JP2015225385A - Information processing system, information processing method and program - Google Patents

Abstract

PROBLEM TO BE SOLVED: To enable access control in a data element unit in accordance with the security level of personal data and the security level for each device such as a server, terminal and the like using the personal data.SOLUTION: An information processing system comprises a first device, a second device and an access control server. A control part of the access control server acquires a disclosure request of a data element of personal data with respect to the second device and an ID of the second device from the first device or the second device, refers to a device ID-security level DB storing the ID of the second device in association with the security level and a data element-security level DB storing the data element in association with the security level, and determines access propriety of the second device to the data element on the basis of the security level of the second device.

Description

  The present invention relates to an information processing system, an information processing method, and a program according to the security level of an apparatus that uses personal data.

  In general, personal data (data including not only personal information with individual identities but also information with a wide range of personal identities) is derived from pedometer and activity meter data, and the value of electronic money and key data for authentication. To a wide range. Conventionally, when personal data is used in a server or a terminal, it is known that the data is uniformly encrypted and distributed by SSL or the like (for example, Non-Patent Document 1). In this case, the confidentiality of information in communication is guaranteed, but it is preferable to finely control whether data can be accessed according to the security level of information and the security level of the user. Therefore, a technique for determining whether a user can access information (content) from a user management database that defines a user security level and a content management database that defines an information security level is known. (For example, patent document 1).

Japanese Patent No. 4116137

“PKI-related technical information section 7.1 TLS (SSL), IPA, [Online], [May 15, 2014 search], Internet <http://www.ipa.go.jp/security/pki/071 .html> “Fiscal 1999 Smart Card Safety Survey Report, IV.1.1 Security Level, IPA, [Online], [May 15, 2014 Search], Internet <http: //www.ipa. go.jp/security/enc/smartcard/node59.html>

  In the method disclosed in Patent Document 1, access permission is determined by comparing the security level of the user with the security level of the information. However, recent user terminals include not only mobile phones but also wearable devices such as tablets and smart watches. These devices have different security tolerances depending on whether or not a device having tamper resistance is mounted. For this reason, it is impossible to determine whether or not access to the access target information can be made uniformly only from the security level of the user. For example, if access is made to life log information such as pedometer data, tamper resistance is not required for data management. On the other hand, tamper resistance such as falsification prevention and secrecy is required for access to values such as electronic money. For this reason, in a multi-device usage environment, it is necessary to perform access control in accordance with the security level of personal data while considering the security level of each device. In relation to this, the security level of the cryptographic module is defined (for example, Non-Patent Document 2).

  An object of the present invention made in view of the above point is to enable access control in units of data elements according to the security level of personal data and the security level of each device such as a server or a terminal that uses personal data. To provide an information processing system, an information processing method, and a program.

  In order to solve the above-described problem, an information processing system according to the present invention includes a first device, a second device, and an access control server, and the control unit of the access control server controls the second device. A device that acquires a disclosure request for a data element of personal data and an ID of the second device from the first device or the second device, and stores the ID of the second device in association with a security level. With reference to the ID—security level DB and the data element—security level DB that stores the data element in association with the security level, based on the security level of the second device, It is characterized by determining whether or not the data element can be accessed.

  In order to solve the above-mentioned problem, an information processing method according to the present invention is an information processing method by an information processing system including a first device, a second device, and an access control server. Obtaining a disclosure request of a data element of personal data for the second device and an ID of the second device from the first device or the second device by the control unit; The control unit refers to a device ID that stores the second device ID in association with a security level—a security level DB, and a data element that stores the data element in association with a security level—a security level DB. And accessing the data element by the second device based on the security level of the second device. Characterized in that it comprises a step of determining whether.

  In order to solve the above-described problem, a program according to the present invention causes a computer to send a disclosure request for a data element of personal data to a second device and an ID of the second device to the first device or the second device. A device ID that stores the ID of the second device in association with a security level—a security level DB; and a data element that stores the data element in association with a security level—a security level DB And a procedure for determining whether or not the second device can access the data element based on the security level of the second device.

  According to the present invention, it is possible to perform access control in units of data elements according to the security level of personal data and the security level of each device such as a server or a terminal that uses the personal data.

It is a figure showing a schematic structure of an information processing system concerning one embodiment of the present invention. (A) is a functional block diagram of the 1st apparatus in the information processing system of FIG. 1, (b) is a functional block diagram of the 2nd apparatus in the information processing system of FIG. It is a functional block diagram of the access control server in the information processing system of FIG. It is a functional block diagram of the personal data management server in the information processing system of FIG. It is a figure which shows an example of apparatus ID-security level DB and data element-security level DB which concern on Embodiment 1 of this invention. It is a figure which shows an example of the access determination result by the access control server of this invention. It is a figure which shows the operation | movement flow of the information processing system which concerns on Embodiment 1 of this invention. It is a figure which shows an example of apparatus ID-security level DB, data element-security level DB, and user-security level DB which concern on Embodiment 2 of this invention. It is a figure which shows the operation | movement flow of the information processing system which concerns on Embodiment 2 of this invention. It is a figure which shows an example of apparatus ID-security level DB and data element-security level DB which concern on Embodiment 3 of this invention. It is a figure which shows the operation | movement flow of the information processing system which concerns on Embodiment 3 of this invention.

  Hereinafter, each embodiment of the present invention will be described with reference to the drawings.

  FIG. 1 is a diagram showing a schematic configuration of an information processing system according to an embodiment of the present invention. It should be noted that the schematic configuration illustrated in FIG. 1 is an example, and each configuration can be arbitrarily combined. In one embodiment, the first device 1, the second device 2, and the access control server 3 are connected via the network NW, and the personal data management server 4 is connected to the access control server 3. The number of devices connected to the network NW is not limited. The apparatus may be any of a stationary terminal, a portable terminal, a server, and the like.

  2A is a functional block diagram of the first device 1 in the information processing system according to the embodiment of the present invention, and FIG. 2B is a second block diagram of the information processing system according to the embodiment of the present invention. It is a functional block diagram of apparatus 2 of. Each function of the information processing system according to the present invention will be described, but it should be noted that it is not intended to exclude other functions of the information processing system.

  The first device 1 includes a control unit 11, a communication unit 12, and a personal data management unit 13. The control unit 11 controls various operations of the first device 1. For example, the control unit 11 controls the communication unit 12 to make a data element disclosure request to the access control server 3. The personal data management unit 13 manages (stores) data elements of personal data of the user of the first device 1.

  The second device 2 includes a control unit 21, a communication unit 22, and a position information acquisition unit 23. The control unit 21 controls various operations of the second device 2. For example, the control unit 21 controls the communication unit 22 to acquire personal data from the access control server 3. The position information acquisition unit 23 acquires the position information of the second device 2 using GPS (Global Positioning System). The acquired location information is transmitted to the access control server 3, for example, and used for finer access control.

  FIG. 3 is a functional block diagram of the access control server in the information processing system of FIG. The access control server 3 includes a control unit 31, a communication unit 32, an access control file management unit 33, a key management unit 34, and a data processing unit 35. When providing a tamper resistant area in the access control server 3, the control unit 31, the access control file management unit 33, the key management unit 34, and the data processing unit 35 are included in the tamper resistant area.

  The control unit 31 controls various operations of the access control server 3. For example, the control unit 31 controls the communication unit 32 to acquire the ID 2 of the second device 2 that is a personal data disclosure destination candidate from the first device 1 or the second device 2. In addition, the control unit 31 controls the data processing unit 35 to determine whether or not access to the data element of personal data is possible. Further, the control unit 31 controls the communication unit 32 to transmit (disclose) the data element to the second device 2 that is determined to be able to access the data element of personal data.

  The access control file management unit 33 includes a device ID-security level DB (database) 33a, a data element-security level DB 33b, and a user-security level DB 33c. These DBs determine, for example, whether or not the second device 2 can access data elements of specific personal data, that is, whether or not personal data can be disclosed to the second device 2. Used for such purposes.

  The device ID-security level DB 33a stores the ID of the device requesting the disclosure of the data element or the disclosure destination device of the data element of personal data and the security level in association with each other.

  The security level of the device is determined as follows, for example. A security level 1 device has low attack resistance and correctly implements a cryptographic algorithm, but does not have a tamper detection function. A security level 2 device has a moderate attack resistance and a tamper detection function. The security level 3 apparatus has a strong attack resistance and has not only a tamper detection function but also a function of deleting secret information at the time of tamper detection.

  The data element-security level DB 33b stores the data element of personal data in association with the security level and the management location of the data element for each user ID.

  The security level of the data element of personal data is determined as follows, for example. The data element of security level 1 is personal data, life log data, or the like that requires relatively little confidentiality or authenticity. Data elements of security level 2 are personal data, address, name, physical health data, electronic money information, etc. that require medium confidentiality and authenticity. Data elements of security level 3 are personal data, credit card information, highly sensitive personal data, and the like that are strongly required to be concealed and authentic.

  The user-security level DB 33c stores the users of the first device 1 and / or the second device 2 in association with the security level.

  The security level of the user is a level that determines whether or not the data element can be accessed, for example, according to attribute information such as the user's belonging group or job title. By using the user's security level, for example, when the user tries to access the material (data element) stored in the shared server of the company, depending on the security level of the user and the security level of the material, It is possible to perform access control by making a difference between materials accessible to the user.

  The key management unit 34 performs management of certificates of the access control server 3, management of encryption keys of personal data, management of user authentication and terminal authentication keys, generation and management of session keys, and the like.

  The data processing unit 35 performs user authentication and device authentication of devices and the like. The data processing unit 35 encrypts and decrypts personal data using the session key, and encrypts and decrypts personal data stored in the personal data management server 4. The data processing unit 35 performs access control based on the security level of personal data, the security level of a device such as a device, and the security level of a user. Furthermore, the data processing unit 35 also performs access control based on the location of the user portable terminal, erasing data on the device by remote operation, timer processing, and the like.

  FIG. 4 is a functional block diagram of the personal data management server in the information processing system of FIG. The personal data management server 4 includes a control unit 41, a communication unit 42, and a personal data management unit 43.

  The control unit 41 controls various operations of the personal data management server 4. For example, the control unit 41 controls the communication unit 42 and acquires personal data to be managed from the access control server 3. The personal data management unit 43 manages (stores) the acquired personal data.

[Embodiment 1]
Hereinafter, Embodiment 1 of the present invention will be described.

  In the first embodiment, the first device 1 is a user terminal 1 and the second device 2 is a Web server 2. The user ID of the user terminal 1 is IDa, the ID of the user terminal 1 is ID1, the ID of the Web server 2 is ID2, and the ID of the personal data management server 4 is ID3.

  As a premise, the security level of personal data and the security levels of the user terminal 1 and the Web server 2 are registered in the device ID-security level DB 33a or the data element-security level DB 33b of the access control server 3. .

  In the first embodiment, personal data is stored in the personal data management unit 43 in an encrypted state.

  The user terminal 1 accesses the Web server 2. In order to access the personal data of the user of the user terminal 1, the Web server 2 transmits information for specifying a data element of necessary personal data to the user terminal 1.

  The user terminal 1 accesses the access control server 3, and the access control server 3 authenticates the user of the user terminal 1 with IDa and the user terminal 1 with ID1. The user terminal 1 and the access control server 3 perform mutual authentication. Authentication by the access control server 3 is performed by the data processing unit 35. The user terminal 1 shares a session key with the access control server 3.

  The user terminal 1 transmits to the access control server 3 ID1 as the ID of the disclosure request source apparatus, ID2 as the ID of the disclosure destination apparatus, and information specifying the data element of the personal data that the Web server 2 requests to disclose. .

  After acquiring these pieces of information, the data processing unit 35 refers to the access control file management unit 33 to determine whether or not the Web server 2 can access the data element designated by the Web server 2.

Specifically, the data processing unit 35 refers to the following access condition formula to determine what information is necessary for determining whether access is possible.
(Access conditional expression)
・ Data element security level ≦ ID1 security level ・ Data element security level ≦ ID2 security level

  From the above access conditional expression, the information necessary for determining whether access is possible is the security level of the data element, the security level of ID1, and the security level of ID2.

  The data processing unit 35 refers to the device ID-security level DB 33a as shown in FIG. 5 and determines that the security levels of ID1 and ID2 are 3 and 2, respectively. Therefore, in the first embodiment, the security level of the data element satisfying the access condition expression is 3 or less and 2 or less, that is, 2 or less from the access condition expression.

  The data processing unit 35 refers to the data element-security level DB 33b shown in FIG. If the data elements requested to be disclosed by the Web server 2 are data elements 1 to 4, the data processing unit 35 determines that the security levels of the data elements 1 to 4 are 3, 2, 3, and 1, respectively. Since the data elements having a security level of 2 or less among these are the data elements 2 and 4, the data processing unit 35 determines that only the data elements 2 and 4 among the data elements 1 to 4 are accessible.

  In addition to the numerical examples described above, FIG. 6 illustrates an example of the result of access permission determination when the disclosure request source device, the disclosure destination device, and the data element have various security levels.

  Returning to the description of the first embodiment. After determining that only the data elements 2 and 4 are accessible, the data processing unit 35 performs mutual authentication with the Web server 2. The key management unit 34 generates a session key and shares the session key with the Web server 2. The communication unit 32 transmits the data element determined to be accessible and decrypted by the data processing unit 35 or the decryption key of the data element determined to be accessible to the Web server 2 by secure communication. When the decryption key is transmitted, the Web server 2 acquires the data element from the personal data management server 4 and decrypts it. The generated session key is managed by the key management unit 34.

  The Web server 2 performs an arbitrary predetermined process using the data elements 2 and 4, and transmits a process completion notification to the access control server 3 after the process ends.

  When acquiring the processing completion notification, the data processing unit 35 transmits a data element deletion request to the Web server 2 to delete the data element or the decryption key by remote operation. After erasure, the Web server 2 transmits an erasure completion notification to the access control server 3.

  FIG. 7 is a diagram showing an operation flow of the information processing system according to the first embodiment of the present invention. When the user terminal 1 accesses the Web server 2 (Step S1), the Web server 2 requests to disclose data elements of personal data (Step S2). The user terminal 1 performs user authentication, mutual authentication, and session key sharing with the access control server 3 (step S3). In addition, the user terminal 1 transmits ID1 as the ID of the disclosure request source apparatus, ID2 as the ID of the disclosure destination apparatus, and information specifying the data element to the access control server 3 (step S4). The access control server 3 refers to the access control file management unit 33 based on the acquired information, and determines whether or not access is possible to the data element of the personal data that the Web server 2 requests to disclose (step S5). When the access control server 3 determines that access is not possible (No in step S5), the access control server 3 transmits an access impossibility notification to the web server 2.

  On the other hand, when it is determined that the access control server 3 is accessible (Yes in step S5), the access control server 3 performs mutual authentication with the Web server 2 and shares a session key (step S6). Next, the access control server 3 transmits data elements determined to be accessible (decrypted data elements, data element decryption keys, etc.) to the Web server 2 (step S7). The Web server 2 performs an arbitrary predetermined process based on the data element or the like (step S8). After completion of the predetermined process, the Web server 2 transmits a process completion notification to the access control server 3 (step S9). When the access control server 3 obtains the processing completion notification, the access control server 3 sends a deletion request for data elements or the like to the Web server 2 (step S10). The Web server 2 performs erasure in response to the erasure request (step S11), and transmits an erasure completion notification to the access control server 3 (step S12).

[Embodiment 2]
Hereinafter, the second embodiment of the present invention will be described as another embodiment.

  In the second embodiment, the first device 1 is the data manager terminal 1 and the second device 2 is the user portable terminal 2. The ID of the user of the data manager terminal 1 is IDa, the ID of the data manager terminal 1 is ID1, the ID of the user of the user portable terminal 2 is IDb, and the ID of the user portable terminal 2 is ID2.

  As a premise, the security level of personal data, the security level of the data manager terminal 1 and the user portable terminal 2, and the security level of the user of the data manager terminal 1 and the user portable terminal 2 are It is assumed that it is registered in the device ID-security level DB 33a, data element-security level DB 33b, or user-security level DB 33c.

  In the second embodiment, personal data is stored in the personal data management unit 43 in an encrypted state. Personal data is registered by a data manager (a user of the data manager terminal 1).

  In the personal data, access permission may be set for each user ID as necessary. When access permission is set for each user ID and there is an access request from a user who is set to be inaccessible, it may be determined that access is not possible without performing an access permission determination process described later.

  The user portable terminal 2 accesses the access control server 3, and the access control server 3 authenticates the user of the user portable terminal 2 with IDb and the user portable terminal 2 with ID2. The user portable terminal 2 and the access control server 3 perform mutual authentication. Authentication by the access control server 3 is performed by the data processing unit 35. The user portable terminal 2 shares a session key with the access control server 3.

  The user portable terminal 2 includes IDb as the ID of the user of the disclosure request source device and the disclosure destination device, ID2 as the ID of the disclosure request source device and the disclosure destination device, and personal data requested by the user portable terminal 2 to be disclosed. The information specifying the data element and the location information of the user portable terminal 2 are transmitted to the access control server 3.

  The position information is acquired by the position information acquisition unit 23. The location information may be transmitted together with transmitting the ID information to the access control server 3, or may be transmitted when requested by the access control server 3.

  After acquiring these pieces of information, the data processing unit 35 refers to the access control file management unit 33 and determines whether or not the user portable terminal 2 can access the data element designated by the user portable terminal 2. Determine. That is, the data processing unit 35 determines whether or not the data element may be disclosed to the user portable terminal 2.

Specifically, the data processing unit 35 refers to the following access condition formula to determine what information is necessary for determining whether access is possible.
(Access conditional expression)
・ Data element security level ≦ ID2 security level ・ ID2 exists in an area accessible to the data element ・ Data element security level ≦ IDb security level

  From the above access conditional expression, the information necessary for determining whether access is possible is the security level of the data element, the security level of ID2, the location information of ID2, and the security level of IDb.

  Therefore, the data processing unit 35 determines that the security level of ID2 is 2 with reference to the device ID-security level DB 33a as shown in FIG. Further, the data processing unit 35 determines that the security level of IDb is 3 with reference to the user-security level DB 33c as shown in FIG.

  In the second embodiment, a data element satisfying the above access condition expression has a security level of 2 or less and 3 or less, that is, 2 or less, and ID2 exists in an area accessible to the data element. is there.

  The data processing unit 35 refers to the data element-security level DB 33b. If the data elements that the user portable terminal 2 requested to disclose are data elements 1 to 4, the data processing unit 35 determines that the security levels of the data elements 1 to 4 are 3, 2 (area A), 3 and 1, respectively. To do. Among these, data elements having a security level of 2 or less are data elements 2 and 4.

  In the data element-security level DB 33b, the data element 2 of the data elements 2 and 4 requests on the condition that the position information of the disclosure destination device indicates the area A. On the other hand, the data element 4 does not request on condition that the position information of the disclosure destination device indicates the area A.

  The data processing unit 35 determines that the data elements 2 and 4 are accessible when the position information of the user portable terminal 2 indicates the area A. On the other hand, when the position information of the user portable terminal 2 indicates an area other than the area A or when the position information of the user portable terminal 2 is not acquired, it is determined that only the data element 4 is accessible. When there is no data element determined to be accessible, the access control server 3 transmits an access impossible notification to the user portable terminal 2.

  If there is a data element determined to be accessible, the data processing unit 35 performs mutual authentication with the user portable terminal 2. In addition, the key management unit 34 generates a session key and shares the session key with the user portable terminal 2. The communication unit 32 transmits the data element determined to be accessible and decrypted by the data processing unit 35 or the decryption key of the data element determined to be accessible to the user portable terminal 2 by secure communication. When the decryption key is transmitted, the user portable terminal 2 acquires the data element from the personal data management server 4 and decrypts it. The generated session key is managed by the key management unit 34.

  The user portable terminal 2 performs an arbitrary predetermined process using the data element.

  The data processing unit 35 starts a timer. When the time set by the timer elapses, the access control server 3 requests location information from the user portable terminal 2. When the position information is acquired from the user portable terminal 2, the data processing unit 35 determines whether or not the position information indicates the area A.

  If the position information indicates area A, the data processing unit 35 then starts a timer at a predetermined time point, and requests the user portable terminal 2 for the position information again after the set time has elapsed. As long as the position information indicates the area A, the data processing unit 35 requests and acquires the position information at a predetermined time interval (fixed frequency).

  On the other hand, when the position information does not indicate the area A or when the position information cannot be acquired, the access control server 3 issues an erasure request for erasing the data element corresponding to the user portable terminal 2 or its decryption key. By sending it, it is deleted by remote control.

  If the deletion completion notification is not transmitted from the user portable terminal 2 even after a predetermined time has elapsed, the access control server 3 retransmits the deletion request.

  FIG. 9 is a diagram showing an operation flow of the information processing system according to the second embodiment of the present invention. The data manager terminal 1 registers a data element of personal data in the access control server 3 (step S21). The access control server 3 performs user authentication, mutual authentication, and session key sharing with the user portable terminal 2 (step S22). Further, the user portable terminal 2 includes IDb as the ID of the user of the disclosure request source device and the disclosure destination device, ID2 as the ID of the disclosure request source device and the disclosure destination device, information specifying the data element, and the disclosure destination device The position information is transmitted to the access control server 3 (step S23). The access control server 3 refers to the access control file management unit 33 based on the acquired information, and determines whether or not access to the data element of the personal data requested by the user portable terminal 2 is made (step S24). When the access control server 3 determines that access is not possible (No in step S24), the access control server 3 transmits an access prohibition notification to the user portable terminal 2.

  On the other hand, when it is determined that the access control server 3 is accessible (Yes in step S24), the access control server 3 performs mutual authentication with the user portable terminal 2 and shares a session key (step S25). Next, the access control server 3 transmits the data element determined to be accessible (decrypted data element, decryption key of the data element, etc.) to the user portable terminal 2 (step S26). The user portable terminal 2 performs arbitrary predetermined processing based on the data element or the like (step S27).

  The access control server 3 starts a timer (step S28). When the time set by the timer elapses, the access control server 3 requests location information from the user portable terminal 2 (step S29). When the access control server 3 acquires position information from the user portable terminal 2 (step S30), the access control server 3 determines again whether or not access is possible based on the newly acquired position information (step S31). When it determines with the access control server 3 being accessible (Yes of step S31), the user portable terminal 2 and the access control server 3 repeat step S30 from step S28.

  When the access control server 3 determines that access is not possible (No in step S31), the access control server 3 transmits a deletion request for data elements and the like to the user portable terminal 2 (step S32). The user portable terminal 2 deletes the data element or the like (step S33), and transmits a deletion completion notification to the access control server 3 (step S34). The access control server 3 resends the erasure request when the erasure completion notification cannot be acquired even after a predetermined time has elapsed (step S35).

[Embodiment 3]
Hereinafter, a third embodiment of the present invention will be described as still another embodiment.

  In the third embodiment, the first device 1 is the user terminal 1, and the second device 2 is the user terminal 2 of the same user as the user of the user terminal 1. Also, IDs of the users of the user terminal 1 and the user terminal 2 are both IDa.

  As a premise, the security level of personal data and the security levels of the user terminal 1 and the user terminal 2 are registered in the device ID-security level DB 33a or the data element-security level DB 33b of the access control server 3. To do.

  In the third embodiment, personal data is stored in the user terminal 1 in an encrypted state or a plain text state.

  The user terminal 1 accesses the access control server 3, and the access control server 3 authenticates the user of the user terminal 1 with IDa and the user terminal 1 with ID1. The user terminal 1 and the access control server 3 perform mutual authentication. Authentication by the access control server 3 is performed by the data processing unit 35. The user terminal 1 shares a session key with the access control server 3.

  The user terminal 1 receives ID1 as the ID of the disclosure request source apparatus, ID2 as the ID of the disclosure destination apparatus, and information specifying the data element of the personal data required to be disclosed to the user terminal 2 as the access control server 3. Send to.

  After acquiring these pieces of information, the data processing unit 35 refers to the access control file management unit 33 to determine whether or not the user terminal 2 can access the data element. That is, the data processing unit 35 determines whether or not the data element may be disclosed to the user terminal 2.

Specifically, the data processing unit 35 refers to the following access condition formula to determine what information is necessary for determining whether access is possible.
(Access conditional expression)
・ Data element security level ≦ ID1 security level ・ Data element security level ≦ ID2 security level

  From the above access conditional expression, the information necessary for determining whether access is possible is the security level of the data element, the security level of ID1, and the security level of ID2.

  Therefore, the data processing unit 35 refers to the device ID-security level DB 33a as shown in FIG. 10 and determines that the security levels of ID1 and ID2 are 3 and 2, respectively.

  In the third embodiment, the security level of the data element satisfying the access condition formula is 3 or less and 2 or less, that is, 2 or less.

  The data processing unit 35 refers to a data element-security level DB 33b as shown in FIG. If the data elements requested to be disclosed by the Web server 2 are data elements 1 to 4, the data processing unit 35 determines that the security levels of the data elements 1 to 4 are 3, 2, 3, and 1, respectively. Since the data elements having a security level of 2 or less among these are the data elements 2 and 4, the data processing unit 35 determines that only the data elements 2 and 4 among the data elements 1 to 4 are accessible.

  After determining that only the data elements 2 and 4 are accessible, the data processing unit 35 performs mutual authentication with the user terminal 2. In addition, the key management unit 34 generates a session key and shares the session key with the user terminal 2. The access control server 3 acquires the data elements 2 and 4 from the user terminal 1.

  The data processing unit 35 refers to the data element-security level DB 33b and determines that, of the data elements 2 and 4, the data element 2 is not copyable and the data element 4 is copyable. The data processing unit 35 transmits a deletion request for the data element 2 to the user terminal 1. That is, the access control server 3 deletes the data element 2 by remote operation.

  When the communication unit 32 obtains the deletion completion notification from the user terminal 1, the communication unit 32 determines that the data element is determined to be accessible and is decrypted by the data processing unit 35, the decryption key of the data element determined to be accessible, or is accessible. The data element (when the data element is stored in the user terminal 1 in a plain text state) is transmitted to the user terminal 2 by secure communication. When the decryption key is transmitted, the user terminal 2 acquires the data element from the user terminal 1 and decrypts it. The generated session key is managed by the key management unit 34. The user terminal 2 writes the acquired information.

  As another processing procedure, the access control server 3 determines that only the data elements 2 and 4 are accessible, and then acquires the data elements 2 and 4 from the user terminal 1 and A token may be issued that allows copying of data elements 2 and 4. In this case, the user terminal 2 presents the data elements 2 and 4 without going through the access control server 3 by presenting the token to the user terminal 1. The process in which the access control server 3 determines whether or not the data elements 2 and 4 are copyable and if the copy is not possible, causes the user terminal 1 to delete the non-copyable data element is the same in this processing procedure.

  In the third embodiment, the data element 2 stored in the user terminal 1 is copied to the user terminal 2 after being deleted, so that the uniqueness of the data element 2 is guaranteed.

  FIG. 11 is a diagram illustrating an operation flow of the information processing system according to the third embodiment of the present invention. The user terminal 1 performs user authentication, mutual authentication, and session key sharing with the access control server 3 (step S41). Further, the user terminal 1 transmits ID1 as the ID of the disclosure request source apparatus, ID2 as the ID of the disclosure destination apparatus, and information specifying the data element to the access control server 3 (step S42). The access control server 3 refers to the access control file management unit 33 based on the acquired information, and determines whether or not access to the data element of the personal data requested by the user terminal 2 is made (step S43). When the access control server 3 determines that access is not possible (No in step S43), the access control server 3 transmits an access impossibility notification to the user terminal 2.

  On the other hand, when it is determined that the access control server 3 is accessible (Yes in step S43), the access control server 3 performs mutual authentication with the user terminal 2 and shares a session key (step S44). Next, the access control server 3 acquires a data element determined to be accessible (step S45), and determines a copy enabled or non-copyable attribute for each data element (step S46). If copy is not possible (Yes in step S46), the access control server 3 transmits to the user terminal 1 a request to delete the data element determined to be uncopyable (step S47). The user terminal 2 performs erasure in response to the erasure request (step S48), and transmits an erasure completion notification to the access control server 3 (step S49). When the access control server 3 determines that copying is possible (No in step S46), steps S47 to S49 are not performed.

  The access control server 3 transmits the data element determined to be accessible to the user terminal 2 (step S50). The user terminal 2 writes the acquired data element or the like in the user terminal 2 (step S51).

  As described above, as described in the first to third embodiments, it is possible to perform access control in units of data elements according to the security level of personal data and the security level of each device such as a server or a terminal that uses personal data.

  When the first device 1, the second device 2, the access control server 3 and / or the personal data management server 4 according to the present invention are configured by a computer, a program describing processing contents for realizing each function is provided. It can be realized by storing the program in a storage unit inside or outside the computer, and reading and executing the program by a central processing unit (CPU) of the computer. In addition, such a program can be distributed by selling, transferring, or lending a portable recording medium such as a DVD or a CD-ROM, and such a program is stored in a storage unit of a server on a network, for example. And the program can be distributed by transferring the program from the server to another computer via the network. In addition, a computer that executes such a program can temporarily store, for example, a program recorded on a portable recording medium or a program transferred from a server in its own storage unit. As another embodiment of the program, the computer may directly read the program from a portable recording medium and execute processing according to the program, and each time the program is transferred from the server to the computer. In addition, the processing according to the received program may be executed sequentially. Therefore, the present invention is not limited to the above-described embodiments, and various modifications can be made by combining or partially deleting the same without departing from the spirit of the present invention.

DESCRIPTION OF SYMBOLS 1 1st apparatus 2 2nd apparatus 3 Access control server 4 Personal data management server 11 Control part 12 Communication part 13 Personal data management part 21 Control part 22 Communication part 23 Location information acquisition part 31 Control part 32 Communication part 33 Access control File management unit 33a Device ID-Security level DB
33b Data element-Security level DB
33c User-Security Level DB
34 Key management unit 35 Data processing unit 41 Control unit 42 Communication unit 43 Personal data management unit

Claims (8)

In an information processing system comprising a first device, a second device, and an access control server,
The control unit of the access control server is
Obtaining a disclosure request of the data element of personal data for the second device and the ID of the second device from the first device or the second device;
With reference to the device ID—security level DB for storing the ID of the second device in association with the security level and the data element for storing the data element in association with the security level—security level DB, An information processing system for determining whether or not the second device can access the data element based on a security level of the second device. The information processing system according to claim 1,
The information processing system further includes a personal data management server that stores data elements of the personal data.
The control unit of the access control server further includes:
Obtaining the disclosure request and the ID of the second device from the first device;
Obtaining an ID of the first device from the first device;
With reference to the device ID-security level DB that stores the ID of the first device in association with the security level, whether access is possible is determined based on the security level of the first device;
If it is determined that access is possible as a result of the determination, the information processing system transmits a decryption key for the data element or the data element to the second device. The information processing system according to claim 1,
The information processing system further includes a personal data management server that stores data elements of the personal data.
The control unit of the access control server further includes:
Obtaining the disclosure request and the ID of the second device from the second device;
Obtaining location information of the second device from the second device;
Further, referring to the device ID-security level DB that stores location information that enables access to the data element, it is determined whether access is possible based on the location information,
If it is determined that the access is possible as a result of the determination, the decryption key of the data element or the data element is transmitted to the second device, new position information is acquired at a predetermined time interval, and the determination is performed again. Done
As a result of the determination again, in response to determining that the new position information does not satisfy the condition stored in the data element-security level DB, or that the processing using the data element has been completed. An information processing system for transmitting a decryption key for the data element or an erasure request for erasing the data element in response to obtaining a notification from the second device. The information processing system according to claim 1,
The first device stores data elements of the personal data;
The control unit of the access control server further includes:
Obtaining the disclosure request and the ID of the second device from the first device;
Obtaining an ID of the first device from the first device;
Refer to the device ID-security level DB that stores the ID of the first device in association with the security level, and determine whether access is possible based on the ID of the first device;
As a result of the determination, if it is determined that access is possible, and it is further determined that there is a data element that cannot be copied with reference to the data element-security level DB, it is determined that the first device cannot copy. An information processing system for transmitting an erasure request for erasing a data element. The information processing system according to claim 4,
If the control unit further determines that the access is possible as a result of the determination, the control unit issues a token that permits copying of the data element to the second device,
The information processing system, wherein the second device acquires the data element from the first device by indicating the token to the first device. The information processing system according to any one of claims 1 to 5,
The control unit further includes:
Obtaining the ID of the user of the second device;
The determination is made based on the security level of the user of the second device with reference to the user-security level DB that stores the ID of the user of the second device in association with the security level. Information processing system. In an information processing method by an information processing system including a first device, a second device, and an access control server,
Obtaining from the first device or the second device the disclosure request of the data element of the personal data to the second device and the ID of the second device by the control unit of the access control server;
Device ID that stores the ID of the second device in association with a security level by the control unit of the access control server—Security level DB; and Data element that stores the data element in association with a security level—Security level An information processing method, comprising: referring to DB; and determining whether or not the second device can access the data element based on a security level of the second device. On the computer,
A procedure for obtaining a disclosure request for a data element of personal data to the second device and an ID of the second device from the first device or the second device;
With reference to the device ID—security level DB for storing the ID of the second device in association with the security level and the data element for storing the data element in association with the security level—security level DB, A procedure for determining whether the second device can access the data element based on a security level of the second device;
A program for running

Images