JP2016218739A - Data masking device, data masking method, and computer program - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide a data masking technique for further improving usability of a document after masking information.SOLUTION: A data masking device 14 holds replacement character strings of a plurality of information items recorded in an original document 16 and associated with each other. Between the replacement character strings of the plurality of items held by the data masking device 14, a relation between original character strings of the plurality of information items recorded in the original document 16 is maintained. The data masking device 14 generates a conversion document 18 by replacing the original character strings of the plurality of information items recorded in the original document 16 with the preliminarily held replacement character strings of the plurality of information items.SELECTED DRAWING: Figure 1

Description

  The present invention relates to a data processing technique, and more particularly to a data masking technique.

  The present applicant has proposed a technique for suppressing deterioration in quality as test data for a document after masking personal information (see, for example, Patent Document 1). The data conversion apparatus of Patent Document 1 replaces a character string indicating personal information to be masked with the hash value.

JP 2013-246547 A

  The inventor considered that the significance of the mask may be lost if the original character string can be estimated from the character string after masking. Also, if the character strings of multiple information items that are related to each other, such as kanji surname and kana surname, are masked in one item unit, the relationship between the information items will be lost and the value as test data will be reduced. It was. The present invention has been made on the basis of the above-mentioned problem recognition of the present inventor, and a main object thereof is to provide a data masking technique for further enhancing the usefulness of a document after masking information.

  In order to solve the above problems, a data masking device according to an aspect of the present invention provides a replacement character string that is a plurality of information items recorded in original data and holds replacement character strings of a plurality of information items related to each other. A holding unit; and a character string replacement unit that replaces the original character strings of the plurality of information items recorded in the original data with the replacement character strings of the plurality of information items held in the replacement character string holding unit. The relationship between the original character strings of the plurality of information items recorded in the original data is maintained between the replacement character strings of the plurality of information items held in the replacement character string holding unit.

  Another aspect of the present invention is a data masking method. This method is a plurality of information items recorded in the original data, and refers to a storage area that stores a replacement character string of the plurality of information items related to each other. The data masking device executes a step of replacing the original character string with a replacement character string of a plurality of information items stored in the storage area, and the original data between the replacement character strings of the plurality of information items stored in the storage area The relationship between the original character strings of a plurality of information items recorded in is maintained.

  It should be noted that any combination of the above components and the expression of the present invention converted between a system, a computer program, a recording medium storing the computer program, and the like are also effective as an aspect of the present invention.

  According to the present invention, the usefulness of a document after information is masked can be further enhanced.

It is a figure which shows the structure of the information processing system of 1st Embodiment. It is a block diagram which shows the structure of the data masking apparatus of FIG. It is a figure which shows the conversion dictionary hold | maintained at the conversion dictionary holding | maintenance part of 1st Embodiment. It is a figure which shows the conversion dictionary of a modification. It is a figure which shows the conversion dictionary hold | maintained at the conversion dictionary holding | maintenance part of 2nd Embodiment. It is a figure which shows the conversion dictionary hold | maintained at the conversion dictionary holding | maintenance part of 2nd Embodiment. It is a figure which shows the conversion dictionary of a modification. It is a figure which shows the conversion dictionary hold | maintained at the conversion dictionary holding | maintenance part of 3rd Embodiment.

  Before describing the configuration of the information processing system according to the embodiment, an outline of data masking according to the embodiment will be described. In the following, original document data before masking data is called an original document, and document data after data masking is called a converted document. Further, it is a character string recorded in the original document, that is, an original character string as original data is called an original character string. A character string for replacing the original character string, that is, a character string recorded in place of the original character string in the converted document is referred to as a replacement character string.

  The data masking of the embodiment is to replace the original character string in the original document with a different replacement character string. It can also be said that the information content indicated by the data is invisible and concealed while maintaining the data format.

  A first problem recognized by the present inventors in data masking will be described. As a method of masking personal information, a method of replacing an original character string with a random character string has been adopted so far. For example, the original character strings “Yamada”, “Sasaki”, and “Tanaka” relating to a person's last name may be replaced with “Jie”, “Noii”, and “Yamau”, respectively. As another method, a method of replacing an original character string with a fixed character string may be adopted. For example, the original character strings “Yamada”, “Sasaki”, and “Tanaka” may be replaced with “Sato 01”, “Sato 02”, and “Sato 03”, respectively.

  However, in such a method, consistency between the original character string and the replacement character string is not maintained. For example, when “Jie”, “Noii”, “Yamau” are set in the information item “last name” of the converted document, the user of the converted document intuitively knows that the character string is “last name”. Difficult to distinguish. In addition, when “Sato 01”, “Sato 02”, and “Sato 03” are set in the information item “last name” of the converted document, the user of the converted document may feel uncomfortable. Further, when a test is performed using such a converted document, it may be difficult to determine whether the test result is correct.

  Such a problem can also occur when the original character string is replaced with a hash character string. For example, since a hash value is set for the information item “last name” of the converted document, it is difficult for the user of the converted document to intuitively determine that the character string is “last name”, and may feel uncomfortable. . In addition, it may be difficult to determine whether the test result using the converted document is correct.

  Thus, when masking with a random character string or a fixed character string, the quality from the viewpoint of using the converted document may be deteriorated. Therefore, as another method, a method of masking according to some rule may be adopted. For example, a dictionary that associates “Suzuki” with “Mitamura”, “Sato” with “Moriya”, and “Kikuchi” with “Nakada” is provided, and the original character strings “Suzuki”, “Sato”, and “Kikuchi” are set to “Mitamura”. Sometimes replaced with "Moriya" and "Nakada".

  However, this method has a problem that the original original character string can be easily guessed from the replacement character string because the character string replacement is performed according to a rule predetermined in the dictionary. For example, because “Mitamura” and “Moriya” appear frequently in the information item “Last name” in the converted document, it is assumed that “Mitamura” and “Moriya” are actually “Suzuki” and “Sato” (a surname most commonly used by Japanese people). Will be. In addition, it is easy for a person who knows to some extent the original data before masking to guess the original original character string due to the appearance tendency of a specific replacement character string.

  Next, a second problem recognized by the inventor in data masking will be described. When multiple information items that are related to each other are to be replaced, if masking is performed in units of one information item, the relationship between the original character strings of the plurality of information items is between the replacement character strings of the plurality of information items after masking. Not reflected. For example, if the information items “Kanji surname” and “Kana surname” are to be replaced, if the replacement character strings of “Kanji surname” and “Kana surname” are individually determined, the relationship between kanji and reading will be lost after masking. End up.

  Specifically, it is assumed that the original character strings “Yamada”, “Sasaki”, and “Nakada” of the information item “Kanji surname” are replaced with the replacement character strings “Sato”, “Suzuki”, and “Nakada”, respectively. On the other hand, it is assumed that the original character strings “Yamada”, “Sato”, “Nakata” of the information item “Kana surname” are respectively replaced with the replacement character strings “Taniguchi”, “Kawaguchi”, “Onai”. In this case, “Yamada” and “Yamada” in the original document become “Sato” and “Taniguchi” in the converted document, and the user of the converted document may feel uncomfortable. In addition, when such a converted document is subjected to a kana surname sorting function or search function test, it may be difficult to determine whether the test result is correct or not.

  In order to solve the first problem, the data masking technology of the embodiment determines, as feature 1, a replacement character string based on a combination of original character strings of a plurality of information items (for example, first name and last name). In order to solve the second problem, as the feature 2, a conversion dictionary reflecting the relationship (relationship) between information items in the original document is held, and the information in the original document is referred to by referring to the conversion dictionary. Perform masking while maintaining the relationship between items.

  The feature 1 will be described in the first embodiment (hereinafter referred to as “first embodiment”), and the feature 2 will be described in the second embodiment (hereinafter referred to as “second embodiment”). I will explain. An example of combining feature 1 and feature 2 will be described in a third embodiment (hereinafter referred to as “third embodiment”).

(First embodiment)
FIG. 1 shows a configuration of an information processing system according to the first embodiment. The information processing system 100 includes a production machine 10, a testing machine 12, and a data masking device 14. The production machine 10 is an information processing apparatus installed in a production environment (commercial environment), such as a web server, an application server, a database server, or a directory server. The test machine 12 is an information processing apparatus installed in a development environment or a test environment.

  The production machine 10 holds information that should be kept secret, such as company customer, end user, and employee personal information, and information that is not permitted to be disclosed. The test machine 12 executes a test using the test data extracted from the production machine 10, and the secret information needs to be concealed in the test data. The data masking device 14 is an information processing device that masks various secret information such as personal information. The data masking device 14 acquires an original document 16 in which information held in the production machine 10 is recorded, and generates a converted document 18 in which confidential information recorded in the original document 16 is masked. The conversion document 18 is provided to the testing machine 12 as test data.

  The original document 16 and the conversion document 18 according to the embodiment are data (for example, CSV) in a table format (in other words, a table structure) in which a plurality of records configured by contents (specifically, character strings) of a plurality of information items are recorded. File). However, the original document 16 and the converted document 18 are not limited to tabular data as long as the information items can be identified. For example, it may be document data of various office suites, RDBMS table data, or a plain text file.

  FIG. 2 is a block diagram showing the configuration of the data masking device 14 of FIG. The data masking device 14 includes a control unit 20, a storage unit 22, and an I / F unit 24. The control unit 20 executes various data processing. The storage unit 22 is a storage area that stores data that is referred to and updated by the control unit 20. The I / F unit 24 provides an interface function with an external device, and communicates with the external device according to various communication protocols. It can be said that the I / F unit 24 is a communication unit. The control unit 20 transmits / receives data to / from the production machine 10 and the test machine 12 via the I / F unit 24.

  Each block shown in the block diagram of the present specification can be realized in terms of hardware by an element such as a CPU of a computer or a mechanical device, and in terms of software, it can be realized by a computer program or the like. The functional block realized by those cooperation is drawn. Therefore, those skilled in the art will understand that these functional blocks can be realized in various forms by a combination of hardware and software.

  For example, a data masking program including a module corresponding to each block in the control unit 20 may be stored in a recording medium such as a DVD and installed in the data masking device 14. Then, even if the processor (CPU or the like) of the data masking device 14 reads out the data masking program stored in the local storage to the main memory and executes it, the function of each block in the control unit 20 can be exhibited. Good. The storage unit 22 may be realized by storing data in the storage or memory of the data masking device 14.

  The storage unit 22 includes a replacement target information holding unit 30 and a conversion dictionary holding unit 32. The replacement target information holding unit 30 holds identification information of an information item to be masked, in other words, a replacement target. The replacement target information holding unit 30 may hold a plurality of information items, for example, a character string indicating “contractor surname”, “contractor name”, “age”, “sex”, “address”, and the like as item identification information. Moreover, information indicating the recording position of each original character string of a plurality of information items in the original document 16, for example, the byte length from the start position of the record, the character string length, and the like may be held as item identification information.

  The conversion dictionary holding unit 32 holds dictionary data (hereinafter also referred to as “conversion dictionary”) that is referred to at the time of character string replacement. The conversion dictionary of the embodiment records replacement character strings of a plurality of information items to be character string replacement targets in association with hash values. The hash value can be said to be an ID of a combination of original character strings of a plurality of information items, and an ID of a combination of replacement character strings of a plurality of information items. It can also be said to be a replacement character string search key.

  FIG. 3 shows an example of the conversion dictionary held in the conversion dictionary holding unit 32 of the first embodiment. The conversion dictionary in FIG. 6 associates hash values with replacement character strings (for example, fictitious surnames and first names) of a plurality of information items “contractor last name” and “contractor name”. One line (one record) of the conversion dictionary is a candidate for the replacement character string, and the conversion dictionary defines a plurality of candidates for the replacement character string over a plurality of records. The conversion dictionary holding unit 32 can also be said to be a candidate character string holding unit that holds a plurality of candidates for replacement character strings at different positions (that is, different records in the conversion dictionary). The conversion dictionary may be configured not to record a hash value. Moreover, the conversion dictionary holding | maintenance part 32 may hold | maintain the separate conversion dictionary independent about each of several information item.

  Returning to FIG. 2, the control unit 20 includes an original document acquisition unit 34, an original character string acquisition unit 36, a replacement character string determination unit 38, a character string conversion unit 40, and a converted document output unit 42. The original document acquisition unit 34 reads the original document 16 output from the production machine 10. The original document obtaining unit 34 may communicate with the production machine 10 via the I / F unit 24 and obtain the original document 16 held in the production machine 10. The original document acquisition unit 34 may read the original document 16 from a medium (DVD, USB memory, etc.) on which the original document 16 output from the production machine 10 is recorded.

  The original character string acquisition unit 36 refers to the replacement target information holding unit 30 to identify a plurality of information items to be replaced, and acquires original character strings of the plurality of information items from the original document. For example, the original character string may be acquired from the column of the replacement target information item in the original document 16, or the original character string may be acquired from the recording position of the replacement target information item in the original document 16.

  The replacement character string determination unit 38 determines a replacement character string of the plurality of information items based on a combination of original character strings of the plurality of information items recorded in the original data. Specifically, among the plurality of replacement character string candidates recorded in the conversion dictionary of the conversion dictionary holding unit 32, the replacement character string is recorded at a position in the dictionary that is specified based on a combination of original character strings of a plurality of information items. Candidates are determined as replacement character strings. More specifically, a value obtained by converting a combination of original character strings of a plurality of information items by a predetermined one-way function is obtained, and a candidate held at a position in the dictionary specified based on the value is replaced with a replacement character. Determine as a column.

  The replacement character string determination unit 38 of the embodiment combines the original character strings of a plurality of information items to be replaced acquired by the original character string acquisition unit 36. The combined character string is input to a predetermined hash function (for example, MD5, SHA-1, etc.) to obtain a hash value. For example, if multiple information items to be replaced are "Contractor Last Name" and "Contractor Name", the original character string "Yamada" for "Contractor Last Name" and the original character string "Taro" for "Contractor Name" Get the hash value of the combined character string “Taro Yamada”.

  The replacement character string determination unit 38 identifies replacement character strings of a plurality of information items to be replaced corresponding to the acquired hash value with reference to the conversion dictionary held in the conversion dictionary holding unit 32. The replacement character string determination unit 38 uses the replacement character string recorded at the line position of the conversion dictionary corresponding to the hash value obtained from the character string obtained by combining the original character strings of the plurality of information items for masking. Determine as. For example, values “1” to “999” may be acquired as hash values. Then, the replacement character string recorded at the line position indicated by the hash value in the conversion dictionary (the 500th line if the hash value is “500”) is determined as the replacement character string used for masking.

  Note that the replacement character string determination unit 38 may execute processing for avoiding occurrence of so-called synonyms that hash values overlap between different original character strings, but suppress processing for avoiding generation of synonyms. May be. This is because the conversion document 18 is typically data for development and testing, and even if the same replacement character string is assigned to different original character strings, a problem does not easily occur. In addition, by allowing synonyms, the number of conversion dictionary records held by the conversion dictionary holding unit 32, that is, the number of replacement character string candidates, can be reduced compared to the number of pieces of information that can be recorded as original character strings.

  The character string conversion unit 40 replaces the original character strings of the plurality of information items to be replaced recorded in the original document 16 with the replacement character strings determined by the replacement character string determination unit 38. For example, the original character strings “Yamada” and “Taro” of the contractor surname and the contractor name in one record of the original document 16 are replaced with the replacement character strings “Kuriyama” and “Higher” determined by the replacement character string determination unit 38. Replace. The character string conversion unit 40 generates a converted document 18 in which the original character string is converted into a replacement character string.

  The conversion document output unit 42 outputs the conversion document 18 generated by the character string conversion unit 40 to a predetermined device. For example, the converted document output unit 42 may transmit the converted document 18 to the testing machine 12 via the I / F unit 24. Further, the converted document 18 may be stored in a local storage or a predetermined recording medium.

The operation of the data masking device 14 having the above configuration will be described below.
A developer or a tester of the information processing system 100 causes the original document 16 including the customer or employee personal information held in the production machine 10 to be output to a recording medium, and causes the data masking device 14 to read the recording medium. . The original document acquisition unit 34 of the data masking device 14 reads the original document 16 from the recording medium. The original character string acquisition unit 36 reads the original character strings of a plurality of information items to be replaced recorded in the original document 16 according to the item identification information stored in the replacement target information holding unit 30 in advance.

  The replacement character string determination unit 38 refers to the conversion dictionary of the conversion dictionary holding unit 32 and determines a replacement character string specified by a combination of original character strings of a plurality of information items to be replaced. The character string conversion unit 40 generates a converted document 18 in which the original character string of the original document 16 is replaced with a replacement character string. The converted document output unit 42 outputs the converted document 18 to a predetermined recording medium as test data in which personal information is masked. The developer or tester outputs the data masking device 14 and causes the conversion document 18 to be read into the tester 12 to develop and test the application.

  According to the data masking device 14 of the first embodiment, a replacement character string is determined based on a combination of original character strings of a plurality of information items in units of a plurality of information items. As a result, the appearance tendency of a specific original character string in the original document 16 can be prevented from being reflected in the converted document 18. For example, even if at least one of a plurality of information items has a high frequency of appearance of a specific original character string, the replacement character string is determined in combination with the original character string of another information item. It can suppress that the appearance frequency of a character string is reflected in the appearance frequency of a specific substitution character string. As a result, it is difficult to infer the original original character string from the replacement character string recorded in the converted document 18, and the risk of information leakage by the converted document 18 can be reduced.

  For example, the plurality of information items are “contractor last name” and “contractor name”, the first record of the original document 16 is “Suzuki” and “Taro”, the second record is “Suzuki” and “Jiro”, and the third record is “ Assume that they are Suzuki and Saburo. In this case, by the data masking of the first embodiment, for example, the first record of the converted document 18 is “Sato” “Nobunaga”, the second record is “Yamaguchi” “Hideyoshi”, and the third record is “Sasaki” “Ieyasu”. Become. When “Suzuki” of “contractor surname” is replaced with a specific replacement character string (for example, “Mitamura”), if “Mitamura” appears in the converted document 18 many times, “Mitamura” is actually You can guess that it is “Suzuki” or “Sato”. In the data masking device 14 of the first embodiment, “Suzuki” is not simply replaced with “Mitamura”, but is replaced with various character strings, making it difficult to guess the original character string from the replacement character string. Become.

  As described above, information items for which it is preferable to determine a replacement character string based on a combination of original character strings of a plurality of information items are information items that have some tendency in the appearance frequency of a specific original character string. For example, in addition to a person's last name, the name of a prefecture in an address or the like, and the department name to which the person belongs are listed. In the case of the prefecture name, it is easy to prevent the original character string “Tokyo” or “Osaka Prefecture” having a large population from being inferred from the replacement character string. In the case of a department name, it is easy to prevent a department name having many employees from being guessed from a replacement character string. The technical idea of the embodiment determines a replacement character string of at least one information item that tends to appear in the appearance frequency of the original character string among the plurality of information items by combining the original character strings of the plurality of information items. It can be said that.

  Further, according to the data masking device 14 of the first embodiment, among the plurality of replacement character string candidates recorded at different positions in the conversion dictionary, the data is recorded at the position specified by the combination of the original character strings of the plurality of information items. The candidate is a replacement character string used for replacement of the original character string. According to this configuration, a specific combination of original character strings is uniquely converted into a specific replacement character string, and the uniqueness of the conversion can be guaranteed.

  Further, according to the data masking device 14 of the first embodiment, a hash value is obtained by inputting a character string obtained by combining original character strings of a plurality of information items into a hash function. Among the plurality of replacement character string candidates recorded at different positions in the conversion dictionary, the candidate recorded at the position of the conversion dictionary specified by the hash value is used as a replacement character string used for replacement of the original character string. According to this configuration, since only the correspondence between the hash value and the replacement character string is recorded in the conversion dictionary, it is difficult to grasp the original character string corresponding to the replacement character string only by looking at the conversion dictionary. Masking safety can be improved.

  The present invention has been described based on the first embodiment. This embodiment is an exemplification, and it will be understood by those skilled in the art that various modifications can be made to combinations of the respective constituent elements and processing processes, and such modifications are also within the scope of the present invention. is there.

  A first modification of the first embodiment will be described. When the original document 16 includes the first information item and the second information item, the replacement character string determination unit 38 combines the original character string of the first information item and the original character string of the second information item in the first mode. The candidate held at the position specified based on the character string may be determined as the replacement character string of the first information item. On the other hand, the replacement character string determination unit 38 sets the original character string of the first information item and the original character string of the second information item at a position specified based on the character string that is combined in a second mode different from the first mode. The held candidate may be determined as the replacement character string of the second information item.

  A specific example using the conversion dictionary of FIG. 3 is shown. When the first information item is the contractor last name and the second information item is the contractor name, the replacement character string determination unit 38 combines the original character strings in the order of the contractor last name and the contractor name from the top (for example, “Taro Yamada”) is input to the hash function to obtain a hash value, and a record corresponding to the hash value is identified. Then, the replacement character string recorded in the record may be determined as the replacement character string of the contractor last name. If the hash value is “123”, the replacement character string of the contractor surname is “Kuriyama”.

  Further, the replacement character string determination unit 38 inputs a character string (for example, “Taro Yamada”) obtained by combining the original character strings in the order of the contractor name and the contractor surname from the beginning to the hash function to obtain a hash value, and the hash Identifies the record corresponding to the value. Then, the replacement character string recorded in the record may be determined as the replacement character string of the contractor last name. If the hash value is “422”, the replacement character string of the contractor name is “Hiraku”.

  According to the configuration of the first modification, the combinations of replacement character strings of a plurality of information items to be masked are further diversified, and it becomes more difficult to estimate the original character string from the replacement character string. For example, in the conversion dictionary of FIG. 3, when the replacement character string of the contractor last name is “Kuriyama”, the replacement character string of the contractor name is not always “higher order”, but “Hiroji” or “Kotaro”. It may be. Further, it is possible to make it more difficult to grasp the original character string corresponding to the replacement character string by looking at the conversion dictionary.

  A second modification of the first embodiment will be described. In the above embodiment, the replacement character string determination unit 38 acquires the hash value by combining the original character strings of the plurality of information items to be replaced. As a modification, after combining the original character strings of the information items, a hash value may be acquired after executing a predetermined character string operation or bit operation. Alternatively, after a predetermined character string operation or bit operation is performed on the original character string of each information item, the hash value may be obtained by combining the character strings after the operation / operation. Alternatively, after obtaining a hash value for each original character string of each information item, the individual hash values may be synthesized by a predetermined operation, and a replacement character string may be determined based on the synthesized value.

  A third modification of the first embodiment will be described. In the above embodiment, the replacement character string recorded at the line position corresponding to the hash value is determined as the replacement character string used for masking. As a modification, the replacement character string determination unit 38 converts the replacement character strings of the plurality of information items associated with the hash values obtained from the character strings obtained by combining the original character strings of the plurality of information items into the conversion dictionary holding unit. You may identify with reference to the conversion dictionary hold | maintained at 32. FIG. That is, the conversion dictionary record in which the hash value obtained from the combined character string is recorded may be identified, and the replacement character string recorded in the record may be determined as a character string used for masking. For example, referring to the conversion dictionary of FIG. 3 and the hash value of “Taro Yamada” combined with the original character string is “123”, the replacement character string of “contractor surname” is determined as “Kuriyama”. The replacement character string of “contractor name” may be determined as “high order”.

  A fourth modification of the first embodiment will be described. The conversion dictionary held by the conversion dictionary holding unit 32 may directly associate the original character string with the replacement character string. FIG. 4 shows a modified conversion dictionary. In the conversion dictionary of the figure, the original character strings (data of “original contractor surname” and “original contractor name” in the figure) of a plurality of information items “contractor surname” and “contractor name” are stored in the information items. Of the replacement character string (data of “substitution contractor surname” and “substitution contractor name” in the figure). In this case, the replacement character string determination unit 38 may search the conversion dictionary using the original character string combinations of a plurality of information items as keys. In the example of FIG. 4, when the combination of the original contractor surname and the original contractor name is “Yamada” and “Taro”, the replacement character string determination unit 38 sets “Kuriyama” as the combination of the replacement contractor surname and the replacement contractor name. Determine “higher order”.

(Second Embodiment)
In the second embodiment, a data masking technique for maintaining the relationship between original character strings of a plurality of information items to be replaced even between the replacement character strings of the plurality of information items will be described. The configuration of the information processing system 100 of the second embodiment is the same as that of the first embodiment (FIG. 1), and the functional block of the data masking device 14 of the second embodiment is also the same as that of the first embodiment (FIG. 2). . Hereinafter, the description which overlaps with 1st Embodiment is abbreviate | omitted, and a different point is mainly demonstrated.

  In a plurality of information items to be masked in the second embodiment, original character strings having contents related to each other are recorded. For example, in a plurality of information items, a first information item in which an original character string in which a certain target / thing is described in the first mode is set, and an original in which the same target / thing is described in a second mode different from the first mode A second information item in which a character string is set is included. In other words, each of the plurality of information items is set with a character string describing the same object / thing in a different manner in appearance. For example, when the first information item is “contractor kanji surname” in which the contractor's surname's kanji is set, the second information item is “contractor kana surname” in which the contractor's surname is set. Is applicable.

  A plurality of information items in which original character strings having contents related to each other are recorded, that is, a plurality of information items for which masking of the second embodiment is effective, may be various in addition to the kanji surname and kana surname. For example, a person's first name and gender, an ID (for example, a prefecture code) and information (for example, a prefecture name) specified by the ID, a prefecture name and a city name, a last name and an email address (the last name in the local part of the email address) (When there is a rule to set romaji).

  The conversion dictionary holding unit 32 holds a conversion dictionary that is a plurality of information items recorded in the original document 16 and indicates replacement character strings of a plurality of information items related to each other. FIG. 5 shows an example of the conversion dictionary held in the conversion dictionary holding unit 32 of the second embodiment. The relationship between the original character strings of the plurality of information items recorded in the original document 16 is maintained between the replacement character strings of the plurality of information items defined by the conversion dictionary. That is, in the conversion dictionary of FIG. 5, the hash value is associated with the replacement character strings of the information items “contractor kanji surname” and “contractor kana surname”. Is set to the reading Kana of “Contractor Kanji Surname”.

  FIG. 6 also shows an example of the conversion dictionary held in the conversion dictionary holding unit 32 of the second embodiment. The relationship between the original character strings of the plurality of information items recorded in the original document 16 is maintained even between the replacement character strings of the plurality of information items defined by the conversion dictionary. That is, character strings that match each other are set in the prefecture code, the prefecture name, and the city name in the same record.

  Returning to FIG. 2, the replacement target information holding unit 30 holds identification information of a plurality of information items related to each other as information items to be replaced. The original character string acquisition unit 36 refers to the replacement target information holding unit 30 and acquires an original character string set for each of a plurality of information items related to each other.

  The replacement character string determination unit 38 is specified based on at least one original character string of a plurality of information items related to each other among a plurality of replacement character string candidates recorded in the conversion dictionary of the conversion dictionary holding unit 32. Candidates recorded at positions in the dictionary are determined as replacement character strings for a plurality of information items. The replacement character string determination unit 38 may determine candidates recorded at positions in the dictionary specified based on combinations of original character strings of a plurality of information items related to each other as replacement character strings of the plurality of information items. Good. Also, a value obtained by converting a combination of original character strings of a plurality of information items related to each other with a predetermined one-way function is obtained, and a candidate held at a position specified based on the value is determined as a replacement character string. May be.

  The replacement character string determination unit 38 of the embodiment combines the original character strings of the plurality of information items acquired by the original character string acquisition unit 36, and inputs the combined character strings into a predetermined hash function to acquire a hash value To do. For example, if multiple information items to be replaced are "Contractor Kanji Surname" and "Contractor Kanji Surname", the original characters of "Contractor Kanji Surname" are the original characters "Yamada" and "Contractor Kana Last Name". Get the hash value of the string “Yamada Yamada” that combines the columns “Yamada”.

  The replacement character string determination unit 38 determines the replacement character string recorded at the line position of the conversion dictionary corresponding to the acquired hash value as the replacement character string used for masking, as in the first embodiment. For example, if the hash value of “Yamada Yamada” is “500”, the replacement character string recorded in the 500th line of the conversion dictionary is determined as the character string used for masking. As a modification, the replacement character string determination unit 38 identifies a record in the conversion dictionary in which the acquired hash value is recorded, as in the third modification of the first embodiment, and the replacement character string recorded in the record May be determined as a character string used for masking. For example, referring to the conversion dictionary of FIG. 5 and the hash value of “Yamada Yamada” is “123”, the replacement character string of “contractor kanji surname” is determined as “Kuriyama” and “contractor kana” The replacement character string of “last name” may be determined as “Kuriyama”.

  The character string conversion unit 40 replaces the original character strings of the plurality of information items to be replaced recorded in the original document 16 with the replacement character strings of the plurality of information items defined by the conversion dictionary held by the conversion dictionary holding unit 32. Replace with. Specifically, the character string conversion unit 40 replaces original character strings of a plurality of information items related to each other with the replacement character strings of the information items determined by the replacement character string determination unit 38.

  The operation of the data masking device 14 of the second embodiment is the same as the operation of the data masking device 14 of the first embodiment. The replacement character string determination unit 38 determines a replacement character string of the plurality of information items determined by the conversion dictionary of the conversion dictionary holding unit 32 according to a combination of original character strings of a plurality of information items related to each other. The character string conversion unit 40 generates a converted document 18 by replacing original character strings of a plurality of information items related to each other with replacement character strings of the plurality of information items determined by the conversion dictionary of the conversion dictionary holding unit 32. .

  According to the data masking device 14 of the second embodiment, for a plurality of mutually related information items recorded in the original document 16 and the converted document 18, the relationship between the original character strings of those information items is maintained even between the replacement character strings. can do. Thereby, it is possible to generate the converted document 18 that is highly effective from the viewpoint of using it as test data or the like. For example, in the case of the conversion dictionary in FIG. 5, the replacement character string for the kanji surname matches the replacement character string for the kana surname. In the case of the conversion dictionary of FIG. 6, the replacement character strings of the prefecture code, the prefecture name, and the city name match.

  Therefore, the Kanji surname is “Kuriyama” and the Kana surname is “Ari”, the prefecture name of the address is “Tokyo”, and the municipality name is “Nishi-ku, Yokohama-shi”, etc. Therefore, it is possible to avoid making the user of the converted document 18 feel uncomfortable. Further, it can be avoided that it becomes difficult to determine a result of a test using the converted document 18, for example, a search result using a prefecture name as a key. That is, it is possible to generate the converted document 18 that does not make the user of the converted document 18 feel unnatural in the relationship between the character strings of the plurality of information items, and the usefulness of the data after masking can be improved.

  Further, according to the data masking device 14 of the second embodiment, a specific original character string of a plurality of information items related to each other is uniquely converted into a specific replacement character string, thereby ensuring the uniqueness of the conversion. In addition, since only the correspondence between the hash value and the replacement character string is recorded in the conversion dictionary, it is difficult to grasp the original character string corresponding to the replacement character string simply by looking at the conversion dictionary. Can be improved.

  The present invention has been described based on the second embodiment. This embodiment is an exemplification, and it will be understood by those skilled in the art that various modifications can be made to combinations of the respective constituent elements and processing processes, and such modifications are also within the scope of the present invention. is there.

  The second to fourth modifications of the first embodiment are also useful as modifications of the second embodiment. For example, the conversion dictionary held by the conversion dictionary holding unit 32 may directly associate the original character string with the replacement character string. FIG. 7 shows a modified conversion dictionary. The replacement character string determination unit 38 may search the conversion dictionary using a combination of original character strings of a plurality of information items as a key. In the example of FIG. 7, when the combination of the original contractor kanji surname and the original contractor kana surname is “Yamada” or “Yamada”, the replacement character string determination unit 38 combines the replacement contractor kanji surname and the replacement contractor kana surname "Kuriyama" and "Kuriyama" are decided.

(Third embodiment)
The data masking device 14 of the third embodiment has both the features of the first embodiment and the features of the second embodiment. The configuration of the information processing system 100 of the third embodiment is the same as that of the first and second embodiments (FIG. 1), and the functional block of the data masking device 14 of the second embodiment is also the first and second embodiments. It is the same as the embodiment (FIG. 2). Hereinafter, the description which overlaps with 1st Embodiment and 2nd Embodiment is abbreviate | omitted, and a different point is mainly demonstrated.

  FIG. 8 shows an example of a conversion dictionary held in the conversion dictionary holding unit 32 of the third embodiment. Each record of the conversion dictionary of the third embodiment includes a first item group and a second item for a first item group including a plurality of information items related to each other and a second item group including a plurality of information items related to each other. The correspondence between the replacement character string and the hash value of each group is recorded. The first item group is a combination of the contractor kanji surname and the contractor kana last name in the example of FIG. 8, and the second item group is a combination of the contractor kanji name and the contractor kana name in the example of FIG. It is desirable that there is no related surname between the first item group and the second item group. For example, it can be said that there is no direct relationship between first name and last name.

  Returning to FIG. 2, the replacement target information holding unit 30 identifies the identification information of the plurality of information items included in the first item group and the identification of the plurality of information items included in the second item group as information items to be replaced. Keep information. The original character string acquisition unit 36 refers to the replacement target information holding unit 30 and sets the original character string set for each of the plurality of information items included in the first item group and the plurality of information items included in the second item group. Get the original text string set for each.

  The replacement character string determination unit 38 includes at least one original character string of the first item group and at least one of the second item group among the plurality of replacement character string candidates recorded in the conversion dictionary of the conversion dictionary holding unit 32. A candidate recorded at a position in the dictionary specified based on a combination of two original character strings is determined as a replacement character string. The replacement character string determination unit 38 combines a plurality of original character strings of a plurality of information items included in the first item group and a plurality of original character strings of a plurality of information items included in the second item group. A replacement string may be determined using a column.

  The replacement character string determination unit 38 according to the embodiment combines all of the original character strings of the plurality of information items acquired by the original character string acquisition unit 36 and inputs the combined character string to a predetermined hash function to obtain a hash value To get. For example, the original character string “Yamada” of the contractor kanji surname of the first item group and the original character string “Yamada” of the contractor kana surname, the original character string “Taro” of the contractor kanji name of the second item group, and the contractor Get the hash value of “Yamada Yamada Taro” combined with the original character string “Taro”.

  The replacement character string determination unit 38 determines the replacement character string recorded at the line position of the conversion dictionary corresponding to the acquired hash value as the replacement character string used for masking, as in the first embodiment. For example, if the hash value of “Yamada and yet Taro Taro” is “500”, the replacement character string recorded in the 500th line of the conversion dictionary is determined as the character string used for masking. As a modification, the replacement character string determination unit 38 identifies a record in the conversion dictionary in which the acquired hash value is recorded, as in the third modification of the first embodiment, and the replacement character string recorded in the record May be determined as a character string used for masking. For example, if the conversion dictionary in FIG. 8 is referred to and the hash value of “Yamada and yet Taro Taro” is “123”, the replacement character string of the contractor kanji surname is determined as “Kuriyama”, and the contractor kana surname is determined. The replacement character string may be determined as “Kuriyama”. At the same time, the replacement character string of the contractor Kanji name may be determined as “high order”, and the replacement character string of the contractor Kana name may be determined as “Koji”. Other configurations and operations are the same as those in the first embodiment and the second embodiment.

  According to the data masking device 14 of the third embodiment, both the effects of the first embodiment and the effects of the second embodiment can be achieved. That is, it is difficult to infer the original original character string from the replacement character string, and the relationship between the original character strings of a plurality of information items related to each other can be maintained between the replacement character strings after masking. Thereby, the usefulness of the data after masking can be enhanced in both of information leakage prevention and data utilization.

  The present invention has been described based on the third embodiment. This embodiment is an exemplification, and it will be understood by those skilled in the art that various modifications can be made to combinations of the respective constituent elements and processing processes, and such modifications are also within the scope of the present invention. is there. The modification of the first example and the modification of the second embodiment are also useful for the third embodiment. For example, in the conversion dictionary of FIG. 8, the original character string may be directly associated with the replacement character string instead of the hash value.

  It should also be understood by those skilled in the art that the functions to be fulfilled by the constituent elements described in the claims are realized by the individual constituent elements shown in the embodiments and the modification examples or by their cooperation.

  DESCRIPTION OF SYMBOLS 14 Data masking apparatus, 30 Replacement object information holding part, 32 Conversion dictionary holding part, 34 Original document acquisition part, 36 Original character string acquisition part, 38 Replacement character string determination part, 40 Character string conversion part, 42 Conversion document output part

Claims (6)

A replacement character string holding unit for holding replacement character strings of a plurality of information items that are related to each other and are a plurality of information items recorded in the original data;
A character string replacement unit that replaces original character strings of the plurality of information items recorded in the original data with replacement character strings of the plurality of information items held in the replacement character string holding unit;
With
The relationship between the original character strings of the plurality of information items recorded in the original data is maintained between the replacement character strings of the plurality of information items held in the replacement character string holding unit. Data masking device.   The plurality of information items include a first item that represents a target in a first mode and a second item that represents the target in a second mode different from the first mode. The data masking device according to claim 1.   3. The data masking device according to claim 2, wherein a character string expressing the target in Chinese characters is set in the first item, and a character string expressing the target in kana is set in the second item. . A replacement character string determination unit;
The replacement character string holding unit holds a plurality of candidates at different positions for combinations of replacement character strings of the plurality of information items,
The replacement character string determination unit determines a candidate held at a position specified based on an original character string of at least one information item among the plurality of information items as a replacement character string of the plurality of information items. The data masking device according to any one of claims 1 to 3. Original characters of the plurality of information items recorded in the original data with reference to a storage area for storing replacement character strings of the plurality of information items related to each other and the plurality of information items recorded in the original data The data masking device executes a step of replacing a column with a replacement character string of the plurality of information items stored in the storage area,
Data masking characterized in that a relationship between original character strings of the plurality of information items recorded in the original data is maintained between replacement character strings of the plurality of information items stored in the storage area. Method. Original characters of the plurality of information items recorded in the original data with reference to a storage area for storing replacement character strings of the plurality of information items related to each other and the plurality of information items recorded in the original data A data masking device realizes a function of replacing a column with a replacement character string of the plurality of information items stored in the storage area,
A computer program characterized in that a relationship between original character strings of the plurality of information items recorded in the original data is maintained between replacement character strings of the plurality of information items stored in the storage area. .

Images