JP2015043553A - Terminal device, data processing method, and program - Google Patents

Abstract

PROBLEM TO BE SOLVED: To make it possible to provide an advanced personal service utilizing both personal data and context data from outside while protecting the personal data.SOLUTION: Map display data is produced in a public data processing part 112 capable of accessing external data. Product recommendation data is produced in a private data processing part 113, incapable of accessing the outside, but capable of accessing personal data. The map display data and the product recommendation data are composed in a display part 114.

Description

  The present invention relates to a terminal device, a data processing method, and a program for accessing personal data and displaying information optimized for the individual on a personal terminal.

  With the spread of information devices possessed by individuals typified by smartphones, it has become common to display information provided from various online services on mobile terminals. In these information display services, there are cases where user convenience is enhanced by displaying information personalized to the user using information related to the user. For example, by downloading the surrounding map data from the server based on the information of the user's current location and displaying it on the mobile terminal, the user does not have to bother to input the current location to the information display service. Information can be viewed immediately.

  As described above, in order to provide a service that is optimized (personalized) to the user, it is necessary to perform a process of linking other related data and presenting it to the user based on the user's own information (personal data). . The personal data can be divided into context data representing the context (current location, etc.) of the user at a certain point in time and other data. The context data is information that changes with time, and other data includes personal information such as name, address, and sex, profile information, and history information such as travel history and purchase history. In the following, when it is simply expressed as personal data, it refers to the latter information other than context data.

Currently, there are mainly two types of methods for displaying information optimized for individuals.
One is to display information to the user as a form of application installed on the terminal. This is the case when the map application on the mobile terminal displays a map around the current location using the GPS (position) data of the terminal. In this form of application, since arbitrary data stored on the terminal can be accessed, display information can be optimized (personalized) using personal information. On the other hand, in this form, since arbitrary data acquired by the application can be transmitted to an external server, there is a risk that a malicious application misuses personal data. Recently, there are cases where personal information and personal data stored on a mobile device are extracted by an application installed on the mobile device and sent to the outside (such as a server operated by an application development company) without the user's permission. It has become a social problem. It is difficult to technically prevent such unauthorized applications from collecting and misusing personal information without permission.

  The other is a form in which information optimized for the user is displayed using a Web browser. In this mode, content downloaded from a Web server (HTML file or Java (registered trademark) Script (registered trademark) program) uses the function (API) provided in the browser to acquire current location information and By sending information, the map data around the current location is downloaded and the surrounding map is displayed (Non-Patent Document 1). In this form, personal data can be automatically acquired from the user terminal only within the API range provided by the browser. In the HTML standard, from the viewpoint of protecting user privacy, the browser cannot normally access data in the user terminal, and allows access to some context data only with the explicit permission of the user. At present, the data that the browser can automatically acquire from the user terminal is about the position information. For this reason, in order to personalize display information using personal data other than position information, it is necessary to store personal data in a web server in some form. However, it is not practical to store all information related to privacy such as location information history and purchase history information in the server because of the high cost for protecting the user's privacy and ensuring information security.

W3C Geolocation API Specification, http://www.w3.org/TR/geolocation-API/ Content Security Policy, http://www.w3.org/TR/CSP/

  In the above prior art, when it is desired to provide an advanced personal information display service utilizing the personal data of the user, when the program operating on the user terminal can access the personal data in the terminal, the data can be freely released to the outside. There is a risk of being sent and misused.

  Further, when the program cannot access the personal data in the terminal, it is necessary to store the personal data on the server in advance, resulting in a high cost for managing personal information.

  An object of the present invention is to provide a terminal device, a data processing method, and a program capable of providing an advanced personal service using both personal data and external context data while protecting personal data. .

In order to solve the above problems, the present invention provides two data processing units for executing a program.
First, an area (sandbox) in which data cannot be transmitted / received to / from the outside (such as a server) in the terminal is generated (this is called a private data processing unit), and data processing and display data generation using personal data is performed in the private data processing unit. I do. A program executed in the private data processing unit can access personal data in the terminal, but cannot send and receive data to the outside.

  Next, apart from the private data processing unit, a public data processing unit that can freely access the outside is provided to perform data processing, data transmission / reception with the outside, and display data generation. A program executed in the public data processing unit can access context data (current position information and the like) as in the browser, but cannot access personal data.

Finally, the display unit synthesizes the display data respectively created by the private data processing unit and the public data processing unit and finally presents them to the user.
In the present invention, a plurality of public data processing units and a plurality of private data processing units may exist. Further, an exception may be provided for external access of the private data processing unit so that data can be transmitted / received only to a specific external server. In this case, the private data processing unit can transmit personal data only to a specific trusted server. The above inventions can be combined as much as possible.

In the present invention, since only a program in the private data processing unit that cannot transmit and receive data to the outside handles personal data, the possibility of abuse by transmitting personal data to an external server is technically prevented.
On the other hand, a program in the private data processing section can freely access personal data and create an information display screen optimized for the individual, so that personalization services can be realized even if personal data is not stored on an external server. Yes.

  When only the private data processing unit exists, an external data acquisition request based on the context data cannot be transmitted to the server. For example, it is not possible to download and display surrounding map data based on your current location. In the present invention, the public data processing unit creates map display data, the private data processing unit creates personal display data, and the display unit synthesizes them, while protecting the personal data, the personal data and the context Enables the provision of advanced personal services utilizing both data.

1 is a block diagram showing an information display system related to the present invention. 1 is a block diagram showing an information display system according to the present invention. The block diagram which shows the example of a connection structure of the user terminal and server which concern on the 1st Embodiment of this invention. The sequence diagram which shows the transmission / reception operation | movement of the data between the server and each part of a user terminal in 1st Embodiment. The data structure figure of the query in a 1st embodiment. The data structure figure which attached the HTTP header to the query in a 1st embodiment. The figure which shows an example of the display data which the public data process part produced in 1st Embodiment. The figure which shows an example of the composite display data which the public data processing part and the private data processing part produced in 1st Embodiment. The block diagram which shows the connection structural example of the user terminal which concerns on the 2nd Embodiment of this invention, a server, and a totaling server. The data structure figure which gave the HTTP header to the query in a 2nd embodiment.

  Embodiments of the present invention will be described with reference to the accompanying drawings. The embodiments described below are examples of the present invention, and the present invention is not limited to the following embodiments. In the present specification and drawings, the same reference numerals denote the same components.

Prior to describing an embodiment according to the present invention, its operation principle will be described.
Previously, as shown in FIG. 1, the content (HTML file or Java (registered trademark) Script (registered trademark) program) downloaded from the server SV on the web is a function provided in the browser in the mobile terminal MT ( API) is used to acquire current location information, and the information is transmitted to the server SV. Then, the server SV includes a data transmission unit 1, a data processing unit 2, a request reception unit 3, and a personal data storage unit 4. When the server SV receives the information sent from the portable terminal MT by the request reception unit 3, the data processing unit 2 reads the personal data from the personal data storage unit 4 to generate personalized display data, and the data transmission unit 1 The display data is transmitted to the portable terminal MT.

By the way, in the system shown in FIG. 1, since all information related to privacy such as location information history and purchase history information is stored in the server SV, costs for protecting user privacy and ensuring information security are high.
Therefore, as shown in FIG. 2, in the present invention, a personal data providing unit 130 and a local server 140 are provided in the user terminal 100, and a display data receiving unit 111, a display is displayed in the information display system (browser) 110. In addition to the unit 114 and the request transmission unit 115, a public data processing unit 112 and a private data processing unit 113 are provided. The private data processing unit 113 performs data processing and display data generation using personal data stored in the personal data providing unit 130. A program executed in the private data processing unit 113 can access the personal data providing unit 130, but cannot transmit / receive data to / from the outside.

  The public data processing unit 112 performs data processing, data transmission / reception with the outside, and display data generation. A program executed in the public data processing unit 112 can access the context data providing unit 120 in the user terminal 100 but cannot access the personal data providing unit 130.

The display unit 114 combines the display data created by the public data processing unit 112 and the private data processing unit 113 and finally presents them to the user.
Based on the above principle, embodiments of the present invention will be described below.

(First embodiment)
In the first embodiment, consider a scenario in which a service provider X provides a personalized Web service to a user using the information display system of the present invention. Specifically, it is assumed that a past purchase history is stored as personal data in a certain user terminal, and the service provider is likely to purchase the user from products sold in stores around the user's current location. Consider a case where a product is selected and presented to the user (displayed on the user terminal).

  FIG. 3 shows a connection configuration example between the user terminal 100 and the server SV according to the first embodiment, and each functional unit will be described below. The server SV is a Web server owned by the business operator X that provides the service of the first embodiment. The server SV has a request reception unit 3, a data processing unit 2, and a data transmission unit 1.

The user is a user who receives this service, and possesses the user terminal 100. The user terminal 100 may be a mobile terminal such as a smartphone or a stationary terminal such as a personal computer.
The user terminal 100 manages context data such as current location information, and manages personal data such as phone book information, location information history, and purchase history, as well as context data providing unit 120 provided to the public data processing unit 112. There is a personal data providing unit 130, a local server 140, and an information display system 110. In the first embodiment, the context data providing unit 120 and the personal data providing unit 130 are implemented by the user terminal 100 as an API or database, and the local server 140 is a Web server that operates on the user terminal 100. To do.

  The information display system 110 includes a data reception unit 111, a public data processing unit 112, a private data processing unit 113, a display unit 114, and a request transmission unit 115. In the first embodiment, the information display system 110 uses a Web browser, and the public data processing unit 112 and the private data processing unit 113 are units indicated by <HTML> to </ HTML> elements of the Web page. (Frame element) and a JavaScript (registered trademark) program provided together with HTML data is assumed to run.

  The local server 140 is connected to the personal data providing unit 130 and has a function of inquiring the personal data providing unit 130 about personal data stored in the user terminal 100. The personal data providing unit 130 is not connected to the information display system 110, and the information display system 110 cannot directly access personal data.

  The point of this embodiment is that personal data can be accessed by providing a local server 140 having a function capable of accessing personal data in the user terminal 100 and configuring a Web page according to the procedure described later. The private data processing unit 113 that cannot transmit and receive data to the outside is generated, and the display data generated by the private data processing unit 113 and the public data processing unit 112 are combined using the existing functions of the browser to the user. It is to present.

In the following, description will be made along the step numbers in FIGS. FIG. 4 is a sequence showing a data transmission / reception operation between the server SV and each unit of the user terminal 100.
(Step 1) Upon receiving an instruction to access a Web site (specific URL) provided by the service provider from the user, the request transmission unit 115 transmits a connection request for the URL.

  (Step 2) Upon receiving the connection request by the request receiving unit 3, the server SV creates Web site data + query corresponding to the content of the request in the data processing unit 2 and transmits it from the data transmission unit 1. Web site data is HTML data and Java (registered trademark) Script (registered trademark) programs used in ordinary websites. In this example, a program that reads the current location and displays surrounding maps and store icons is included. Shall be. As shown in FIG. 5, the query is composed of an HTML part and a data part. In this example, it is assumed that the data portion includes a list of stores and a list of products sold for a plurality of stores. In the HTML part, from the list of products sold at the store with the specified store name, list the products included in the purchase history from the previous year to the present of the user, format and output as HTML It is assumed that data and programs are described.

  The Web site data and query are read into the information display system (browser) 110 via the data receiving unit 111 and become Web pages (S2-1, S2-2). This page is a public data processing unit 112. Since the public data processing unit 112 is actually a normal web page, it can freely access data outside the terminal and context data provided by the browser as an API, while personal data inside the terminal where the browser does not provide the API. Cannot be accessed.

  (Step 3) The public data processing unit 112 registers the query passed from the server SV in the local server 140 (S3-1). The local server 140 stores the content of the query in its own storage area (S3-2), and hosts the HTML part and the data part of the query as a Web server. A web page hosted on the local server 140 read by the information display system (browser) 110 (Web page) becomes the private data processing unit 113 (S3-3).

The public data processing unit 112 obtains the URL of the private data processing unit 113 developed on the local server 140 as a return value at the time of query registration (S3-4).
In general, in the information display system 110 using HTML, in a Web page A configured with one HTML, a Web page B configured with another HTML is referred to inline (the src element of the <iframe> tag has another reference). By specifying a URL that points to HTML), Web page A can be displayed in a nested manner with Web page B included.

  Also in this embodiment, by referring to the URL of the private data processing unit 113 obtained as a return value inline, the Web page in the public data processing unit 112 includes and displays the Web page generated by the private data processing unit 113. can do. At this time, it is also possible to specify the display position of the included Web page by the normal HTML notation using the <iframe> tag.

  The local server 140 has a personal data inquiry function for the personal data providing unit 130, and provides a JavaScript (registered trademark) API to the program of the private data processing unit 113. Therefore, the private data processing unit 113 can access personal data.

  On the other hand, the local server 140 attaches the HTTP header as shown in FIG. 6 to host the contents of the query, and in accordance with the technology of Content Security Policy (Non-Patent Document 2), this Web page (private data processing) Part 113). Specifically, it is impossible to send a request to the outside from this Web page. As a result, the private data processing unit 113 becomes a Web page that can access personal data but cannot send and receive data to the outside.

(Option 1) The public data processing unit 112 may receive a plurality of queries from the server SV and perform the query registration processing a plurality of times. In that case, a plurality of private data processing units 113 are generated.
(Option 2) Moreover, you may give the electronic signature by the auditor Y to a query. The inspector Y confirms and verifies the contents (program) of the query, and gives an electronic signature to the query when determining that the personal data is appropriately handled. This signature can technically ensure that the content of the query is appropriate, and the user can confirm it.

  (Step 4) The public data processing unit 112 generates display data using the Web site data. At that time, according to the instruction of the program in the Web site data, the current data of the user terminal is inquired to the context data providing unit (S4-1), and the latitude and longitude of the current location are obtained (S4-2). The public data processing unit 112 transmits the current location information (latitude and longitude) to the server SV via the request transmission unit 115 (S4-3). The server SV returns a plurality of store data (store name, store position) in the surrounding area together with the map data centered on the designated latitude and longitude (S4-4, S4-5).

  (Step 5) The public data processing unit 112 acquires map data and store data via the data receiving unit 111, creates display screen data (HTML) (S5-1), and passes it to the display unit 114 (S5- 2). The display unit 114 composes a screen image from the received display data and presents (displays) it to the user. FIG. 7 shows a display image.

  (Step 6) When the user presented with the display screen of FIG. 7 in Step 5 above selects one from the stores displayed on the screen and performs a display operation (click or tap) (S6-1) The public data processing unit 112 receives the selected store name (S6-2). Then, the private data processing unit 113 is requested to display detailed information for the store via the local server 140 (S6-3, S6-4). The private data processing unit 113 that has received this makes an inquiry to the local server 140 using the store name (S6-5). The local server 140 refers to the query data registered in step 3 above, and returns the product list sold by the store (MT store in FIG. 7) to the private data processing unit 113 (S6-). 6).

  (Step 7) The private data processing unit 113 continues to make a purchase history inquiry to the local server 140 (S7-1). The local server 140 makes a purchase history inquiry to the personal data providing unit 130 (S7-2), and when the purchase history is acquired from the personal data providing unit 130 (S7-3), the purchase history is returned to the private data processing unit 113. (S7-4).

  The private data processing unit 113 then sorts the product list sold by the store using personal data (S7-5). Specifically, the private data processing unit 113 uses the purchase history information to rearrange the store product list in the order of the number of times the user has purchased (that is, in the order recommended to the user), and displays it as display data (HTML). Generate (S7-6).

  (Option 3) When the local server 140 accesses the personal data providing unit 130 and reads the personal data in the user terminal 100, the local server 140 alerts the user to read the personal data. An opt-in screen may be displayed. By confirming the opt-in screen, the user can recognize that his / her personal data is used for the service, so that the service can be used more safely.

  Furthermore, at the time of opt-in, the local server 140 may display the signature of the query registered in the local server 140 by the public data processing unit 112 to the user. By confirming that the auditor Y has signed the query, the user can confirm that the third party has verified the contents to determine whether the program that is trying to access his / her personal data performs appropriate processing. , You can use the service with more peace of mind.

  (Option 4) In the first embodiment, the product list for each store is described in the data portion in the query, and the private data processing unit 113 acquires the product list via the local server 140. May be described directly in the HTML part or in the program, or provided in the form of an additional parameter when the public data processing unit 112 obtains it from the server SV and requests the private data processing unit 113 to display the store information. Also good.

  (Step 8) The generated display data is displayed on the display unit 114 so as to be overlaid on the previously displayed display data of the public data processing unit 112 (FIG. 8). In the display example shown in FIG. 8, for example, the recommended product B and the product C at the MT store are displayed as balloons from the MT store.

(Explanation of effects according to the first embodiment)
When such a first embodiment is realized by using conventional browser technology, there is no means for accessing personal data such as purchase history via the browser, so the service provider can check the purchase history of the user. Such a service cannot be provided unless the data is already stored in the server SV. For this reason, it is difficult for a major operator who already has a large number of purchase histories to provide such services, and even a major operator cannot collect all purchase histories of users. Therefore, it is impossible to present recommended products using sufficient data.

  On the other hand, when realized in the form of a conventional application, the application reads personal data from the user terminal 100 and transmits it to an external server, that is, it is possible to abuse personal data. If the application does not have any network communication function / authority to prevent this, external data such as map data cannot be accessed, so the first embodiment as described above cannot be technically realized. .

  In the first embodiment of the present invention, map display data is created in the public data processing unit 112 that can access external data, and the product data is stored in the private data processing unit 113 that cannot access the outside but can access personal data. By creating recommendation data and combining them in the display unit 114, the first embodiment is realized while avoiding the above-described problems.

(Second Embodiment)
In the second embodiment, based on the first embodiment, the private data processing unit 113 is provided with an exception for external access, and a list of stay stores of a plurality of users is aggregated to rank popular stores. A scenario for creating and customizing the map / store data and providing it to the user will be described.

  FIG. 9 shows a connection configuration example of the user terminal 100 of the user A, the user terminal 200 of the user B, the server SVX, and the aggregation server 300 according to the second embodiment, and each functional unit will be described below. Users A and B have terminals 100 and 200, respectively. Each terminal 100, 200 has personal data transmission units 116, 212 in addition to the functional units described in the first embodiment.

  Further, a business operator Y different from the business operator X that provides this service using the server SVX has the aggregation server 300, and the purchase history data of the users A and B are sent only to the aggregation server 300.

  In the second embodiment, in step 3 of the first embodiment, when the local server hosts the HTML part and the data part of the query as a Web server, an HTTP header as shown in FIG. 10 is added. In this case, the URL of the aggregation server 300 is added after the URL of the local server. As a result, the generated private data processing unit 113 can communicate only with the aggregation server 300. The private data processing units 113 and 211 operating on the terminals 100 and 200 access the location information history data in each terminal 100 and 200 via the local server according to the program content described in the query, and store the stores that have stayed in the past. A list is created, and the data (list) is transmitted to the aggregation server 300.

  In the aggregation server 300, the data reception unit 313 receives the data of the stay store list sent from a plurality of users, and the data aggregation unit 312 stores the store having a large number of staying users based on the data of the stay store list (that is, popularity). A process (aggregation process) for creating a ranking of stores is performed, and the data aggregated by the data transmission unit 311 is sent to the server SVX. Thereby, the server SVX can customize the service content provided to the user based on the popular store ranking. Specifically, in step 4 of the first embodiment, when the server SVX returns store data to the user based on the location information, it is more optimized for the user by returning the popular store with priority. The displayed map / store data is displayed.

  In the second embodiment, the service provider X and the provider Y of the tabulation server 300 are separated, and the private data processing units 113 and 211 are limited to only the tabulation server 300 so that the services can be communicated. Even if personal data is not directly transmitted to the provider X, the service can be customized using personal data of a plurality of users.

(Other embodiments)
The apparatus of the present invention can be realized by a computer and a program, and can be recorded on a recording medium or provided through a network.
In short, the present invention is not limited to the above-described embodiment as it is, and can be embodied by modifying the constituent elements without departing from the scope of the invention in the implementation stage. Further, various inventions can be formed by appropriately combining a plurality of constituent elements disclosed in the embodiment. For example, some components may be deleted from all the components shown in the embodiment. Furthermore, you may combine suitably the component covering different embodiment.

  DESCRIPTION OF SYMBOLS 1 ... Data transmission part, 2 ... Data processing part, 3 ... Request receiving part, 100, 200 ... User terminal, 110, 210 ... Information display system (browser), 111 ... Display data receiving part, 112 ... Public data processing part, 113, 211 ... Private data processing unit, 114 ... Display unit, 115 ... Request transmission unit, 116, 212 ... Personal data transmission unit, 300 ... Aggregation server, 311 ... Data transmission unit, 312 ... Data aggregation unit, 313 ... Data reception Part, SV, SVX ... server.

Claims (8)

A personal data storage unit for storing personal data;
A first data processing unit having an external communication function and restricting access to the personal data storage unit;
A second data processing unit that restricts communication with the outside and has a function of accessing the personal data storage unit;
A terminal device comprising: a display unit configured to synthesize and display display data generated by both the first and second data processing units. The second data processing unit has a communication function with the aggregation server,
The aggregation server is
A function of aggregating data transmitted from a plurality of user terminals;
A function of sending the aggregated data to an external server,
The terminal device according to claim 1, wherein the information presented to the user terminal is changed using data collected in the external server.   The terminal device according to claim 1, wherein a plurality of the second data processing units are provided.   The first data processing unit acquires data with an electronic signature from the outside in response to an external data acquisition request from the user, and presents the electronic signature to the user. 4. The terminal device according to any one of items 1 to 3.   5. The first data processing unit according to claim 1, wherein when reading the personal data stored in the personal data storage unit, the second data processing unit presents to the user that the personal data is to be read. The terminal device described in 1. A personal data storage unit for storing personal data; a first data processing unit which has a communication function with the outside, and restricts access to the personal data storage unit; A data processing method used in a terminal device including a second data processing unit having a function of accessing a storage unit,
The first data processing unit transmits an external data acquisition request to the outside,
The first data processing unit receives the data transmitted from the outside in response to the transmission of the acquisition request and generates display data;
The second data processing unit accesses the personal data storage unit to acquire personal data from the personal data storage unit, and generates personal display data from the personal data;
The data processing method, wherein the first and second data processing units synthesize and display the generated display data. The second data processing unit further comprises communicating with a summary server;
The aggregation server is
A function of aggregating data transmitted from a plurality of user terminals;
A function of sending the aggregated data to an external server,
The data processing method according to claim 6, wherein the information presented to the user terminal is changed using data collected in the external server. A program executed by the terminal device, the personal data storage unit storing personal data in the terminal device;
A first data processing unit having an external communication function and restricting access to the personal data storage unit;
A second data processing unit that restricts communication with the outside and has a function of accessing the personal data storage unit;
A program that operates as a display unit that synthesizes and displays display data generated by both the first and second data processing units.