JP2020004011A - Information management system and information management method - Google Patents

Abstract

To provide an information management system which does not disclose personal information unless a personal information provider permits the disclosure of the personal information and designates the range of the disclosure, and makes it difficult for a malicious third person to attack the personal information.SOLUTION: An information management system includes: a terminal device of a user who provides personal information; a personal information management server for storing and managing the personnal information; a terminal device of a business operator who acquires a disclosure permission of the personal information of the user, and provides many specified users with information including the personal information; and a management server for controlling communication between the terminal devices of the user and the business operator and the personal information management server. The management server and the terminal devices of the user and the business operator are connected by an Internet line, and the personal information management server and the management server are connected by an internal exclusive line which is hardly accessed from the outside.SELECTED DRAWING: Figure 1

Description

  The present invention relates to an information management technique capable of preventing leakage of personal information stored in a server and unauthorized tampering.

  With the spread of the Internet, handling of personal information via the Internet is increasing. For example, personal information is uploaded when making a contract with a real estate agent or applying for a WEB sweepstakes campaign via the Internet.

  From the viewpoint of information security in such a situation, (1) providing a service by directly connecting an information management server that stores personal information and a business terminal that provides a service using the personal information; (2) Confirmation of browsing permission to the user by transmitting it from the information management server to the ID management server, (3) Verification of the user's electronic signature attached to the entire user information, and the like. Is being done.

  However, regarding (1), directly connecting the information management server and the business operator terminal may result in attacks by third parties, unauthorized use, data leakage, and the like. Regarding (2), there is a problem that if the user does not obtain the consent of the user in advance, the personal information is disclosed without the consent. In the case of (3), there is a problem that all personal information such as a credit card number is disclosed only by verifying only the electronic signature.

  Therefore, it is required to securely store and manage personal information data in order to prevent various kinds of unauthorized access including leakage of personal information.

  Specifically, the information management server where personal information is stored is not directly connected to the business operator terminal, and the personal information is disclosed to the business after obtaining the consent of the user in advance. In addition, there is a demand for a personal information management technology having a configuration in which the level of disclosure is selectable, rather than releasing all of the personal information at once.

  As a technique most similar to such a technique, for example, Patent Literature 1 discloses a technique capable of preventing data leakage without lowering search efficiency and preventing leakage by an insider such as an administrator. User information that collects user information, which is personal information, from users, and discloses the collected user information to users and businesses based on the scope of use. A management server, an item ID management server that generates and manages an item ID, which is information for associating each item of user information with the user, and provides the item ID within a use range based on a request; A personal information management system that includes a user device that provides personal information to a user and a business terminal that browses user information to provide a service. Database management method is disclosed that.

  In this database management method, user information is collected by a user information management server, a request for an item ID is made to the item ID management server, and each item of user information is collected by the item ID management server based on the item ID request. An item ID is created by generating a unique random number for the item, and the item ID is recorded in its own database in association with the user, transmitted to the user information management server, and managed by the user information management server. The user information is stored in its own database based on the item ID received from the server.

At the time of collecting user information, the user information management server transmits the hash value of each item of the user information, requests the item ID management server for the item ID, and the item ID management server performs the request based on the item ID request. Then, a unique random number is generated for each item of the user information to create an item ID, and the item ID and hash value of each item are recorded in its own database in association with the user.

  When browsing the user information, the user information management server issues an item ID request to the item ID management server in order to disclose the user information in response to the browsing request of the user device or the business entity terminal. The management server searches its own database in response to the item ID request, and transmits the item ID to the user information management server for the items permitted to be browsed.

  For items that are not permitted to be browsed, the hash value is transmitted to the user information management server. For items that are permitted to be browsed by the user information management server that has received the item ID and hash value, the item ID is used. It searches its own database and transmits the user information to the user device or the business operator terminal.

  For items for which browsing is not permitted, the hash value is transmitted to the user device or business terminal, and the user device and business terminal that have received the user information and the hash value are permitted to browse. Only browse that user information.

  Further, for items that are permitted to be browsed, a hash value is generated from the user information, and for items that are not permitted to be browsed, the received hash value is used to generate the hash value of the user assigned to the entire user information. A database management method characterized by verifying an electronic signature is disclosed.

  This database management method is an excellent personal information management method. However, since user information such as personal information is stored in a user information management server that can be accessed by the terminal device on the business side, the database management method is used via an Internet line. Therefore, it is impossible to avoid attacks by malicious third parties.

Japanese Patent No. 4708177

  In view of the above circumstances, the present invention does not disclose personal information unless the provider of the personal information performs permission of disclosure of personal information and designation of the range of disclosure, and an individual by a malicious third party. It is an object to provide an information management system that makes it difficult to attack information.

As means for solving the above problems, the invention according to claim 1 of the present invention provides a terminal device of a user that provides personal information, a personal information management server that stores and manages personal information, A terminal device of a business operator that obtains information disclosure permission and provides information including personal information to a specified number of users, and a management server that controls communication between the user and business terminal devices and the personal information management server And,
The management server and the terminal devices of the user and the operator are connected via an Internet line,
An information management system is characterized in that the personal information management server and the management server are connected by an internal dedicated line that is difficult to access from the outside.

According to a second aspect of the present invention, there is provided an information management method in the information management system according to the first aspect,
Step 1 of registering the personal information in advance from the terminal device of the user in the management server;
Step 2 in which the management server issues a random number ID for each user, transmits the random number ID to the personal information management server, and stores the personal information management server;
Step 3 in which the terminal device of the business operator requests the management server to disclose personal information of a user;
A step 4 in which the management server transmits the contents of the disclosure request to the user's terminal device, and asks the user's terminal device for the content of identity verification according to the level of personal information;
Step 5 in which the user terminal device transmits a public key corresponding to the level of personal information to the management server;
Step 6 in which the management server confirms the identity of the user with a public key corresponding to the level of personal information and the random number ID;
After step 6, the management server reissues the random number ID, transmits the random number ID to the personal information management server, and stores the personal information management server in step 7,
Step 8 in which the personal information management server transmits to the management server that the identification of the user has been completed;
A step 9 in which the management server transmits to the user terminal device that the user identification has been completed;
A step 10 in which the terminal device of the user selects a range of disclosure of the personal information of the user and transmits to the management server that only the selected range is permitted;
A step 11 in which the management server transmits to the personal information management server that only the selected range is permitted;
A step 12 in which the personal information management server transmits the permitted range of personal information to the management server;
Transmitting the data created based on the received personal information in the permitted range to the terminal device of the business operator, wherein the management server comprises a step 13.

  According to the information management system of the present invention, a management server that manages information, a terminal device of a specific number of users who provide personal information, and a terminal device of a business entity that provides a service using the personal information, While connected via the Internet line, the personal information management server that stores the user's personal information is connected to the management server via an internal dedicated line. Therefore, since it is difficult to access the personal information management server storing the personal information from the outside, the possibility that the personal information is leaked to a third party or the possibility that the personal information is falsified is low.

  Further, according to the information management method of the present invention, by using the information management system of the present invention, it is possible to realize information management in which there is a low possibility that personal information is leaked to a third party or falsified by the third party. It becomes possible. Further, according to the information management method of the present invention, a business providing a service using personal information of a user, unless the user who provided the personal information permits the disclosure and specifies the range of disclosure, We cannot provide information including personal information.

FIG. 1 is an explanatory diagram illustrating the configuration of an information management system according to the present invention. FIG. 4 is a sequence diagram illustrating a work flow of the information management system of the present invention.

<Information management system>
An information management system according to the present invention will be described with reference to FIG.
An information management system according to the present invention is an information management system that allows a business operator that provides a service using personal information of a user with the permission of the user to use the personal information.

  The information management system of the present invention includes a terminal device of a user that provides personal information, a personal information management server that stores and manages a plurality of personal information, and a personal information that is disclosed to a specified number of users. The system includes a terminal device of a business entity that provides information including information, and a management server that controls communication between the terminal device of the user, the terminal device of the business entity, and the personal information management server.

  The management server, the user's terminal device and the business operator's terminal device are connected via an Internet line, and the personal information management server and the management server are connected via an internal dedicated line which is difficult to access from outside. The feature is that.

(User's terminal device, operator's terminal device)
There is no particular limitation on the user's terminal device. For example, a smartphone, a mobile phone, a personal computer, and the like can be given.
Although there is no particular limitation on the terminal device of the parliamentary company, a personal computer having a higher information processing capability than a smartphone or a mobile phone can be suitably used because it handles personal information of many users.

(Personal information management server)
Since the personal information management server has a main function of storing personal information, any storage device can be used without particular limitation. For example, a personal computer equipped with a storage device, various external storage devices (such as a hard disk device, an SSD (Solid State Drive), and a file server connected via a network) can be used.

(Management server)
As the management server, a so-called server device which is a computer having a large-capacity storage device communicably connected to the personal information management server and the terminal devices of the user and the business can be used.

  The management server and the terminal devices of the user and the business are connected by an Internet line. Therefore, a general user can easily access the management server and register personal information of the user, for example, by accessing a dedicated homepage created by a company that operates the management server. For example, it is possible to register personal information of more than 10,000 users without any problem.

  The business operator can access the management server through the Internet line similarly to the user.

  The management server stores and manages personal information data registered by the user in the personal information management server. The management server has a function of processing the stored personal information data. The content to be processed is not particularly limited. For example, data is processed according to a format requested by the business operator, and the processed data is passed to the business operator.

  The management server and the personal information management server are connected using an internal dedicated line inside the management company of the management server. This internal leased line is a communication line independent of the Internet. Therefore, the possibility that the personal information management server storing the personal information is attacked by a malicious third party can be reduced as compared with the case where the personal information management server is directly connected to the Internet line.

<Information management method>
The information management method of the present invention will be described with reference to FIG.
The information management method of the present invention is an information management method in the information management system of the present invention.

  Step 1 in which personal information is registered in advance from a user's terminal device to a management server, step 2 in which the management server issues a random number ID for each user, and transmits and stores the random number ID in the personal information management server. Step 3 in which the device requests the management server to disclose the personal information of the user, and the management server transmits the contents of the disclosure request to the terminal device of the user, and confirms the identity according to the level of the personal information. Step 4 in which the content is requested from the user's terminal device; step 5 in which the user's terminal device transmits a public key corresponding to the level of the personal information to the management server; Step 6 in which the identity of the user is identified using the public key and the random number ID. After step 6, the management server re-issues the random number ID, transmits it to the personal information management server, and stores the random number ID in the personal information management server. Step 7, the personal information management server transmits to the management server that the identification of the user has been completed to the management server, and the management server reports to the terminal device of the user that the identification of the user has been completed. Step 9 of transmitting, Step 10 in which the terminal device of the user selects the range of disclosure of the personal information of the user, and transmitting to the management server that only the selected range is permitted, and Step 11 of transmitting to the personal information management server that only the range is permitted, step 12 of transmitting the personal information of the permitted range to the management server, and step Transmitting the data created based on the personal information in the range to the terminal device of the business operator.

(Step 1)
A user transmits user information, which is personal information, to a management server through an Internet line using a user terminal. The management server deletes the received user information from the management server after registering the received user information in the personal information management server.

(Step 2)
The management server issues a random number ID for each registered user information, and transmits the random number ID to the personal information management server through an internal dedicated line. Upon receiving the random number ID, the personal information management server stores the random number ID and the user information as a set.
By repeating Step 1 and Step 2, a large number of user information, which is personal information, is accumulated as information that is set with a random number ID issued for each piece of the user information.

(Step 3)
The business operator sends a request for disclosure of user information to the management server using the business operator terminal. The request for disclosure includes at least the designation of the level (or range) of disclosure of personal information.

(Step 4)
When the management server receives the disclosure request from the business operator, it determines the importance and determines the number of public keys. A one-time password is sent to the user terminal according to the number of public keys. That is, for each level of disclosure of personal information, a request is made to the user who is the provider of personal information to confirm whether or not the disclosure is permitted.
For example, for the level of browsing such as an address and a telephone number, authentication of a one-time password or the like is performed on a terminal of a user who is a provider of the personal information by using, for example, SMS (Short Mail Service) or e-mail. By sending the code and inputting the authentication code on a screen of a dedicated application (Application Software) using a smartphone or the like, the identity can be confirmed. Furthermore, for the level of browsing of credit information with a high level linked to a security card, for example, by inputting a fingerprint code of the user and a security code such as 3D secure of a credit card on the screen of the dedicated application, You can verify your identity.

(Step 5)
When the user terminal receives confirmation from the management server as to whether disclosure is possible for each disclosure level, the user opens the dedicated application, enters a one-time password, and enters his or her personal information that can be disclosed. Confirm on the selectable screen and send the public key for each level to the management server. At the same time, the random number ID is transmitted to the management server. For example, one public key may use a one-time password, and two public keys may use a user's fingerprint authentication and a security code such as a 3D secure credit card. May be. Since encryption is performed using the public key, two public keys are more difficult to decrypt than one.

(Step 6)
The management server instructs the personal information management server to perform identity verification using the public key for each level received from the user terminal and the random number ID stored in the personal information management server.

(Step 7)
The management server issues a new random number ID each time the management server and the personal information management server communicate, and the personal information management server updates and stores the random number ID of the user.

(Step 8)
The personal information management server performs identity verification based on the public key for each level received from the management server and the random number ID stored in the personal information management server. When the identity is confirmed, the fact that the identity is confirmed is transmitted to the management server. If the identity cannot be confirmed, the fact that the identity was not confirmed is transmitted to the management server.

(Step 9)
The management server transmits to the user terminal that the identity has been confirmed or that the identity has not been confirmed.

(Step 10)
The user selects, via the user terminal, a range in which disclosure is permitted in response to a request for disclosure of personal information, and transmits the range to the management server.

(Step 11)
The management server permits the personal information management server to disclose personal information limited to the range of disclosure selected by the user.

(Step 12)
The personal information management server transmits the personal information permitted to be disclosed to the management server.

(Step 13)
The management server processes the data using the personal information permitted to be disclosed, and then transmits the processed data to the company terminal.

  As described above, only when the user who is the provider of personal information specifies the range of personal information disclosure through the user terminal and permits the disclosure of personal information within that range, the business operator will disclose through the business terminal The information processed by the management server can be obtained by using the personal information in the range where is permitted.

  The information management system of the present invention provides a personal information service provider that provides various services using a large number of personal information, unless a permission including the range of disclosure of the personal information from the personal information provider is obtained. Is an information management system that cannot be obtained. In addition, since the personal information management server that stores personal information is not directly connected to the Internet, the personal information management server is configured to be less susceptible to malicious attacks by third parties.

  Therefore, the information management system can be suitably applied to a web-type prize campaign using a smartphone or a personal computer. When applying for a sweepstakes campaign, personal information such as the applicant's address and name must be uploaded, but such personal information is stored on a personal information management server installed in the company that operates the information management system Therefore, it is difficult for information to be leaked or falsified.

  Further, it can be suitably used as a real estate information management system of a real estate company. For example, if you want to sell a real estate property that you own, in addition to real estate-related information such as the size and condition of the real estate land and buildings, the surrounding environment, etc., as well as personal information such as the address, name, Register information.

  The personal information of the owner needs to be strictly managed, but in the information management system of the present invention, the personal information management server storing the personal information is not directly connected to the Internet. Hardly suffers from information leaks or tampering.

Claims (2)

Terminal device of the user who provides personal information, personal information management server that stores and manages personal information, and with permission to disclose the personal information of the user, provides information including personal information to a specified number of users And a management server that controls communication between the user and the terminal device of the business operator and the personal information management server,
The management server and the terminal devices of the user and the operator are connected via an Internet line,
An information management system, wherein the personal information management server and the management server are connected by an internal dedicated line that is difficult to access from the outside. An information management method in the information management system according to claim 1, wherein
Step 1 of registering the personal information in advance from the terminal device of the user in the management server;
Step 2 in which the management server issues a random number ID for each user, transmits the random number ID to the personal information management server, and stores the personal information management server;
Step 3 in which the terminal device of the business operator requests the management server to disclose personal information of a user;
A step 4 in which the management server transmits the contents of the disclosure request to the user's terminal device, and asks the user's terminal device for the content of identity verification according to the level of personal information;
Step 5 in which the user terminal device transmits a public key corresponding to the level of personal information to the management server;
Step 6 in which the management server confirms the identity of the user with a public key corresponding to the level of personal information and the random number ID;
After step 6, the management server reissues the random number ID, transmits the random number ID to the personal information management server, and stores the personal information management server in step 7,
Step 8 in which the personal information management server transmits to the management server that the identification of the user has been completed;
A step 9 in which the management server transmits to the user terminal device that the user identification has been completed;
A step 10 in which the terminal device of the user selects a range of disclosure of the personal information of the user and transmits to the management server that only the selected range is permitted;
A step 11 in which the management server transmits to the personal information management server that only the selected range is permitted;
A step 12 in which the personal information management server transmits the permitted range of personal information to the management server;
Transmitting the data created based on the received personal information in the permitted range to the terminal device of the business operator.

Images