case where the reason for the information cooperation request is a reason indicating that the first storage unit is to be updated, a combination of the specific information of the first individual and the specific information of the transfer destination organization of the first individual Generate second data,
Generating a second hash value from the second data, registering the second hash value in the first storage unit, and specifying the first individual specifying information and the first individual transfer source organization specifying information; Generate the combined third data,
Generating a third hash value from the third data;
The first storage unit is searched based on the third hash value, and information indicating that the first individual has changed and the date and time of the first individual change are registered in the corresponding record.
The fraudulent information detection method according to claim 3. The fraudulent information detection device further includes a second storage unit that stores the organization group to which the individual belongs and the specific information of the organization to which the individual belongs in association with each other,
The first storage unit further stores the hash value of the individual, and the first storage unit is provided in the unauthorized information detection device for each organization group,
Receiving the information cooperation request including the specific information of the first individual and the information specific to the information cooperation request source organization via the network;
Generating a second hash value from the received specific information of the first individual;
Identifying the first individual organization group from the received identification information of the request source organization and the second storage unit;
Based on the second hash value, search the first storage unit corresponding to the identified organization group,
When there are two or more second hash values, the fact that the information cooperation request is an unauthorized information cooperation request is output.
The fraud information detection method according to claim 1. In the unauthorized information detection device connected to the network,
A first storage unit that stores a hash value of data obtained by combining the personal identification information and the identification information of the organization to which the individual belongs, and an arithmetic processing unit;
The arithmetic processing unit includes:
Via the network, receiving an information cooperation request including the specific information of the first individual and the identification information of the information cooperation request source organization;
Generating first data combining the specific information of the first individual and the specific information of the information cooperation request source organization;
Generating a first hash value from the first data;
Searching the first storage unit based on the first hash value;
When the first hash value is not in the first storage unit, the fact that the information cooperation request is an unauthorized information cooperation request is output.
A fraudulent information detection apparatus characterized by the above. The arithmetic processing unit includes:
An information cooperation request including the specific information of the first individual, the specific information of the transfer destination organization of the first individual, the specific information of the transfer source organization of the first individual, and the reason for the information link request via the network Receive
In the case where the reason for the information cooperation request is a reason indicating that the first storage unit is to be updated, a combination of the specific information of the first individual and the specific information of the transfer destination organization of the first individual Generate second data,
Generating a second hash value from the second data, registering the second hash value in the first storage unit, and specifying the first individual specifying information and the first individual transfer source organization specifying information; Generate the combined third data,
Generating a third hash value from the third data and deleting it from the first storage unit;
The fraudulent information detection apparatus according to claim 6. The information cooperation request further includes information indicating a reason for the information cooperation request, and the first storage unit further stores information indicating that the individual has changed and the date and time of the personal change in association with each other,
The fraudulent information detection apparatus further includes a second storage unit that stores the organization group to which the individual belongs and the specific information of the organization to which the individual belongs in association with each other, the organization group, and each reason for the information cooperation request. A third storage unit for storing the information linkage requestable period,
The arithmetic processing unit includes:
The first storage unit is searched based on the first hash value, the first hash value is in the first storage unit, and information indicating that the first individual has been transferred to the corresponding record is If there is, specify the first individual organization group from the information specifying the information cooperation request source organization and the second storage unit,
An information cooperation request possible period associated with the reason for the information cooperation request included in the first personal organization group and the information cooperation request is acquired from the third storage unit,
The information cooperation request when the date and time when the information cooperation request is received is larger than the value obtained by adding the acquired information cooperation request possible period and the first individual change date and time acquired from the first storage unit. Output that it is an invalid information linkage request,
The fraudulent information detection apparatus according to claim 6. The arithmetic processing unit includes:
The information including the first person specific information, the first individual transfer destination organization specific information, the first individual transfer source organization specific information, and the reason for the information linkage request via the network Receive a collaboration request,
In the case where the reason for the information cooperation request is a reason indicating that the first storage unit is to be updated, a combination of the specific information of the first individual and the specific information of the transfer destination organization of the first individual Generate second data,
Generating a second hash value from the second data, registering the second hash value in the first storage unit, and specifying the first individual specifying information and the first individual transfer source organization specifying information; Generate the combined third data,
Generating a third hash value from the third data;
The first storage unit is searched based on the third hash value, and information indicating that the first individual has changed and the date and time of the first individual change are registered in the corresponding record.
The unauthorized information detection device according to claim 8. The fraudulent information detection device further includes a second storage unit that stores the organization group to which the individual belongs and the specific information of the organization to which the individual belongs in association with each other,
The first storage unit further stores the hash value of the individual, and the first storage unit is provided in the unauthorized information detection device for each organization group,
The arithmetic processing unit includes:
Receiving the information cooperation request including the specific information of the first individual and the information specific to the information cooperation request source organization via the network;
Generating a second hash value from the received specific information of the first individual;
Identifying the first individual organization group from the received identification information of the request source organization and the second storage unit;
Based on the second hash value, the first storage unit corresponding to the identified organization group is searched, and when there are two or more second hash values, the information cooperation request is invalid information cooperation. Output that it is a request,
The fraudulent information detection apparatus according to claim 6.

Images